• Estate Planning Intensive Course

    Estate Planning Intensive Course
  • Categories

  • Archives

  • © The Regents of the University of California, 2010-2017. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited.

They Know Computers But Not How to Help Your Case

183145432When corporate goes criminal, i.e., an investigation involving a corporation leads to a criminal case headed to trial, you often need computer forensic experts to testify about the evidence. Such experts know all about electronic devices and data storage and retrieval, but they don’t necessarily know how to clearly relay that knowledge. It’s up to you to prepare your computer forensics expert to testify effectively.

Computer forensic experts range from digital investigators retained early on by the corporation for the initial collection and analysis of evidence to experts brought in by either side once evidence is identified or seized by police to interpret the data and testify about it in court.

Regardless of when the expert came on board, you need to prepare him or her to testify about the investigation at trial. The key is having the expert give enough detail on the investigation that a fact-finder can follow the process and see that it’s reliable and logical (and that the expert is knowledgeable and credible) but not so much as to inundate the fact-finder with technical minutiae that will distract and bore.

Review this list of questions with your expert to help him or her stay focused on the relevant facts and relay them in the sweet spot between helpful details and mind-numbing intricacies:

  • What is the evidence? Does it consist of data that a person specifically created and stored in the computer, or is it data that the computer automatically generated through its operation?
  • Where was the evidence collected (e.g., in individual workstations, loose media, or a central server)?
  • How was the evidence collected? For example, were mirror images made? Were they done onsite or in a lab? What tools were used?
  • Who collected the evidence and for what purpose?
  • Can a chain of custody of the evidence be established? If it can, what is the chain? Where was the evidence kept? Who had access to it? What steps were taken to prevent tampering?

Get more practical advice on handling digital forensics investigations in corporate environments in CEB’s new book Scientific Evidence and Expert Testimony in California, chap 7. For guidance on working with expert witnesses generally, turn to CEB’s California Expert Witness Guide.

Other CEBblog™ posts you may find useful:

© The Regents of the University of California, 2015. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited.

One Response

  1. […] They Know Computers But Not How to Help Your Case […]

Add your comment to the blog post

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: