1. COS/PSA 413 Day 24

2. Agenda Student evaluations Lab 12 Graded –1 A, 7 B’s, 1 F and 1 non-submit Assignment 4 Due –Must return the evidence disc Assignment 5 posted –Due December 16 Lab 13 tomorrow in OMS –Either 14-2 or 14-3, same project on different images and I will tell you which one of the images to use tomorrow –Due December 14 –You will be working in teams for this assignment and I expect that there will be equal participation. In your report indicate which team member performed each task. 10% penalty in the grade if this isn’t a team effort. Today we will be discussing becoming an Expert Witness

3. Game Plan for last 3 weeks Dec 6 –Becoming an Expert Witness –Assignment 4 Due Dec 7 –Lab 13 OMS Dec 9 –Becoming an expert witness Con’t Dec 13 –Final Comprehensive Lab 14 Dec 14 –Lab 14 continued –Lab 13 due Dec 16 –Assignment 5 Due –Exam 4 Dec 22 –1-3 PM –Capstones due –Capstone presentations

7. Learning Objectives Compare Technical and Scientific Testimony Prepare for Testimony Documenting and preparing evidence Testify in Court Testify during Cross-Examination Prepare for a Deposition Form an Expert Opinion

8. Comparing Technical and Scientific Testimony Technical Witness – A person who has performed the actual field work, but does not offer an opinion in court, only the results of their findings. Expert Witness – A person who has knowledge in a field and can offer an opinion in addition to the facts being presented.

9. Preparing for Testimony Technical or scientific witness –Provides facts found in investigation –Do not offer conclusions –Prepare testimony Expert witness –Has opinions based on observations –Opinions make the witness an expert –Works for the attorney

10. Preparing for Testimony Deposition Banks – Libraries kept by various law firms of depositions given in the past. Curriculum Vita (CV) – An extensive resume of your professional history that includes not only where you have worked, but what cases you have worked on, what testimony you have given, what training you have received and from whom, along with details of your other skills.

11. Creating and Maintaining Your CV Purpose of a CV –Tells your professional life –Qualify your testimony Show you continuously enhance your skills Detail specific accomplishments List basic and advanced skills Include a testimony log –Do not include books you have read

12. Preparing For Testimony When presenting yourself to a federal court as an expert witness, federal rules require that you provide the following information: - Four years of previous testimony you may have provided, which indicates that you have experience at trial. - Ten years of any published writings. - Previous compensation you may have received when giving testimony.

13. Preparing for Testimony (continued) Confirm your findings with documentation –Corroborate them with other peers Detect conflict of interest Avoid “conflicting out” practice –Prevents another attorney from using you

14. Preparing Technical Definitions Definitions of technical material Use your own words and language Some terms –Computer forensics –Hash algorithms –Image and bit-stream backups –File slack and unallocated space –File data and time stamps –Computer log files

15. Documenting and Preparing Evidence Document your steps –To prove them repeatable Preserve evidence and document it Do not use formal checklist –Do not include checklist in final report –Opposing attorneys can challenge them Collect evidence and document employed tools Maintain chain of custody

16. Documenting and Preparing Evidence (continued) Check opposing experts –Internet –Deposition banks –Curriculum vitae, strengths, and weaknesses Collect the right amount of information –Collect only what was asked for

17. Processing Evidence Monitor, preserve, and validate your work Keep only successful output –Do not keep previous runs Validate your evidence using hash algorithms Search for keywords using well-defined parameters Keep your notes simple –List only relevant evidence on your report

18. Testifying in Court Consider the following questions when preparing your testimony: What is my story of the case? What can I say with confidence? What is the client’s (attorney) overall theory of the case? How does my opinion support the case? What is the scope of the case? Have I gone too far? Have I identified the client’s desires?

19. Testifying in Court Questions you should prepare for: How is data (or evidence) stored on a hard disk drive? What is an image or a bit-stream copy of a disk drive? How is deleted data recovered from a disk drive? What are Windows temporary files and how do they relate to data or evidence? What are system or network log files?

20. Testifying in Court Testifying During Direct Examination Independent Recollection – Things that you know about this case and others without being prompted. Customary practice – Things that are traditionally done in similar cases. Documentation of the Case – The actual written records that you have maintained.

21. Testifying in Court Procedures during a trial –Your attorney presents you as a competent expert –Opposing attorney might attempt to discredit you –Your attorney leads you through the evidence –Opposing attorney cross-examines you

22. Understanding the Trial Process Typical order of trial –Motion in limine –Empanelling of the jury –Opening statements –Plaintiff –Defendant –Rebuttal –Closing arguments –Jury instructions

23. Qualifying Your Testimony and Voir Dire Demonstrates you are an expert witness –This qualification is called voir dire Court-appointed expert witnesses –Neutral in their initial positions Brief your attorney on your findings about a court’s expert Opposing attorney might try to disqualify you –Depends on your CV and experience

24. Testifying in General Be conscious of the jury, judge, and attorneys If asked something you cannot answer –“That is beyond the scope of my expertise” –“I was not requested to investigate that” Be professional and polite Be aware of leading questions Avoid overreaching opinions

25. Testifying in General (continued) Build repetition into your explanations Place microphone 6 to 8 inches from you Use chronological order to describe events Movement –Turn towards the questioner when asked –Turn back to the jury when answering Cite source of the evidence you used to construct an opinion

26. Presenting Your Evidence Steps: –State your opinions –Identify evidence to support your opinions –Relate the method used to arrive to that opinion –Restate your opinion –Never carry on with a lengthy build-up Consider your audience Do not talk with anybody during court recess

27. Avoiding Testimony Problems Be an impartial expert witness Be clear about your opinion and knowledge boundaries –Do not lie about your expertise Always build a business case Build a case outline and summary for the attorney Coordinate your testimony with your attorney

28. Testifying During Direct Examination Techniques: –State your background and qualifications –Provide a clear overview of your findings –Use a systematic, easy-to-follow plan for describing your methods –Balance language –Practice testifying –Be fair –Avoid vagueness

29. Testifying during Cross-Examination The following are other questions opposing attorneys often ask: What is your standing in the profession of computer forensics? What are the tools used and what are their known problems or weak features? Are the tools you used reliable? Are they consistent? Do they produce the same results?

