Title: 1. Preparing for Testimony
Course: IN 2005 Digital Forensics > Section: Module 14: Chapter 14-Expert Testimony in High-Tech Investigations & Ethics for the Expert Witness

Preparing for Testimony

1. Two types of testimony:
  - Technical or scientific witness
  - Expert witness
2. When preparing your testimony, you should consider the following questions:
  - What is my story of the case?
  - What can I say with confidence?
  - What is the client’s overall theory of the case?
  - How does my opinion support the case?
  - What is the scope of the case? Have I gone too far?
  - Have I identified the client’s needs for how my testimony fits into the overall theory of the case?

Documenting and Preparing Evidence

1. Some guidelines for performing these tasks:
  - Document your steps to prove them repeatable
  - Preserve your evidence and document the process
  - Do not use formal checklists since opposite attorneys can challenge them
  - Collect evidence and document the tools used during the process
  - Maintain the chain of custody
  - Collect only the information that was asked for, no more
  - Note the date and time of your forensic workstation when starting your analysis
  - Keep only successful output
  - Search for keywords using well-defined parameters
  - Keep your notes simple
  - List only relevant evidence on your report
  - Define any procedures you use to conduct your analysis as scientific and conforming to your profession’s standards
  - Monitor, preserve and validate your work
  - Validate your evidence using hash algorithms

Reviewing Your Role as a Consulting Expert or an Expert Witness

1. Some recommendations for acting as a consultant expert or an expert witness:
  - Do not record conversations or telephone calls
  - Federal information requirements
    - Four years of experience
    - Ten years of any published writings
    - Previous compensations
  - Learn about all other people involved and basic points in dispute
  - Brief your attorney on your findings and opinion of the court’s expert
  - Find out if you are the first expert asked
2. Mention that any investigator can be hired as a consulting expert and then asked to act as an expert witness and testify on court.

Creating and Maintaining Your CV

1. The purpose of your curriculum vitae (CV) is to list your professional experience and qualify your testimony.
2. Some recommendations to create your CV and keep it updated:
  - Show you continuously enhance your skills
  - Detail specific accomplishments
  - List basic and advanced skills
  - Include a testimony log
  - Do not include books you have read
  - Update your CV at most every three months

Preparing Technical Definitions

1. Some of the terms you should prepare a technical definition for before a trial:
  - Computer forensics
  - Hash algorithms
  - Image and bit-stream backups
  - File slack and unallocated space
  - File timestamps
  - Computer log files
  - Folder or directory
  - Hardware
  - Software
  - Operating system

Preparing to Deal with the News Media

1. Some legal actions generate interest from the news media.
2. Some of the reasons to avoid contact with news media, including:
  - Your comments could harm the case and create a record that can be used against you
  - You have no control over the context of the information a journalist publishes
  - You can’t rely on a journalist’s promises of confidentiality