Guide to Computer Forensics and Investigations, Fifth Edition 15-1
Chapter 15
Expert Testimony in Digital Investigations
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
Guide to Computer Forensics and Investigations, Fifth Edition 15-2
Lecture Notes
Overview
Chapter 15 explains the rules of evidence and procedure as they apply to testimony.
You learn about the types of testimony—for trials, depositions, and hearings—and the
difference between a fact witness and an expert witness. You learn how to avoid some
Chapter Objectives
• Explain guidelines for giving testimony as a fact witness or an expert witness
• Describe guidelines for testifying in court
• Explain guidelines for testifying in depositions and hearings
• Describe procedures for preparing forensics evidence for testimony
Teaching Tips
Preparing for Testimony
1. Describe both types of testimony:
3. Explain that when preparing your testimony, you should consider the following
questions:
a. What is my story of the case?
b. What can I say with confidence?
c. What is the client’s overall theory of the case?
d. How does my opinion fit into the theory of the case?
e. What is the scope of the case? Have I gone too far?
f. Have I identified the client’s needs for how my testimony fits into the overall
theory of the case?
Guide to Computer Forensics and Investigations, Fifth Edition 15-3
Documenting and Preparing Evidence
1. Provide some guidelines for performing these tasks:
a. Document your steps to prove them repeatable
b. Validate your tools and verify your evidence with hash algorithms
c. Do not use formal checklists since opposite attorneys can challenge them
d. Collect evidence and document the tools used during the process
e. Maintain the chain of custody
Reviewing Your Role as a Consulting Expert or an Expert Witness
1. Describe some recommended practices for a consultant expert or an expert witness:
a. Do not record conversations or telephone calls
b. Federal information requires that you provide:
i. Preceding four years of experience
ii. Ten years of any published writings
iii. Previous compensations
Teaching
Tip
When approached to give expert testimony, find out whether you are the first one
asked. If you aren’t, find out why other experts might have been contacted but
not retained.
Creating and Maintaining Your CV
1. Explain that the purpose of your curriculum vitae (CV) is to list your professional
2. Describe some recommendations to create your CV and keep it updated:
a. Show you continuously enhance your skills
b. Detail specific accomplishments
Teaching
Tip
Keep a separate list of books you’ve read on your area of expertise, but don’t
include this list in your CV because it might suggest that you approve of
everything written in these books.
Preparing Technical Definitions
1. List some of the terms you should prepare a technical definition for before a trial:
a. Digital or computer forensics
b. CRC-32, MD5, and SHA-1 hashing algorithms
c. Image files and bit-stream copies
Preparing to Deal with the News Media
1. Mention that some legal actions generate interest from the news media.
2. Describe some of the reasons to avoid contact with news media, including:
a. Your comments could harm the case and create a record that can be used against
you
Testifying in Court
1. Describe the four procedures followed during a trial:
a. Your attorney presents you as a competent expert or fact witness
Guide to Computer Forensics and Investigations, Fifth Edition 15-5
Understanding the Trial Process
1. Explain each step from a typical trial:
a. Motion in limine
b. Impaneling the jury
Providing Qualifications for Your Testimony
1. Explain the process of qualifying as an expert witness. This qualification phase is called
voir dire.
If you know that the opposing expert witness taught or took a course that used a
General Guidelines on Testifying
1. Provide some guidelines for testifying on a trial:
a. Be professional and polite
b. Be conscious of the jury, judge, and attorneys
c. If asked something you cannot answer, respond by saying:
i. That is beyond the scope of my expertise
ii. I was not requested to investigate that
d. Avoid overstating opinions
e. Always acknowledge the jury and direct your testimony to them
2. Describe some of the questions that you should consider when preparing your testimony
with the attorney who hired you, including:
a. How is data (or evidence) stored on a hard drive?
b. What is an image or a bit-stream copy of a drive?
c. How is deleted data recovered from a drive?
d. What are Windows temporary files and how do they relate to data or evidence?
e. What are system or network log files?
