Selecting A Computer Forensic Expert
Gregory L Fordham
May 2008
As digital evidence continues to become more common in litigation, so has the need for computer forensic experts.
In some areas, the entire case is driven by the findings of computer forensic experts. Even in garden variety e-discovery cases, where one would think that the challenges are the efficient and timely exchange of documents, the aid of a computer forensic expert can be essential to assess document authenticity, production compliance and the existence of spoliation.
Once the need for a computer forensic expert is recognized, the next likely hurdle will be how to find and select one. To the uninitiated, this may seem no more complicated than an inquiry with a colleague.
However, there are more things to consider, particularly now as the number of those claiming to have this expertise grows to meet demand.
For example, one might consider using an expert with a law enforcement background. These individuals tend to make great witnesses for juries because of their instant credibility.
If the case is a civil matter, however, there are other things to consider. After all, the differences between criminal and civil cases are more than the law. Indeed, the capabilities of the experts are shaped by the procedural differences as well as the cultures spawned by those procedures.
In criminal cases the bar is higher than in a civil matter. In addition, prosecutors can have larger case loads than their civilian counterparts. Both of these factors can pressure them and their experts to focus on the low hanging fruit.
The net result is that an expert grounded in criminal cases involving child pornography may be more accustom to finding the sure thing than going the extra mile to pursue issues that require research, testing, extensive analysis or marshalling complicated fact patterns.
Another difference is that in a civil case the opposing side often has considerably more notice of the impending production than a criminal defendant served with a search warrant. As such, in a civil matter it can be more important for the computer forensic expert to know how to find traces of what had been on the computer than finding the files themselves.
Also, criminal experts may not be accustomed to the discovery that occurs in civil proceedings. Thus, they may not be proficient in report writing, giving depositions and revealing and supporting their evidence and opinions prior to testifying at trial.
Another factor to consider is presentation skills. An expert’s presentation skills are not just important while testifying at trial. Indeed, they are important throughout the entire litigation lifecycle that can include briefings with the legal team and the client as well as formulation of tests and procedures for advancing the case.
Interestingly, advancing the case is not just about sifting and interpreting evidence. It can include using his expertise to counter the obstacles devised by opposing counsel to stifle discovery
So, the expert must fill many roles. He must be a teacher and a strategist. It is not enough to find interesting artifacts. The expert must be able to educate the lawyer about differing ways to obtain relevant evidence that is important to the case as well as the significance of his findings.
Delivery of the expert’s findings is also an important part of his presentation skills. Many of the forensic tools used by experts possess report writing tools. While these tools are good for experts, who already understand all of the attributes they contain, they are not typically good for lawyers. Often they are no more than raw data dumps. Unless the lawyer is familiar with these reports or even the data that they contain they will likely be useless to the lawyer.
In terms of strategy, there are two ways that the expert can help. The first is uncovering the flaws in the opposing side’s claims that requests are overly burdensome. The second is devising techniques for sifting data efficiently when opposing counsel has delivered “quicksand”.
In addition to the above there are many other factors that a litigator will want to consider when picking a computer expert for his case. Some of these are the forensic tools and resources used by the expert, the case specifics and industry expertise of the expert as well as many others.