Digital forensics is about the investigation and recovery of material found on digital devices. It is the analysis of electronically stored information (ESI) by persons with proper training, tools, and experience. A digital forensics expert is responsible for the acquisition and documentation of evidence, preservation, examination, storage, production of the ESI, and testifying as an independent expert.
Digital forensics has become a major part of many, if not most civil and criminal cases and can often be the determining factor in a case’s outcome. Because of this, you want to have a digital forensic expert witness as part of your legal team and case presentation. Computer forensics experts are often asked to wear a number of hats and perform various services. As I’ve said before, this is not an area for do-it-yourselfers or your IT guy. Your digital forensics expert not only needs the appropriate tools and equipment necessary for a thorough examination, he/she needs in-depth knowledge of the process to produce trustworthy results. Both the effective process of collecting, analyzing, and examining ESI, and expert testimony can mean the difference between winning and losing your case. So, how do you choose the right digital forensic expert?
- Ask about credentials, background, and experience: There are an increasing number of people out there who claim to be experts in the digital forensics field. Look very carefully at the level of experience of both the company and the individual(s) who will be doing the work. Remember, you are retaining the services of an individual who will likely be called to testify in court to explain what he or she did to the electronic device(s) and its data. The court will want to hear about that individual’s own level of education, training, experience, accreditations and certifications. You want an expert with experience specifically in computer forensics, not in computer science or information technology. Computer skills does not necessarily translate to forensic expertise.
- Find out what procedures are used to ensure all evidence is defensible? The process is the most important and critical element to a digital forensics investigation. Experts must take care to accurately preserve and store information properly so that is admissible in court and must have a working knowledge of chain of custody practices. Any data seized from devices must be replicated exactly. This is typically done with forensic imaging. This process creates a read-only image of all the files and leftover space from the hard drive. The result is essentially a mirror image of the hard drive. The original data cannot be modified from this point to ensure the accuracy of the findings. The data is then analyzed using a number of tools and methods to recover evidence. That evidence is reconstructed to recreate actions and to reach conclusions. When the investigation is completed, a written report is created regarding the findings. Proper preservation and collection procedures will help you avoid the sanctions that may occur if the right data is not preserved properly.
- What experience does your expert have in providing expert witness testimony? Will your digital forensic expert be able to delivery key testimony to help solidify your case? Has he/she used discovery methods that are permissible in court to ensure the validity of the testimony? If your case will involve e-Discovery then an expert witness will be a key component and may have a dramatic impact on your case. Expert witnesses are often called in to help explain complex topics and clearly lay out the facts without confusing the judge and/or jury. It is important to choose a qualified and experienced professional who can be trusted to do the job.
- Ask for references and do your homework: As with any hire, make sure to vet your digital forensics expert witness and ask for references from previous clients. You want to look at your expert’s success with cases similar to yours. Examine their record, which should be available in the public record, for at least the previous 4 years. You’ll need to examine not only whether their testimony was successful, but also any exclusions of their testimony from record as well as any instances that may have damaged the case and their credibility. As stated above, the testimony from a digital forensic expert can often be the difference between winning and losing your case. Don’t leave it up to chance.
About Prudential Associates
Prudential Associates was founded by former Army Intelligence Officer Robert Miller in 1972, who began serving the local legal community as an investigative, surveillance, and intelligence resource.
Prudential Associates has expanded its service footprint geographically and added over 70 extremely valuable staff members and experts; our consulting and service operations have taken place in thousands of locations on nearly every continent. To date we have achieved recognition as the premier resource for clients in sectors such as: television and movie production; maritime services and shipping; large event/concert planning & security; pharmaceutical production; shipping and logistics; human capital management; and, perhaps most notably, in the legal service industry, given our highly distinguished investigative, surveillance, and digital forensics expertise.
Our in-house computer and cell phone forensics lab rivals or exceeds the capabilities of over 90% of the law enforcement labs in the United States, as well as over 99% of those overseas.
For a greater insight into our experience, expertise, and operational history, please see our Corporate Resume.
Contact us today to discuss our digital forensics services, your digital forensic needs, and expert witness testimony. Get in touch with one of our experts now by calling 301.279.6700 or 877.279.670, or by visiting www.prudentialassociates.com.