Legaltech News: Digital Forensic Testimony 101

May 27, 2015

A panel of forensic investigators and expert witnesses gathered to discuss pitfalls and tips in testifying.

Originally published by: Legaltech News

By: Sean Doherty

Digital forensic investigators get their day in court but it may never end for some who regularly testify as expert witnesses. At CEIC (Computer Examinations and Investigations Conference) in Las Vegas on May 19,  a panel of forensic investigators and expert witnesses gathered to discuss some of the pitfalls to avoid and tips for navigating the hot seat between judge and jury.

The panel entitled “Forensic Evidence in Court,” was moderated by Suzanne Widup, senior analyst at Verizon Enterprise Services, and included David Cowen, partner at G-C Partners; James Vaugh, managing director at Intelligent Discovery Solutions; Jonathan Rajewski, director at Senator Patrick Leahy Center for Digital Investigation; and Sheryl Falk, partner at Winston & Strawn.

The format for the panel was entirely interactive. Widup had a list of questions for the panelists posed via email and questions were presented from the audience.

QUESTION AND ANSWER

Attendee: How do you get qualified on the stand as an expert?

Cowen: That, probably, is the easiest part. Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993), layed down three foundations: qualified by education, experience, or by training. You don’t have to have all three. You only need one. The important thing when you’re doing it is that you’re an expert in your field. They will go through your background and experience to understand what it is that fits the criteria that you are in fact an expert in the field. In the legal world expert is a pretty vague word. It’s anyone who knows more than the layman.

Attendee: What are the differences between a testifying and a consulting expert?

Vaugn: Hired as a consultant. Later you may become an expert. Or you can be hired as the expert and you will do some expert consulting. The difference there being what’s discoverable from the beginning vs. what’s not. What are you going to put in emails vs. not. Everything from the time you become a consultant is arguably discoverable.

Cohen: I think you’re going to hear the word discoverable, a lot.

Attendee: Do any of you have any experience with the Office 365 litigation hold feature and is it sufficient on the court to do discovery on mailboxes in litigation hold after the fact? Although it preserves all user data, it may or may not preserve all system data.

Vaugh: I would love to hear what Sheryl has to say as a lawyer, but I want to respond as a technical consultant. The fact is that there is no tool that is perfect. It is what is available, does the tool work, has the tool been validated, have you tested the tool, can you replicate the results, and if so, does it meet the standard of reasonableness. That’s really what your faced with, it’s not perfection. And there is a difference in collecting for electronically stored information and forensics.

ADVICE

Do not bring a computer to a deposition unless there is a request to image it at the deposition.

Eye contact: Making eye contact is a big thing. Whenever you answer a question, try to make eye contact with the judge or jury because they are the only people who matter when you testify. When you make eye contact with the judge or jury, you add to your credibility. It does you no good to look at the lawyer when answering questions.

Judge: If you have any questions on the judge’s preferences, ask the lawyer. He or she will know all about the judge.

Notes: follow your standard practice in using notes to write reports. If you use notes, use fact-based notes and make sure your attorneys know. And if there is no request for notes from the opposing party, and you incorporate the contents of your notes into reports, then there’s no reason to keep the notes.

Plain talk: The art of testimony is being able to address your audience. You have to be able to beak down technical concepts and use simple analogies, while still technically true, describe what you are going to do in a way they can understand. Keep testimony simple and concise.

Preparation: To better prepare yourself, meet the lawyer and know what he or she will ask you ahead of time; or give them a list of questions to use. If you have to read from your report on the stand, you will lose credibility.

Yes-or-No. In a deposition don’t allow yourself to be limited to a yes or no answer. For example, Question: “Isn’t it true that you did this?” Answer: “Well, it sounds like you’re asking me a hypothetical, so I am going to give you a hypothetical answer” or “While that’s possible, it’s not plausible, and I’d like to explain to you why it’s not plausible.”

 
Original Source: http://www.legaltechnews.com/id=1202727360710/Digital-Forensic-Testimony-101#ixzz3bLTBauEc

 

Filed under: Article,Expert Witnesses,Testimony,Trial Strategy

Leave a Comment

(required)

(required), (Hidden)

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

TrackBack URL  |  RSS feed for comments on this post.


Contact

Email: experts@ALM.com
Phone: 888-809-0133

Archives

Expert Witnesses

ALM Experts Blog

Admin