What are the two types of witness
fact witness - only facts from investigation, how obtained and conclusive results. no opinions
expert witness - you give opinions about what you have found or observed based on evidence, experience and deductive reasoning.
Name 5 steps that you should take in documenting and preparing evidence
Use a folder to collect evidence and record the tools you used
Keep Chain of Custody log
Be careful not to collect too much or too little information
Date and times of analysis
Keep only successful output of analysis tools
Take simple notes
Apart from preparing and documenting evidence, how else can you prepare for a trial?
Maintain CV - skills, training, professional experience
Prepare technical definitions
Prepare for news media
What is the order of trial proceedings?
- Motion in limine - pretrial motion to exclude certain evidence because it could prejudice the jury
- Impaneling the jury voir dire of venireman
- Opening statements
- Plaintiff - The plaintiff’s attorney presents the case
- Defense the defense’s attorney presents the case
- Rebuttal (cross-examination)
- Closing arguments - statements that organize the evidence and state the applicable law.
- Jury instructions - the attorney’s propose instructions to the jury on how to consider the evidence and then the judge approves or disapproves
What are some guidelines for testifying?
- If you can’t answer say “that is beyond the scope of my expertise” or “ I wasn’t asked to investigate that”
- Acknowledge the jury and address your testimony to them
- speak clearly
- use simple direct language
- avoid humour
- explain what opinions are based on
- don’t memorise, be natural
- make large, visible graphics
What are some testimony problems and how do you avoid them?
Conflicting out - opposing attorney’s may call you to discuss a case and then claim that you cannot be a witness as you are conflicted.
- —avoid discussing a case until you are under contract. do not discuss case with anyone else
- be prepared to discuss fees and payments
What are the 2 types of depositions?
A deposition differs from trial testimony because there’s no jury or judge. Both attorney’s are present and ask you questions. The purpose of the deposition is for the opposing attorney to preview your testimony before trial.
- Discovery deposition is part of the discovery process for trial. The opposing attorney examines you.
- A testimony preservation deposition is requested by your client to preserve your testimony in case of schedule conflicts or health problems. Often video recorded. Opposing council cross examines you.
What are some deposition problems?
- omitting information
- pause before difficult questions
- excessively detailed questions are an attempt to get you to contradict yourself
- don’t be negative about colleagues
- you can correct errors later
What are some factors that courts may use in determining whether to disqualify an expert?
- Did the attorney inform the expert that their discussions were confidential
- Did the expert review materials marked as confidential
- -Was the expert asked to sign a confidentiality agreement
- Number of discussions over a period of time
- type of information conveyed
- amount of time in discussion
- did the expert provide the attorney with confidential information
- Whether the expert was compensated
What are some obvious ethical errors to avoid?
- Don’t present false data or alter data
- Don’t report work that was not done
- Don’t ignore available contradictory data
- Don’t do work beyond your expertise or competence
- Don’t allow the attorney to influence your opinion
- Don’t accept and assignment if it can’t be done reasonably in the allowed time
- Don’t reach a conclusion before doing complete research
- Don’t fail to report possible conflicts of interest
What are some societies that have relevant ethical guidelines?
- International Society of Forensic Computer Examiners
- International High Technology Crime Investigation Association
- International Association of Computer Investigative Specialists
- American Bar Association
- American Psychological Association
What does the International Society of Forensic Computer Examiners Ethical Guildelines include?
- Maintain the utmost objectivity in all forensic examinations and present finding accurately
- Conduct examinations based on established validated principles
- Test truthfully in all matters before any board, court, or proceeding
- Avoid any action that would appear to be a conflict of interest
- never misrepresent training, credentials, or association membership
- Never reveal any confidential matters or knowledge learned in an examination without an order from a court or competent jurisdiction or the client’s express permission
What does the International High Techology Crime Investigation Association Guideline include:
- they value the Truth oncovered within digital information and the effective techniques to uncover that Truth, so that no one is wrongfully conviced
- They value the integrity of its members and the evidence they expose through common investigative and digital forensics best practices, including specialised techniques used to gather digital evidence
What does the International Association of Computer Investigative Specialists Guidelines include?
Maintain the highest level of objectivity in all forensic examinations and accurately present the facts involved
- Examine and analyse evidence in a case thoroughly.
- Conduct examinations based on established, validated principles
- Render opinions having a basis that is demonstratively reasonable
- Not withhold any findings, whether inculpatory or exculpatory, that would cause the facts of a case to be misrepresented or distorted.
