By browsing this site, you are agreeing to our cookie policy. More Information

Forensic investigators: Advice from the pros to boost your expert witness credibility

Digital Forensics | May 26, 2016

As a digital forensics professional, you know how to get on the electronic trail and help prove facts in civil and criminal cases. But when opposition attorneys are seasoned and crafty, explaining how you connected the digital dots can make the witness stand seem more hostile than a mixed martial arts steel cage octagon.

A panel of attorneys and veteran expert witnesses at Guidance Software’s Enfuse 2016 user conference discussed the traps, pitfalls and mistaken assumptions forensic investigators can make in the course of testifying during depositions, hearings and trials.

The lively panelists offered 30-plus tips – many of them backed with anecdotes from their own cases or ones they’d researched. We present the top 10:

  1. Don’t sign an affidavit you didn’t write. On the stand, opposing attorneys will use this as a hatchet to chop away at your credibility. Many times, however, investigators collaborate with a member of the attorney’s office to draft a statement, and that’s perfectly acceptable. The best thing to do, of course, is to write your own.
  2. Slow down your questioner. Sometimes, opposing attorneys knock out questions in a rapid-fire fashion to fluster you or lead you down a logical dead end that puts you in a bad light. When you sense things are headed this way, you can tap the breaks by having the questioner repeat the question because you didn’t hear it right, or ask for clarifications and definitions.
  3. In depositions, don’t answer the question that should have been asked. Let’s face it, you’re closest to the data and understand its interpretation as well as anyone. But while you want to prove your expertise, don’t take the opportunity to answer a related question to the one being asked because the original question was off-topic, uninteresting, incomplete or had some other problem. Don’t give them any more information to strategize against than you have to.
  4. Answer either/or trap questions this way. Sometimes through ignorance or strategy, you get a “this, or that?” question where both answers are wrong, or partially wrong, or unanswerable – and both answers can put you in a bad spot. Here’s what you say: “I can’t answer that without misleading the jury.”
  5. Don’t bring your laptop to a deposition. It can suddenly be turned into evidence and you’re leaving without it. Leave it in the car, or better yet, at home.
  6. Don’t, for one second, believe this statement: “Don’t worry, it will settle. It’s never going to trial.” Whoever on the legal team says this could very well be right. But on the off-chance they’re not -- and you discontinue forensics work and documentation based on the assumption it’s going to settle -- you may end up in a position where you have to cram a week’s worth of work in a day, and in the process possibly hurting your side’s chance to win.
  7. Don’t be afraid of questions to which you don’t know the answers. It becomes clear when an expert witness feints or dodges a question to which he or she is unsure of the answer. Simply respond to the effect of, “I haven’t tested it yet,” or “I need to check this.” Opposition attorneys especially like it when experts make up answers to questions to which they clearly don’t know the answers to – it’s blood in the water and can be the opening they need to win the case.
  8. “Can you say this information was a trade secret?” No, you can’t. You don’t own the company, and likely you’re not an expert in their market. You can, however, say that the CEO or someone within the company told you it was. So when prepping with the client, get someone to explain a particular piece of information – if relevant to your testimony – is a trade secret.
  9. Avoid jargon. When talking to peers, you move easily between computer-tech-forensics-law enforcement-legal dialects. On the stand, it can be incomprehensible to attorneys and juries and judges, and that’s not helpful to your case or credibility. Stick to plain English as much as possible. Practice what you’re going to say. Practice being articulate.
  10. Listen to the lawyers. Take their suggestions for mock depositions and mock trial testimony. Listen to their advice, let them help you communicate your best evidence in the most concise way. They know what they’re doing and soon you will too, customized to the case at hand.

Panelists included:

James Vaughn, managing director, iDiscovery Solutions; Jonathan Rajewski, director & digital forensics professor, Champlain College; Sheryl Falk, attorney, Winston Strawn; Christopher Novak, managing principal, Verizon; David Cowen, partner, G-C Partners, LLC/SANS.

Load more comments
Thank you for the comment! Your comment must be approved first

You May Also Like

Digital Forensics

Now Available OnDemand: Advanced Internet Examinat...

Keep your skills up-to-date from the comfort of your home or office – no travel justification needed.
Nov 19
Digital Forensics

Sneak Peek at One Piece of Our New Logo

Since 1997, Guidance Software has had a look
Nov 3
Digital Forensics

Best Practices in Recovering Data from Water-Damag...

How successful have you and your agency been in responding to water-damaged devices?
Oct 16