Qualifications and Skill Levels of Digital Forensics Practitioners in South Africa: An Exploratory Study

  • Mannis Stenvert
  • Irwin Brown
Conference paper
Part of the Communications in Computer and Information Science book series (CCIS, volume 963)


Digital forensic investigations require competence in skills associated with an investigation which is often measured through qualifications consisting of scholastic education, digital forensic training, digital forensic certification, and digital forensics work-related experience. While prior research has been conducted into the qualifications of digital forensic practitioners within the South African environment, the association between qualifications and measures of skill has not been addressed. This research study utilises a conceptual research framework to test the association between qualifications and the skills levels of digital forensic practitioners in South Africa. The findings show that continuous training and the level of testimony provided by a digital forensics practitioner in a civil or criminal procedure are positively associated with overall skills level. Other factors such as formal education, number of forensics training courses, certification, and work-related experience did not have a direct association with the measured skill. Further research is hence needed to understand the role of these factors in improving skill levels.


Digital forensics Qualifications and skills South Africa 


  1. 1.
    Bhattacherjee, A.: Social Science Research: Principles, Methods, and Practices, 2nd edn. University of South Florida Press, Gainesville (2012)Google Scholar
  2. 2.
    Bloom, B.S., Engelhart, M.D., Furst, E.J., Hill, W.H., Krathwohl, D.R.: Taxonomy of Educational Objectives: The Classification of Educational Goals. David McKay Company, Philadelphia (1956)Google Scholar
  3. 3.
    Carlton, G., Worthley, R.: Identifying a computer forensics expert: a study to measure the characteristics of forensic computer examiners. J. Dig. Forensic Secur. Law 5(1), 5–19 (2010)Google Scholar
  4. 4.
    Carrier, B.D., Spafford, E.H.: An event-based digital forensic investigation framework. In: Proceedings of Digital Forensic Research Workshop, pp. 11–13 (2004)Google Scholar
  5. 5.
    Department of Higher Education and Training: Organising Framework for Occupations (OFO), Guideline No. 2013, p. 33, South Africa (2013)Google Scholar
  6. 6.
    Department Justice and Constitutional Development: Courts in South Africa. Governm. Communic.
  7. 7.
    European Network of Forensic Science Institutes: Guidelines for Best Practice in the Forensic Examination of Digital Technology. In: Best Practice Guide 6(FIT-2005-001), p. 30 (2009)Google Scholar
  8. 8.
    Foit, D., Vukalović, J., Hausknecht, K.: Competencies and Skills needed for Digital Forensic Trainer. In: MIPRO 2015 Proceedings of 38th IEEE International Convention on Information and Communication Technology, Electronics and Microelectronics, pp. 1376–1381 (2015)Google Scholar
  9. 9.
    Grobler, M.: Digital forensic standards: international progress. In: SAISMC 2010 Proceedings of South African Information Security Multi-Conference, pp. 216–271 (2010)Google Scholar
  10. 10.
    Harichandran, V.S., Breitinger, F., Baggili, I., Marrington, A.: A cyber forensics needs analysis survey: revisiting the domain’s needs a decade later. Comp. Secur. 57, 1–13 (2016)CrossRefGoogle Scholar
  11. 11.
  12. 12.
    IOS: Information Technology – Security Techniques – Investigation Principles and Processes. Standard ISO/IEC 27043:2015 (2015)Google Scholar
  13. 13.
    Jordaan, J.: A Sample of Digital Forensic Quality Assurance in the South African Criminal Justice System. In: ISSA 2012 Proceedings International Information Security for South Africa Conference (2012)Google Scholar
  14. 14.
    Jordaan, J.: An Examination of Validation Practices in relation to the Forensic Acquisition of Digital Evidence in South Africa. M.-Diss., Rhodes Univ. (2014)Google Scholar
  15. 15.
    Jordaan, J., Bradshaw, K.: The current state of digital forensic practitioners in South Africa. In: ISSA 2015 Proceedings of International Information Security for South Africa Conference (2015)Google Scholar
  16. 16.
    Köhn, M.D., Eloff, M.M., Eloff, J.H.P.: Integrated digital forensic process model. Comp. Secur. 38, 103–115 (2013)CrossRefGoogle Scholar
  17. 17.
    Kruse, W.G., Heiser, J.G.: Computer Forensics: Incident Response Essentials. Addison-Wesley, Boston (2001)Google Scholar
  18. 18.
    Laykin, E.: Investigative Computer Forensics: The Practical Guide for Lawyers, Accountants, Investigators, and Business Executives. Wiley, Hoboken (2013)CrossRefGoogle Scholar
  19. 19.
    Leung, W.S.: Cheap latex, high-end thrills: a fantasy exercise in search and seizure. In: Liebenberg, J., Gruner, S. (eds.) SACLA 2017. CCIS, vol. 730, pp. 265–277. Springer, Cham (2017). Scholar
  20. 20.
    Liu, H.: Comparing Welch’s ANOVA, a Kruskal-Wallis Test and Traditional ANOVA in case of Heterogeneity of Variance. M.-Diss., Virginia Commonwealth Univ. (2015)Google Scholar
  21. 21.
    Lunn, D.A.: Computer Forensics – An Overview. Technical report, SANS Inst., (2000)Google Scholar
  22. 22.
    Manca, F.: Why Do We Need to Measure Skills Better? Better Indicators for Better Policies! Technical report (2013).
  23. 23.
    McKemmish, R.: When is digital evidence forensically sound? In: Ray, I., Shenoi, S. (eds.) DigitalForensics 2008. ITIFIP, vol. 285, pp. 3–15. Springer, Boston, MA (2008). Scholar
  24. 24.
    Minister of Justice and Correctional Services: Republic of South Africa Cybercrimes and Cybersecurity Bill (2017)Google Scholar
  25. 25.
    National Research Council: Strengthening Forensic Science in the United States: A Path Forward. National Academies Press (2009)Google Scholar
  26. 26.
    Republic of South Africa: National Qualifications Framework Act 67 of 2008. Government Gazette 32233(25) (2009)Google Scholar
  27. 27.
    Rogers, M.K., Seigfried, K.: The future of computer forensics: a needs analysis survey. Comp. Secur. 23(1), 12–16 (2004)CrossRefGoogle Scholar
  28. 28.
    Saunders, M.N.K., Lewis, P., Thornhill, A.: Research Methods for Business Students, 7th edn. Pearson, London (2015)Google Scholar
  29. 29.
    Squire, D.: Understanding the Organising Framework for Occupations. Technical report (2012).
  30. 30.
    Srinivasan, S.: Digital forensics curriculum in security education. J. Inf. Technol. Educ. 12, 147–157 (2013)Google Scholar
  31. 31.
    Stander, A., Johnston, K.: The need for and contents of a course in forensic information systems and computer science at the University of Cape Town. Informing Sci.: Int. J. Emerg. Transdiscipl. 4(1), 63–72 (2007)Google Scholar
  32. 32.
    Taylor, C., Endicott-Popovsky, B., Phillips, A.: Forensics education: assessment and measures of excellence. In: SADFE 2007 Proceedings of 2nd International Workshop on Systematic Approaches to Digital Forensic Engineering, pp. 155–165 (2007)Google Scholar
  33. 33.
    United Nations Office on Drugs and Crime: Staff Skill Requirements and Equipment Recommendations for Forensic Science Laboratories (No. ST/NAR/2/ REV.1), p. 138, UNO (2011)Google Scholar
  34. 34.
    Valjarevic, A., Venter, H.S.: A comprehensive and harmonized digital forensic investigation process model. J. Forensic Sci. 60(6), 1467–1483 (2015)CrossRefGoogle Scholar
  35. 35.
    Valjarevic, A., Venter, H.S.: Harmonised digital forensic investigation process model. In: ISSA 2012 Proceedings International Information Security for South Africa Conference (2012)Google Scholar
  36. 36.
    Valli, C.: Establishing a vendor neutral skills based framework for digital forensics curriculum development and competence assessment. In: Proceedings of Australian Digital Forensics Conference (2006)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  1. 1.Department of Information SystemsUniversity of Cape TownCape TownSouth Africa

Personalised recommendations