Module 6

Expert testimony and how to

testify in court
 Expert Testimony
• Forensic experts or investigators can be employed by a
variety of entities, such as federal, state or local
laboratories or academic institutions.

• They may be called on to be expert witnesses or hired as

consultants to contribute specialized knowledge and
advice on scientific or technical issues.

• Forensic experts may be subpoenaed or appointed by the

court to assist the judge or jury in a criminal or civil case,
to help an indigent criminal defendant, or to provide a
third opinion on information and evidence.
 Expert Testimony

• Regardless of how or why expert witnesses are called to

testify, they must be prepared.

• Forensic experts must test evidence or gather technical

information related to the case. When testing evidence,
they must follow standard lab protocols and procedures.

• Forensic experts must proceed step-by-step, in an orderly

and logical way, to obtain the test results, facts and
information on which conclusions are based.
Preparing for Testimony
• Technical or scientific witness
➢Provides facts found in investigation
➢Does not offer conclusions
➢Prepares testimony

• Expert witness
➢Has opinions based on observations
➢Opinions make the witness an expert
➢Works for the attorney
Preparing for Testimony
When preparing testimony consider the following
questions:
• What is my story of the case?
• What can I say with confidence?
• What is the client’s overall theory of the case?
• How does my opinion support the case?
• What is the scope of the case? Have I gone too
far?
• Have I identified the client’s needs for how my
testimony fits into the overall theory of the case?
Preparing Testimony
Prepare the testimony with the attorney.

• How is data (or evidence) stored on a hard drive?

• What is an image or a bit-stream copy of a drive?
• How is deleted data recovered from a drive?
• What are Windows temporary files and how do they
relate to data or evidence?
• What are system or network log files?
Preparing Explanations of
Evidence-Collection Methods
• Might also be asked to explain specific
features of the computer, Operating Systems,
and applications

• Explain how these applications and computer

forensics tools work
Documenting and Preparing
Evidence
• Document the steps
➢ To prove them repeatable

• Preserve evidence and document it

• Do not use formal checklist
➢ Do not include checklist in final report
➢ Opposing attorneys can challenge them

• Collect evidence and document employed tools

• Maintain chain of custody
Documenting and Preparing
Evidence
• Collect the right amount of information
➢ Collect only what was asked for
• Note the date and time of the forensic workstation
when starting the analysis
• Keep only successful output
➢ Do not keep previous runs
• Search for keywords using well-defined parameters
Documenting and Preparing
Evidence
• Keep all the notes simple
• List only relevant evidence on your report
• Define any procedures used to conduct the
analysis as scientific
➢And conforming to the profession’s
standards

• Monitor, preserve, and validate the work

• Validate the evidence using hash algorithms
 Preparing Technical Definitions
Prepare definitions of technical concepts
• Use own words and language
• Some terms - examples
➢ Computer forensics
➢ Hash algorithms
➢ Image and bit-stream backups
➢ File slack and unallocated space
➢ File timestamps
➢ Computer log files
➢ Folder or directory
➢ Hardware
➢ Software
➢ Operating system
General Guidelines on
Testifying in court
Delivery and Presentation
• Be conscious of the jury, judge, and attorneys
• Be professional and polite
• Avoid overstating opinions
• Always acknowledge the jury and direct your
testimony to them
Delivery and Presentation
• Use chronological order to describe events

• For technical terms, identify and define these

terms for the jury

• Cite the source of the evidence the opinion is

based on
Delivery and Presentation

For direct examination

• State the opinions
• Identify evidence to support the opinions
• Relate the method used to arrive to that opinion
• Restate the opinion
Presentation using Graphics
• Graphical exhibits illustrate and clarify the findings
• Exhibits must be clear and easy to understand
• Graphics should be big, bold, and simple
• The goal of using graphics is to provide information
the jury needs to know
• Review all graphics with the attorney before trial
• Make sure the jury can see the graphics during
presentation
Testifying During Direct
Examination
Techniques

• Work with the attorney to get the right language

• Review the examination plan the attorney has
prepared
• Provide a clear overview of the findings
• Use a systematic easy-to-follow plan for describing
the methods