Title: 4. Preparing Forensics Evidence for Testimony
Course: IN 2005 Digital Forensics > Section: Module 14: Chapter 14-Expert Testimony in High-Tech Investigations & Ethics for the Expert Witness

Preparing Forensics Evidence for Testimony

1. See Figures 15-1 and 15-2 to explain to  you how to use ProDiscover Basic to extract e-mail folders and FTK Demo to extract and analyze e-mail metadata and messages.

Preparing Explanations of Your Evidence-Collection Methods

1. To prepare for court testimony, you should prepare answers for questions on what steps you took to extract e-mail metadata and messages.
2. You might be asked to explain specific features of the computer, OS and applications (such as Outlook), and you also might be asked to explain how these applications and computer forensics tools work.