FINDING AND SELECTING
A COMPUTER FORENSIC EXPERT

Finding a Computer Forensic Expert

Once the lawyer has determined to use a computer forensic expert the next likely hurdle will be how to find one.  Of course, there is always the old fashion way that is probably used most by lawyers.  That is asking around with other firm members and colleagues about experts that they may have used and would recommend.

Performing searches on the internet is another common method of finding experts.  If their websites exist then evaluating the content of those sites can help identify candidates.

Besides searches of the internet, those with access to case decisions can also search those for instances where experts are identified.

Of course beyond that are the usual directories.  Some of the better known are Martindale Hubbell, AMExperts and then various industry or geographically specific directories such as construction industry directories or local bar association directories.

As computer forensics has become more common, there are also professional associations that can provide member lists.  For example, the International Society of Forensic Computer Examiners is one professional association where individuals can be found.  In addition there are also tool specific certifications like guidance Software’s EnCE [Encase Certified Examiner] and Access Data’s ACE [AccessData Certified Examiner].

Selecting a Computer Forensic Expert

Once you have located potential candidates, or at least sources for potential candidates, the next step will be selecting a computer forensic expert.  There are a number of features that can influence a selection decision.  Some of those criteria are litigation background such as criminal or civil; the education background, training, tools, nature of the case and industry specifics.

Criminal versus Civil

One might consider using an expert with a law enforcement background.  These individuals tend to make great witnesses for juries because of their instant credibility. 

If the case is a civil matter, however, there are other things to consider.  After all, the differences between criminal and civil cases are more than the law.  Indeed, the capabilities of the experts are shaped by the procedural differences as well as the cultures spawned by those procedures.

In criminal cases the bar is higher than in a civil matter.  In addition, prosecutors can have larger case loads than their civilian counterparts.  Both of these factors can pressure them and their experts to focus on the low hanging fruit. 

The net result is that an expert grounded in criminal cases involving child pornography may be more accustom to finding the sure thing than going the extra mile to pursue issues that require research, testing, extensive analysis or marshalling complicated fact patterns.

Another difference is that in a civil case the opposing side often has considerably more notice of the impending production than a criminal defendant served with a search warrant.  As such, in a civil matter it can be more important for the computer forensic expert to know how to find traces of what had been on the computer than finding the files themselves.

Also, criminal experts may not be accustomed to the discovery that occurs in civil proceedings.  Thus, they may not be used to report writing, giving depositions and revealing and supporting their evidence and opinions prior to testifying at trial.

Presentation Skills

Another factor to consider is presentation skills.  An expert’s presentation skills are not just important while testifying at trial. Indeed, they are important throughout the entire litigation lifecycle that can include briefings with the legal team and the client as well as formulation of tests and procedures for advancing the case.

Interestingly, advancing the case is not just about sifting and interpreting evidence.  It can include using his expertise to counter the obstacles devised by opposing counsel to stifle discovery

So, the expert must fill many roles.  He must be a teacher and a strategist.  It is not enough to find interesting artifacts.  The expert must be able to educate the lawyer about differing ways to obtain relevant evidence that is important to the case as well as the significance of his findings. 

Delivery of the expert’s findings is also an important part of his presentation skills.  Many of the forensic tools used by experts possess report writing tools.  While these tools are good for experts, who already understand all of the attributes they contain, they are not typically good for lawyers.  Often they are no more than raw data dumps.  Unless the lawyer is familiar with these reports or even the data that they contain they will likely be useless to the lawyer.

In terms of strategy, there are two ways that the expert can help.  The first is uncovering the flaws in the opposing side’s claims that requests are overly burdensome.  The second is devising techniques for sifting data efficiently when opposing counsel has delivered “quicksand”. 

<Previous   Next>

Printable Version

Page 2