The International Society of Forensic Computer Examiners  

image image image image image image image image image image

    ISFCE Certification Board


    Craig Ball 

    Craig Ball of Austin, Texas is a Board Certified trial lawyer, certified computer forensic examiner and electronic evidence expert. He's dedicated his career to teaching the bench and bar about forensic technology and trial tactics. After decades trying lawsuits, Craig limits his practice to service as a court-appointed special master and consultant in computer forensics and e-discovery. A prolific contributor to educational programs worldwide--having delivered over 700 presentations and papers--Craig’s articles on forensic technology and electronic discovery frequently appear in the national media. He writes a monthly award winning column on computer forensics and e-discovery for Law Technology News and called "Ball in your Court" and a monthly column on computer forensics for Forensic Focus.  Craig Ball has served as the Special Master or testifying expert on computer forensics and electronic discovery in some of the most challenging, front page cases in the U.S. He also currently serves as an Adjunct Professor at the University of Texas School of Law, teaching Electronic Discovery and Digital Evidence.

    Mr. Ball's education includes:

    Rice University (B.A., 1979, triple major)
    University of Texas (J.D., with honors, 1982)
    Oregon State University (Computer Forensics certification, 2003)
    EnCase Intermediate Reporting and Analysis Course (Guidance Software 2004)
    WinHex Forensics Certification Course (X-Ways Software Technology 2005)
    Certified Data Recovery Specialist (Forensic Strategy Services 2009)
    Numerous other classes on computer forensics and electronic discovery.

    Mr. Balls's selected professional activities include:

    Board Certified in Personal Injury Trial Law by the Texas Board of Legal Specialization
    Certified Computer Forensic Examiner, Oregon State University and NTI
    Certified Computer Examiner (CCE), International Society of Forensic Computer Examiners
    Member, Editorial Advisory Board, Law Technology News and (American Lawyer Media)
    Board Member, Georgetown University Law School Advanced E-Discovery Institute and E-Discovery Academy
    Member, Sedona Conference WG1 on Electronic Document Retention and Production
    Instructor in Computer Forensics and Electronic Discovery, United States Department of Justice
    Lecturer/Author on Electronic Discovery for Federal Judicial Center and Texas Office of the Attorney General
    Specialist Lecturer, Electronic Discovery, University of Texas School of Law faculty
    Instructor, HTCIA Annual 2010, Cybercrime Summit, 2006, 2007; SANS Instructor 2009, PFIC 2010, CEIC 2011
    Special Prosecutor, Texas Commission for Lawyer Discipline, 1995-96
    President, Houston Trial Lawyers Association (2000-01); President, Houston Trial Lawyers Foundation (2001-02)


    Dan Mares

    Dan Mares founded Mares and Company, LLC in 1998 after retiring from a 27-year career as a federal law enforcement agent. He had responsibilities as an Investigator both in the field and in internal security. During that time he became interested in and obtained training in computer science. He began developing software programs designed to analyze large amounts of data retrieved from mainframe computer databases. Those programs were the precursors to the current Maresware data analysis software. Around 1986, he began working in the area of what is now termed 'computer forensics.' In the search for tools more suitable to the specific needs of computer forensic investigations, he then began developing software that was the precursor to Maresware computer forensic software.

    While serving as a federal agent, Dan assisted in the development of the Seized Computer Evidence Recovery Specialist (SCERS) course at the Federal Law Enforcement Training Center in Glynco, Georgia. He subsequently served as a SCERS instructor. He also assisted in the development and teaching of the Basic Data Recovery and Advanced Data Recovery classes at the National White Collar Crime Center.

    Mr. Mares is frequently an invited speaker and instructor in the field of computer forensics, fraud examination and other related areas. A few of the organizations he has appeared before include: International Association of Computer Investigative Specialists (IACIS); University of Texas, Austin.; Kennesaw State College; U.S. Secret Service; Southeast CyberCrime Institute; FBI Academy in Quantico, Va.; High Technology Crime Investigation Association(HTCIA); Institute of Police Technology and Management (IPTM); and Norwegian National Police Academy.

