When corporate goes criminal, i.e., an investigation involving a corporation leads to a criminal case headed to trial, you often need computer forensic experts to testify about the evidence. Such experts know all about electronic devices and data storage and retrieval, but they don’t necessarily know how to clearly relay that knowledge. It’s up to you to prepare your computer forensics expert to testify effectively.
Computer forensic experts range from digital investigators retained early on by the corporation for the initial collection and analysis of evidence to experts brought in by either side once evidence is identified or seized by police to interpret the data and testify about it in court.
Regardless of when the expert came on board, you need to prepare him or her to testify about the investigation at trial. The key is having the expert give enough detail on the investigation that a fact-finder can follow the process and see that it’s reliable and logical (and that the expert is knowledgeable and credible) but not so much as to inundate the fact-finder with technical minutiae that will distract and bore.
Review this list of questions with your expert to help him or her stay focused on the relevant facts and relay them in the sweet spot between helpful details and mind-numbing intricacies:
- What is the evidence? Does it consist of data that a person specifically created and stored in the computer, or is it data that the computer automatically generated through its operation?
- Where was the evidence collected (e.g., in individual workstations, loose media, or a central server)?
- How was the evidence collected? For example, were mirror images made? Were they done onsite or in a lab? What tools were used?
- Who collected the evidence and for what purpose?
- Can a chain of custody of the evidence be established? If it can, what is the chain? Where was the evidence kept? Who had access to it? What steps were taken to prevent tampering?
Get more practical advice on handling digital forensics investigations in corporate environments in CEB’s new book Scientific Evidence and Expert Testimony in California, chap 7. For guidance on working with expert witnesses generally, turn to CEB’s California Expert Witness Guide.
Other CEBblog™ posts you may find useful:
- An Offer to Concede Your Expert’s Qualifications May Be a Trojan Horse
- Are Two (or More) Experts Better Than One?
- 10 Tips for Attacking DNA Evidence
© The Regents of the University of California, 2015. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited.