Part 5 of our series on How to Be an Effective Expert Witness in Court.

In most cases a computer forensic expert is called upon to prepare a written report. If the expert is going to testify in federal court a written report is mandatory unless otherwise stipulated or ordered by the court. Rule 26 (2)(A) Fed. R. Civ. P., requires that witnesses intended to be used at trial who will present evidence under Federal Rule of Evidence 702, 703, or 705 (the specific rules that apply to expert testimony) be disclosed in the initial witness disclosure required under Rule 26(a)(1). Although the rule requires that the expert's identity be disclosed as part of the initial disclosures it is not uncommon for parties to agree to a different disclosure date as part of a pre-trial scheduling order. Sometimes even the disclosure of the expert's identity is pushed off into the future per the scheduling order.

Regardless of when the expert is identified, Rule 26 contains specific requirements that pertain to expert reports. Rule 26 (2)(B) contains the following specific provisions for testifying experts:

(B) Witnesses Who Must Provide a Written Report. Unless otherwise stipulated or ordered by the court, this disclosure must be accompanied by a written report—prepared and signed by the witness—if the witness is one retained or specially employed to provide expert testimony in the case or one whose duties as the party’s employee regularly involve giving expert testimony. The report must contain:

(i) a complete statement of all opinions the witness will express and the basis and reasons for them;

(ii) the facts or data considered by the witness in forming them;

(iii) any exhibits that will be used to summarize or support them;

(iv) the witness’s qualifications, including a list of all publications authored in the previous 10 years;

(v) a list of all other cases in which, during the previous 4 years, the witness testified as an expert at trial or by deposition; and

(vi) a statement of the compensation to be paid for the study and testimony in the case.

In some cases a written expert report may not be required, but in those cases the following provisions apply:

(C) Witnesses Who Do Not Provide a Written Report. Unless otherwise stipulated or ordered by the court, if the witness is not required to provide a written report, this disclosure must state:

(i) the subject matter on which the witness is expected to present evidence under Federal Rule of Evidence 702, 703, or 705; and

(ii) a summary of the facts and opinions to which the witness is expected to testify.

(D) Time to Disclose Expert Testimony. A party must make these disclosures at the times and in the sequence that the court orders. Absent a stipulation or a court order, the disclosures must be made:

(i) at least 90 days before the date set for trial or for the case to be ready for trial; or

(ii) if the evidence is intended solely to contradict or rebut evidence on the same subject matter identified by another party under Rule 26(a)(2)(B) or (C), within 30 days after the other party’s disclosure.

Thus, even where a report is not required, a written summary of opinions is required. This can often be as time consuming to prepare as simply writing a report.

State court requirements vary considerably. It is more likely that you will not be required to prepare a written report if the case is in state court. However, many states follow the federal rules, so regardless of the case venue you should be prepared to provide a written report as part of your work on the case.

The report must contain the specified items, but there is no requirement that they be presented in the order identified in the rule; nor is there a limitation that would prevent you from adding more information than that specifically identified. The key is providing enough information to meet the rule's requirements without providing too much information that only sets you up for more cross examination.

The Report
A typical report will begin with a factual statement in which the parties are identified, the basic relevant facts of the case are set forth, and the specific task assigned to the forensic examiner by the hiring attorney is laid out. Once this introductory material is set out, you shift to a description of your collection activities to establish that you have properly gathered the electronic evidence you examined and about which you will opine. This would include specifying the equipment used, the methodology employed, and the steps followed in the collection process. You will want to include information relating to hash values to verify the copies of the evidence you made are exact duplicates of the source data. Next you would turn to a description of the methods of analysis used to analyze the data. The specific findings can be listed at this point, or saved for later when you state your opinions.

Typically the next section of the report contains your opinions and the supporting commentary required under the rule. You must specify each opinion you intend to offer and provide your reasons and bases for the opinions. The specific supporting data relied upon for an individual opinion should be identified as well. The level of detail will depend on whether you have previously described the results of your analysis in your report. If you did, you can incorporate it by reference in the section dealing with your individual opinions. You need to be as thorough as possible, since a failure to identify a particular opinion may result in your subsequent testimony being limited. You should write the report with the expectation that if it is not in the report you won't be allowed to testify about it.

Since copies of any exhibits you intend to use to substantiate your opinions are supposed to be attached to the report, it is important to work early and closely with your attorney to decide on what you should prepare. Exhibits should be prepared with the expectation that they will be used in front of a jury so consideration should be given to the look of the exhibits from a demonstrative evidence perspective. Just attaching a bunch of spreadsheets is not enough. You need to consider how the spreadsheet evidence will be presented in order to properly prepare your exhibits. Timelines need to be developed. Key documents recovered need to be identified. You may even be required to provide any demonstrative exhibits that you intend to use to educate the jury on basic computer components or processes. Thought must be given far enough in advance so you won't find yourself limited at trial in terms of the exhibits you are allowed to use.

You also need a section on your qualifications. Typically a brief narrative identifying who you are and your basic qualifications is set forth in the report, and then a copy of your full CV is attached as an exhibit. If you don't want to attach the CV you may need to go into greater detail about your qualifications in the body of the report.

You are also required to provide a statement of your compensation. Typically this would include a statement of any flat fee based activities (such as a flat fee per computer imaged or processed), together with a statement identifying your hourly rate and the total number of hours spent working on the case. You should provide a statement of your charges incurred up to the date of the submission of your report. You may be tempted to attach a copy of your billing statements. However, unless you are required to produce them, you should not volunteer this information. The descriptive portion of the bill describing the tasks you've undertaken can be grist for cross examination. You can find yourself in a Sword of Damocles situation where you've either provided too much or too little detail. The best option is to simply provide a statement of total fees and expenses incurred to date.

In writing your report you need to keep in mind the likely reader or readers. Your attorney must be able to understand what you've done, and a Judge must understand it as well. In all likelihood the report will be offered as an exhibit at trial so you need to consider that an average juror will also be reviewing it. Therefore, you do not want to be excessively technical. If technical explanations are required, you need to provide interpretations of the technical matters in lay terms that all of the people reading your report can understand. Define technical terms in the body of the report or with footnotes. Use analogies to explain methodologies and technical aspects of your analysis. In short, avoid writing geek to geek.

Finally, include enough information so your report is intelligible and you have offered a thorough statement of each opinion you intend to offer at trial. Do not, however, include more than is necessary to meet your obligations under the rules. Avoid volunteering information that is not specifically relevant. You are writing a report, not a thesis. If you volunteer too much, all you are doing is providing the opposing attorney with ammunition to use in cross examination. Be cognizant of the fact that whatever you state can and will be used against you if the opportunity arises. Therefore, be as precise and as succinct as you can be.

Under the recently amended Rule 26(b)(4)(B), early drafts of your report no longer need to be produced. This gives you the flexibility to discuss your report with your attorney to be certain you have meet your obligations but have not offered too much information. It is expected that you will confer with your attorney before submitting the final draft.

Bruce A. Olson is an experienced board certified civil trial attorney and a CCE who has testified at both depositions and in court as a computer forensic expert.

Read past articles from our series on testifying as a digital forensic expert witness: Part 1 looked at the role of the computer forensic expert; Part 2 at expert qualifications and preparing a CV; Part 3 examined the Daubert rules for qualification; and Part 4 explained the new federal rules of civil procedure.