    Dan continues to provide forensic and technical computer assistance, conduct forensic investigations, and to provide training to individuals, corporations and government agencies. He has provided his services to numerous state and federal agencies, Big 5 accounting firms, law firms and courts, and private corporations of all sizes. He has developed and continually updates Basic and Advanced Computer Forensics Training Seminars offered through Mares and Company, LLC. In addition, he conducts training in the use of his own Maresware software, which is used by law enforcement, intelligence agencies, investigators, auditors, fraud examiners and other professionals worldwide.

    Mr. Maresis a highly effective expert witness and litigation consultant. His combined skills in forensic investigations and in forensic software development enhance his ability to testify effectively in court, particularly regarding the technical aspects of electronic evidence analysis and forensic methodology.

    Dan is professionally active in a number of organizations devoted to the advancement of the science and practice of computer forensics. Some of his memberships (and current or past office holdings) include:

    • HTCIA, High Technology Crime Investigation Association Atlanta chapter president, vice president, secretary
    • IISFA, International Information Systems Forensics Association Atlanta Chapter, Training director
    • IACIS, International Association of Computer Investigative Specialists IACIS.
    • ISSA, Information Systems Security Association.

    He was also involved during the early organizing of the group which has become NCTP (National CyberCrime Training Partnership). Dan has also devoted time and expertise to a number of NIST endeavors to create reference texts for computer forensic investigators and analysts.

    Mr. Mares holds certifications as a:

    Certified Information Forensics Investigator (CIFI) from ISFA (2003)
    Certified Computer Examiner (CCE)

    Mark McKinnon

    Mr. McKinnon’s Experience:

    Adjunct Faculty Member - Davenport University

    (Educational Institution; Higher Education industry)

    January 2009 — Present (1 year 7 months)

    Mr. McKinnon is currently one of the instructors teaching the Computer Forensics Course at the Lettinga campus in Grand Rapids

    Principal - RedWolf Computer Forensics

    (Computer & Network Security industry)

    January 2005 — Present (5 years 7 months)

    Performing Computer Forensics examinations and imaging. Create custom open source tools to aid in computer forensics examinations. Data retrieval/restoration - Deleted files, Formatted disks, CD-RW's, email's documents, images, etc.. Electronic Discovery.

    Database Administrator - Haworth, Inc

    (Privately Held; 5001-10,000 employees; Furniture industry)

    May 1990 — Present (20 years 3 months)

    Administor, Design, Perfromance Tunning, Backup, Recovery, Clonning of DB2, Oracle and SQL Server Databases. I have created automation scripts to handle daily monitoring and maintenance activities as well as alert me to potential problems. The databases range in size from 100+ meg to over 1/2 Terabyte.

    Mr. McKinnon’s Education:

    Grand Valley State University

    Master of Science , Software Engineering , 1991 — 1995

    Grand Valley State University

    BS , Computer Science and Information Systems , 1986 — 1991      



    Dustin Sachs
    Dustin Sachs is a Managing Consultant in the Digital Forensics and Incident Response practice at Navigant Consulting. He oversees and manages the computer forensics capabilities, including the forensics lab, in the Houston office. He assists with all phases of the forensic process from planning and collection to analysis and reporting so that attorneys, auditors, and investigators make informed decisions. He provides objective assessments of digital evidence in matters related to legal or ethical issues, data breach incidents, theft of valuable information, and other corporate investigations.

    For more than nine years, Dustin has analyzed thousands of computer laptops, desktops, servers, and mobile devices in the support of civil and criminal litigation and internal investigative matters. He has received extensive training in computer forensics, evidence handling, and computer investigations.

    Educational Background:
    Bachelor of Arts, Political Science, University of South Florida
    Graduate Certificate, Computer Forensics, University of Central Florida

    Certified Cyber Forensics Professional (CCFP)
    Certified Computer Examiner (CCE)
    Certified Fraud Examiner (CFE)
    EnCase Certified Examiner (EnCE)
    Cellebrite Certified Mobile Examiner (CCME)
    Licensed Private Investigator in the states of Texas and Florida