3. Explain some of the guidelines when using graphics during testimony, including:
a. Graphical exhibits illustrate and clarify your findings
b. Your exhibits must be clear and easy to understand
Don’t include vendor logos on your charts, and don’t use charts created by
4. Present some recommendations to avoid testimony problems, including:
a. Recognize when conflict-of-interest issues apply to your case
5. Explain that if you have found exculpatory evidence, you have an obligation to ensure
Testifying During Direct Examination
1. Direct examination is the most important part of a trial. You provide direct examination
2. Some recommendations include:
a. Work with your attorney to get the right language
b. Be wary of your inclination to be helpful
c. Review the examination plan your attorney has prepared
Testifying During Cross-examination
1. Give some recommendations to follow during cross-examination. Also include tactics
or techniques an opposing attorney may use during cross-examination, including:
a. Use your own words
b. Keep in mind that certain words have additional meanings
c. Opposing attorneys sometimes use the trick of interrupting you
d. Be aware of leading questions
e. Never guess when you do not have an answer
f. Be prepared for challenging, pre-constructed questions, such as: Did you use
more than one tool?
Quick Quiz 1
1. When you give ____ testimony, you present evidence and explain what it is and how it
was obtained. You don’t offer conclusions, only the facts.
2. Your _____ lists your professional experience and is used to qualify your testimony.
3. Jurors typically average just over _________ years of education and an eighth-grade
reading level.
4. ____ is an attempt from one attorney to prevent another attorney from using you on an
important case.
5. Sometimes opposing attorneys ask several questions inside one question; this is called
a(n) ____.
Preparing for a Deposition or Hearing
2. Explain both types of deposition:
Guidelines for Testifying at Depositions
1. Provide students with several guidelines for testifying during a deposition, including:
a. Stay calm, relaxed, and confident
b. Maintain a professional demeanor
2. Mention that if you prepared a written report, the opposing attorney might attempt to
use it against you.
4. Mention that you should be prepared at the end of a deposition to spell any specialized
5. Several problems might appear during a deposition. Give your students some
recommendations on how to recognize and deal with them. Your recommendations
should include:
a. Discuss any potential problems with your attorney before the deposition
b. Be prepared to defend yourself
Guidelines for Testifying at Hearings
1. Mention that testifying at a hearing is generally comparable to testifying at a trial.
2. Explain that a hearing can be before an administrative agency or a legislative body or in
Preparing Forensics Evidence for Testimony
1. Use Figures 15-1 and 15-2 to explain how to use OS Forensics to extract and examine
e-mail messages.
Before beginning the activity in this chapter, create a folder called
Preparing a Defense of Your Evidence-Collection Methods
2. Mention that you might be asked to explain specific features of the computer, OS, and
applications (such as Mozilla Thunderbird or Microsoft Outlook), and you also might
Guide to Computer Forensics and Investigations, Fifth Edition 15–10
Quick Quiz 2
1. A(n) ____ differs from trial testimony because there’s no jury or judge.
2. Although a(n) ____deposition can be video recorded, a written transcript is more
common and is required in addition to the video recording.
3. A(n) ____ deposition is usually requested by your client to preserve your testimony in
case of schedule conflicts or health problems.
4. A(n) ____ hearing is held in court to determine the admissibility of certain evidence
before trial.
Class Discussion Topics
1. You are acting as an expert witness for the first time. Because of your lack of
experience, you talked with a complete stranger about details concerning the case. Later
you realized you were not supposed to do that. Should you immediately tell it to your
attorney or wait until something turns out bad and then come clean?
2. Have students design several CV formats and then select the best format. Students must
Additional Projects
1. Ask your students to write a report summarizing the most important guidelines to
maintain the chain of custody for collected evidence.
2. Ask your students to read more about the Federal Rules of Civil Procedures (FRCP) and
Additional Resources
2. How to be an effective expert witness in court:
3. Expert witness and reports:
Key Terms
➢ conflicting out — The practice of opposing attorneys trying to prevent you from
testifying by claiming you have discussed the case with them and, therefore, have a
conflict of interest.
➢ curriculum vitae (CV) — An extensive outline of your professional history that
includes education, training, work, and what cases you have worked on as well as
training you have conducted, publications you have contributed to, and professional
associations and awards.