Our series on testifying as a digital forensic expert witness has looked at the role of the computer forensic expert, their qualifications, and preparing a CV. Now we take a closer look at the Daubert rules for qualification.

Federal and State Approach: Qualifying Under Daubert
As mentioned previously, before you can be offered as an expert you must establish your qualifications. Each state handles the issue in its own way and you should work with the attorney who hires you to make sure you know what you need to know to properly establish your credentials through testimony. In federal court the approach is consistent throughout the system. You must be able to meet the reliability standards defined in the Federal Rules of Evidence as interpreted by the Supreme Court in Daubert v. Merrell Dow Pharm., Inc., 509 U.S. 579 (1993); General Electric Co. v. Joiner, 522U.S. 136 (1997) and Kumho Tire v. Carmichael, 526 U.S. 137 (1999).

The first thing to understand is that the decision whether you will be allowed to testify is up to the judge. He or she serves as the initial gate keeper. If you pass muster with the judge and are allowed to testify, the jury will then be the final arbiter of your testimony making its decision based on the admissible evidence after they determine how much weight to give to your testimony.

In 2000 the Federal Rules of Evidence were amended to incorporate the Daubert analysis. Rule 702 Fed. R. Ev. provides that the expert witness may only testify if:

1. the testimony is based on sufficient facts or data;
2. the testimony is the product of reliable principles and methods; and
3. the witness has applied the principles and theories reliably to the facts of the case.

The judge must assure that your proposed testimony truly proceeds from scientific knowledge. Procedurally there are a number of ways that the issue of you qualifications can be brought before the judge. One common procedure is to have a Daubert hearing where you testify on direct examination giving your attorney the chance to elicit testimony about your qualifications, the collection activities you engaged in, the reliability of your equipment and methodologies, and your overall knowledge of case facts that would be relevant to the opinions you intend to offer. You would then submit yourself to cross examination by opposing counsel, and thereafter the judge would make a ruling. This might be a separate hearing set some time before the trial. It might also take place during trial, with the jury being excused for the duration of the Daubert inquiry. In some cases, particularly where motions are involved, the determination may be made based on affidavits filed by you with the court.

Typically, you would begin with an explanation of your education and training that resulted in your being hired in the first place. Next you would focus on the facts you were given to serve as the basis for your work. You would also identify the specific issues you were asked to address. You would then turn to your collection activities. You would describe any equipment you used, and any steps you took to test the equipment in advance so you knew it was functioning properly at the time of the acquisition. Obviously, there are many different ways to acquire the electronically stored information so you need to be able to address why the method you chose is an acceptable method that produces reliable results. You would need to explain why you used write blocking technology and what its significance is to the acquisition process. An explanation of the verification of the data using hash values will probably occur at this point so you need to be prepared to go into detail on the type of hash you used, why the results are reliable, and what you did to make certain the hash values you obtained established a valid collection of the source data.