Validating Proprietary Digital Forensic Tools: A Case for Open Source
Open source forensic tools may not be easy to work with, but can save a lot of grief down the road when used to validate results from proprietary tools.
Applying Melendez: Briscoe and Beyond
A look at the effects of Briscoe v. Virginia and subsequent case law on the enforcement and application of Melendez-Diaz v. Massachusetts.
Preparing For and Testifying At Trial
The final function of an expert witness is to testify live at trial. It is your chance to influence the judge and jury who will ultimately make the key decisions in the case. In many cases what you say and do at trial will make or break the case.
Expert Witness: Preparing for and Testifying at Depositions
Your deposition is the first opportunity an opposing attorney has to meet you in person and to examine you in a question-and-answer format. You should listen to the question and provide only as much testimony as is necessary to respond truthfully to the question.
Preparing an Expert Report
In most cases a computer forensic expert is called upon to prepare a written report before testifying in court. The report must contain specified items. The key is providing enough information to meet the requirements without providing too much information, setting you up for more cross examination.
New Federal Rules of Civil Procedure That Apply To Expert Witnesses
Rule 26 of the Federal Rules of Civil Procedure was amended in 2010, and as of December 1, 2010, the changes to the rule have significantly altered the type and scope of information that can be obtained from an expert witness in the course of discovery.
How to Be an Effective Expert Witness in Court: Part 3
Before you can be offered as an expert you must establish your qualifications. In federal court you must be able to meet the reliability standards defined in Daubert v. Merrell Dow Pharm.
How to Be an Effective Expert Witness in Court: Part 2
Apart from the expert report, probably the most important document you are likely to create as an expert witness is your Curriculum Vitae or resume. It will invariably be included as an exhibit to your professional report, and will undoubtedly be the first thing you are examined on at deposition or trial.
How to Be an Effective Expert Witness in Court: Part 1
One of a computer forensic expert's most important functions is to serve as a testifying expert in court. This series of articles is intended to prepare you to meet the challenge of being an expert witness when the opportunity presents itself. Part 1 will focus on the role of an expert witness.
Acceptable Use Policies
Most any type of business cannot function today without the use of computers in one fashion or another. It seems a paradox, then, that at no other time in history has the commodity of time been stolen and wasted by employees as much as today.
Privacy, Technology, and the Law
As mobile devices penetrate our daily lives, it is appropriate to evaluate the effect that these new devices have on our safety and privacy. We must also ensure that the law provides sufficient resources to investigators and prosecutors who investigate and prevent crimes against Americans who increasingly conduct their lives using this new medium.
Handling Search and Seizure Issues in Digital Evidence
The collection of digital evidence in criminal cases is governed at the Federal and State levels by numerous constitutional and statutory provisions, including statutes that regulate the communications and computer industries and that directly govern the gathering and use of digital evidence.
Validation of Forensic Tools and Software: A Quick Guide for the Digital Forensic Examiner
This article will attempt to outline the issues faced when drafting tool and software validations, the legal standards that should be followed when drafting validations, and a quick overview of what should be included in every validation.
Confronting Science: Melendez-Diaz and the Confrontation Clause
In an interesting turn of its docket this year, the U.S. Supreme Court agreed to hear a case with an almost identical issue as the controversial decision from last term’s Melendez-Diaz v. Massachusetts. However, the Court’s one-sentence opinion sent it back down to the Virginia Supreme Court, instructing its members to make their ruling consistent with last year’s. Melendez-Diaz provides clarity on the use of live testimony over the introduction of testimonial documents.
Expert Witness: Effective Courtroom Testimony
It is important to look, sound, and act the part to be a convincing and effective Expert Witness. You must be able to present evidence persuasively without confusing the jury for your evidence to shine.
Collaborative Computer Forensics
Often digital forensic investigators operate in a vacuum with limited information about the case they are working. Collaboration between investigators and attorneys, however, can lead to quicker and more cost effective results and a more successful analysis of the evidence.
Ethical Practices for Digital Forensic Examiners
One common misconception of an examiner’s analytical responsibilities is that he or she is to only analyze submitted evidence to the extent of the investigative request. This is far from the truth.
SWGDE Weighs in on Research Council Report
Recently, the Scientific Working Group on Digital Evidence posted a position paper on the National Research Council Report, “Strengthening Forensic Science in the United States: A Path Forward,” that states the “report is a call to action for SWGDE to strengthen the digital evidence discipline.”
Digital Evidence: Secure in Your Papers?
The execution of search warrants is in the digital press again. The Plain View Doctrine allows for the seizure of evidence without a search warrant generally because of the nature of the evidence. Two court rulings are of interest when it comes to being secure in our papers and property.
Plain View Doctrine in Digital Evidence Cases—A Common Sense Approach
For some time now, various authors have suggested eliminating plain view from searches of computer hard drives and other digital evidence. The real issue with plain view in computer searches is a misunderstanding of what a computer search is versus the forensic examination of a computer hard drive.
To Seek or Not to Seek a Warrant
In a real case scenario, investigators seized a laptop computer from a crime scene. After creating a forensic image of the hard drive, the examiner discovered hundreds of pornographic pictures and movies depicting underage children. He then exported all the incriminating data and the subject was charged with possession of child pornography. Is the search of the computer’s hard drive legal? Will the child pornography be admissible at the time of trial?
Search Warrants and Digital Evidence
Pertaining to the seizure of digital devices, there is some misunderstanding concerning what “executing the warrant” actually means. This case scenario examines the technicalities of serving a search warrant when dealing with digital evidence. At what point do you need a new warrant to search further on a computer?
Supreme Court Ruling Requires Computer Forensics Analysts’ Live Testimony
A recent Supreme Court ruling places computer forensics under the scope of Court’s requirement for live testimony by forensic analysts. Although this controversial 5 to 4 decision was well-debated and resolved on constitutional grounds, the ramifications may include increased burdens placed on already over-taxed cybercrime labs.
Digital Evidence Accreditation: Part 2
The Digital Evidence discipline became part of the American Society of Crime Laboratory Directors/Laboratory Accreditation Board’s (ASCLD/LAB) accreditation program in April 2003.
The Hash Algorithm Dilemma–Hash Value Collisions
Digital Evidence, like any other type of evidence, requires identification, collection, a chain of custody, examination/analysis, and finally authentication in court during presentation to the trier of fact.