30. Testifying during Cross-Examination The following are other questions opposing attorneys often ask: Continued... Are the tools safe to use on the original evidence? Have you been called upon as a consultant on how to use the tools from other professionals? Do you keep up with the latest technologies applied to computer forensics journals-papers read or published?

31. Testifying during Cross-Examination In many instances, the opposing counsel give you rapid-fire questions meant to throw you off. For example, they may ask the following questions: Does the vendor certify your tools? Are there other tools available that do the same thing? How do these tools compare to each other?

32. Testifying during Cross-Examination At all costs, you want to avoid losing control, which you can do in any of the following ways: Being argumentative when being badgered by the opposing attorney; being nervous about testifying. Having an unresponsive attorney not objecting to the opposing attorney’s questions. Having poor listening skills and negative body language. Being too talkative when answering questions.

33. Testifying during Cross-Examination Continued... Being too technical for the jury. Acting surprised and unprepared when presented with unknown or new information. Making a mistake and not correcting it immediately and getting back on track.

34. Testifying During Cross-examination Recommendations and practices: –Never guess when you do not have an answer –Use your own words –Be prepared for challenging pre-constructed questions Did you use more than one tool? –Some questions can cause conflicting answers –Rapid-fire questions –Keep eye contact with the jury

35. Testifying During Cross-examination (continued) Recommendations and practices (continued): –Nested questions –Attorneys make speeches and phrase them as questions –Attorneys might put words in your mouth –Be patient –Keep a vigorous demeanor and use energetic speech –Avoid feeling stressed and losing control

36. Preparing for a Deposition There is no jury or judge Opposing attorney previews your testimony at trial Discovery deposition –Part of the discovery process for a trial Testimony preservation deposition –Requested by your client –Preserve your testimony in case of schedule conflicts or health problems

37. Preparing for a Deposition Guidelines for Testifying at a Deposition Be professional and polite. Use facts when describing your opinion. Understand that being deposed in a discovery deposition is an unnatural process; it is intended to get you to make mistakes.

38. Guidelines for Testifying at a Deposition Some recommendations: –Stay calm, relaxed, and confident –Use name of attorneys when answering –Keep eye contact with attorneys –Try to keep your hands on top of the table –Be professional and polite –Use facts when describing your opinion –Ask opposing attorney questions

39. Recognizing Deposition Problems Discuss any problem before the deposition –Identify any negative aspect Be prepared to defend yourself Avoid: –Omitting information –Having the attorney box you into a corner –Contradictions Be professional and polite when giving opinions about opposite experts

40. Preparing for a Deposition You should avoid talking to the news media for the following reasons: Your comments could harm the case. It creates a record for future testimony that can be used against you. Your lack of media training could easily expose you to embarrassing situations. You have no control over the context of the information the journalist will publish.

41. Public Release: Dealing with Reporters Avoid contact with press –Especially during a case Refer press to your attorney Consult with your attorney on how to deal with a journalist Plan to record any interview –Important if you are misquoted or quoted out of context

42. Preparing for a Deposition Continued.... You cannot rely on a journalist’s promises of confidentiality. Their interests do not coincide with yours or your clients. Be on guard at all times, your comments may be interpreted in a manner that taints your impartiality in a case and future cases. Questions from journalists can become too big of a distraction from your work on the case. Even after the case is resolved, avoid discussing the details with the press.

43. Chapter Summary -When cases go to trial you as a forensics expert play one of two roles; you are either called as a technical witness or as an expert witness. As a technical or scientific witness, you are only providing the facts as you have found them in your investigation. However, as an expert, you have opinions about what you observe. In fact, it is your opinion that makes you an expert.

44. Chapter Summary -If you are called as a technical witness in a computer forensics case, you need to thoroughly prepare for your testimony. Establish communication early on with your attorney. When preparing to testify for any litigation, substantiate your findings with your own documentation and by collaborating with other computer forensics professionals.

45. Chapter Summary -As you process evidence, be sure to always monitor, preserve, and validate your work. Doing so helps to ensure that it can be presented in court. Then submit to your attorney all evidence you collected and analyzed. When writing your report, only list evidence findings that are relevant to the case.

46. Chapter Summary -When you are called to testify in court, your attorney demonstrates to the court that you are competent as an expert or technical witness. Your attorney then leads you through the evidence followed by the opposing counsel cross-examining you. After your attorney has established your credentials and you have presented your evidence, the opposing attorney has an opportunity to ask questions about your testimony and evidence, a process called cross- examination.

47. Chapter Summary -Know whether you are being called as a scientific technical witness or expert witness (or both), whether you are being retained as a consulting expert or as an expert witness. Also be familiar with the contents of your curriculum vita (VC). -A deposition differs from a trial because there is no jury or judge. Both attorneys are present and the opposing counsel asks you questions. There are two types of deposition: discovery and testimony preservation.