Becoming a Better Digital Forensics Witness Part 1

Attorney Craig Ball is a forensic technology expert witness. On his website, Ball in Your Court, he writes on his experience as an expert witness.

Becoming a Better Digital Forensics Witness
I love to testify-in court, at deposition, in declarations and affidavits-and I even like writing reports about my findings in forensic exams.

I love the challenge-the chance to mix it up with skilled interrogators, defend my opinions and help the decision makers hear what the electronic evidence tells us. There is a compelling human drama being played out in those bits and bytes, and computer forensic examiners are the fortunate few who get to tell the story. It’s our privilege to help the finders of fact understand the digital evidence.

This post is written for computer forensic examiners and outlines ways to become a more effective witness and avoid common pitfalls. But the advice offered applies as well to almost anyone who takes the stand.

It’s difficult for computer forensic examiners to hone their testimonial skills because it’s rare to be interrogated by a lawyer who understands what we are talking about. Most interrogators are working from a script. They know the first question to ask, but not the next or the one after that. Pushed off their path, they’re lost. Computer forensic examiners have it pretty easy on the stand. Computer-generated evidence still enjoys an aura of accuracy and objectivity, and the hyper-technical nature of digital forensics awes and intimidates the uninitiated. But, it won’t always be this way. Sooner or later, computer forensic examiners will square off against interrogators able to skillfully undermine ability and credibility. So, it behooves us to strive to be skilled witnesses.

The Trick to Being a Great Witness Novice witnesses think there’s a system they can follow to stay out of trouble on cross-examination, but no battle plan survives an encounter with the enemy. There are no “tricks” to testifying, except to prepare carefully, listen to the questions asked, answer the questions asked, stick to what you know and tell the truth. The corollaries are, don’t imagine you can “wing it,” don’t anticipate the question, don’t answer the question you think the examiner meant to ask, don’t overreach your expertise and don’t try to snow the lawyers on technical matters.

It’s All About Preparation Even brilliant, articulate and honest expert witnesses will perform poorly on the stand when they aren’t asked the right questions in the right way. Lawyers invest too little time preparing expert witnesses to present a compelling direct examination, and expert witnesses worry too much about cross-examination. Without a solid direct examination to lay out the key points, getting through cross-examination unscathed doesn’t count for much. There are many reasons why lawyers don’t spend enough time preparing expert witnesses: Lawyers and experts have demanding schedules, time spent with experts may be expensive and egos on both sides may not admit the need for preparation. Still, preparation for direct examination demands more than scripting a few questions and ad-libbing the rest.

The expert witness must help the lawyer understand what the digital evidence signifies and insure that the lawyer won’t stumble on the key terms and concepts. The lawyer must help the expert understand where the digital evidence fits into the overall theme of the case. Both must craft the flow and choreography of the direct examination, including what exhibits and demonstrative aids will be used and how to adapt when things don’t go according to plan (as when the court excludes an exhibit or demonstrative aid). There is no such thing as an over-prepared expert when it comes to direct examination.

Hypothetical Questions and Hearsay In U.S. jurisprudence, there are two principal advantages afforded an expert witness. First, an expert witness is permitted to answer hypothetical questions; that is, questions where the interrogator lays out various assumptions and seeks the witness’ opinions based on those assumptions. Second, an expert witness is permitted to rely upon hearsay evidence when it’s the sort of information on which experts in the field customarily rely.

Some cross-examiners take their hypotheticals too far and require you to assume unreasonable facts. In that event, push back. Point out that you can’t express an opinion based on so implausible an assumption. Don’t be reluctant to say, “I saw no evidence to support that assumption.” Be wary of being pushed into offering opinions on hypotheticals incorporating elements outside your expertise and experience.

Just because you can rely upon hearsay doesn’t mean that you should. Unassailable opinions are constructed from reliable evidence. Try not to build your testimony on assumptions that may buckle. Always ask yourself, “Why do I take this to be true?”

Compound Questions A cross-examiner may pose two questions as one, such that an answer to one sounds like an answer to both. When this happens, the lawyer who handled direct examination should object to the compound question; but, if the lawyer doesn’t object, it’s up to you to be alert and keep the record clear. Seek clarification of the question (e.g., “Are you asking me whether I hashed the images or if the hash values matched?”) or address each part separately (e.g., “Yes, I hashed the images, but the hash values did not match due to damaged sectors on the drive.”).

May I Explain?
Effective cross-examiners use classic techniques to control witnesses. They pose leading questions that suggest the desired reply. They avoid repetition of damaging testimony. They ask only questions to which they already know the answer. And they seek to confine witnesses to “yes” or “no” responses to keep witnesses from explaining their answers. Skilled cross-examiners do this so well, you will be like a horse in harness. But skilled cross-examiners are rare. You are more likely to face cross-examiners who will try to bully you into “yes” or “no” responses to questions that can’t be answered that way.

You have a secret weapon when this happens. You can ask, “May I explain please?” Opposing counsel hate that. They want to scream, “No, just say ‘yes’ or ‘no!'” But, they recognize that if you’ve been candid and cooperative, refusing to let you explain will make them look bad to the judge and jury. Like any secret weapon, it’s not very effective once the secret’s out. So, you can only do this once (or twice). Don’t waste it.

Craig Ball Attorney and Forensic Technologist Certified Computer Forensic Examiner www.ballinyourcourt.com