Training on how to be an expert witness is lacking.

I'm concerned that we are not properly preparing forensic investigators for the day they will need to testify or defend their report. This could open us up to a motion in limine, get your testimony thrown out and carry that black mark on your record with you for the rest of your career (not to mention hurt your client by leaving your side with no expert at trial).

While I have assisted LE with investigations, I will be the first to admit that I have not testified. In the cases where I have provided my input to a case, those cases have led to plea agreements. Due to my lack of experience, I'm going to ask the question…does an attorney going to court simply have the "expert" show up at the day of trial, or is there some preparation that occurs prior to the testimony of the expert? At some point, does the attorney sit down with the expert and simply ask what they have?

I know this sounds a bit ridiculous, but I hear this all the time…what a 'good defense attorney' can do to tear apart an expert's testimony, but I still have to wonder, if that's the case, why would a prosecutor put someone so unprepared on the stand to support their case?

I am at CEIC 2013 and have just left the second of two sessions on report writing and how to be an expert witness. None of my EnCase training, CCE class, or any other computer forensics class including these two I've just attended has adequately prepared me to be an expert witness in court or prepare a proper report following all the Federal Rules of Civil Procedure. I'm concerned about what this means for new investigators who don't have role models or outside training in how to be an expert witness.

The only way I know this is I have been to excellent training on how to be an expert witness sponsored by NACVA. It was a total of 7 days of training on report writing, preparing for trial, and testifying–including a mock deposition and mock jury trial with taped jury deliberations. I also am fortunate to work with financial experts who have testified at trial and deposition hundreds of times. I write reports with them and participate in attorney conferences and preparation for testimony with them. I'm finding that, in the digital forensics world, it is rare for an investigator to actually testify, so they are generally unprepared when they do testify. This is very dangerous.

Have you ever considered sharing the wealth of your experiences with the community through white papers, a blog, or some other means?

Would you be interested in a course like the two I attended on how to be an expert?

Honestly, I have no idea, as you really haven't provided too much information regarding the content of either course.

I'm curious…in your post, you made several references to reports, and defending same. What's the issue that you're attempting to address? Is it the reporting?

I tend to follow a case management process that begins when the first call comes in for assistance, and continues through the entire life span of the case, through reporting. There is documentation all along the way, starting with initial triage worksheet, going into case notes, and finally into reporting. I've even provided an example report based on an available practical exercise available online.

Can you provide what you see as a possible solution to the issue?

Thanks.

Due to my lack of experience, I'm going to ask the question…does an attorney going to court simply have the "expert" show up at the day of trial, or is there some preparation that occurs prior to the testimony of the expert? At some point, does the attorney sit down with the expert and simply ask what they have?

I've testified many times in criminal cases for the prosecution, and in the vast majority of cases, I didn't get time with the attorney, and consequently got asked less than optimal questions. That said, the attorney for the other side often asked questions that were much worse for his client.

My civil and defense attorney clients have been much better than the prosecutors that I worked with at spending time with me to understand the facts. Just none of my civil or defense cases have needed to go to court testimony. I've been deposed, but no court testimony yet in the civil system.

Per the OP's question, 2 things prepared me for court

1. Two and a half years of law school credits so I understood the function of testimony and how lawyers think. That's not going to help as advice for the vast majority of readers.

2. I watched a colleague testify very soon after I started in DF. I also made a point of taking people that I mentored to court with me when I was testifying locally and then debriefing them on it later. There's truly nothing like watching forensic testimony being presented to help you understand what's needed.

BTW, there are 2 DID NOT options in the poll above. I'm not sure which one you intended to be a "DID" option.

While I have assisted LE with investigations, I will be the first to admit that I have not testified. In the cases where I have provided my input to a case, those cases have led to plea agreements. Due to my lack of experience, I'm going to ask the question…does an attorney going to court simply have the "expert" show up at the day of trial, or is there some preparation that occurs prior to the testimony of the expert? At some point, does the attorney sit down with the expert and simply ask what they have?

I know this sounds a bit ridiculous, but I hear this all the time…what a 'good defense attorney' can do to tear apart an expert's testimony, but I still have to wonder, if that's the case, why would a prosecutor put someone so unprepared on the stand to support their case?

A good attorney will absolutely work with you to prepare and give you an opportunity to work with them to explain the case to them, but that costs money and time, both of which can be in short supply leading up to trial. Attorneys often assume they can settle and don't do good trial prep until the last minute. If you're not already ready to testify, it may be too late. My experience with this is all civil, but I suspect it is the same with overworked prosecutors.

Have you ever considered sharing the wealth of your experiences with the community through white papers, a blog, or some other means?

Before today, no but I am now. I don't have my own blog, and I'd have to get everything approved through my company before I could post it anyway. What I would prefer to do is arrange courses to cover this material. It's something that is hard to teach through the written word. I will think about putting something online, but not guarantees. See below for why.

Honestly, I have no idea, as you really haven't provided too much information regarding the content of either course.

The links point to descriptions of the courses.

The first is focused on deposition testimony and surviving that deposition–avoiding the pitfalls that could sink the case for your side. A report you've written will also be critiqued and picked apart in ways you would never have thought could happen. The people who teach it are excellent. One instructor's expertise is actually in getting other experts disqualified with motions in limine. This is a great forum to get this critique because there are no consequences of failure like there would be in a real case.

The second is a course combined with a case study. You get a commercial damages case on the first day and are split into two groups. One side works plaintiff and the other defense. You have the same facts along with expert reports that you have submitted. On the forth day of class, a mock trial is held with attorneys, a judge, and some temp workers brought in as the jury. This class is by far the best training I've had in the realm of soft skills. It's also the most work I've put into a class since college. About 8 hours of homework per night is a good estimate. Obviously, this case would need to be changed to include some forensics, but I think it could be done.

I'm curious…in your post, you made several references to reports, and defending same. What's the issue that you're attempting to address? Is it the reporting?

I tend to follow a case management process that begins when the first call comes in for assistance, and continues through the entire life span of the case, through reporting. There is documentation all along the way, starting with initial triage worksheet, going into case notes, and finally into reporting. I've even provided an example report based on an available practical exercise available online.

In general, expert reports submitted in Federal Court (and many state courts) have to have specific elements. If any are missing, your testimony can be excluded. It's ridiculous minutia, but in some instances our legal system depends on ridiculous minutia.

Here are the requirements for a report

FRCP Rule 26, excerpt
(2) Disclosure of Expert Testimony.

(A) In General. In addition to the disclosures required by Rule 26(a)(1), a party must disclose to the other parties the identity of any witness it may use at trial to present evidence under Federal Rule of Evidence 702, 703, or 705.

(B) Witnesses Who Must Provide a Written Report. Unless otherwise stipulated or ordered by the court, this disclosure must be accompanied by a written report—prepared and signed by the witness—if the witness is one retained or specially employed to provide expert testimony in the case or one whose duties as the party's employee regularly involve giving expert testimony. The report must contain

(i) a complete statement of all opinions the witness will express and the basis and reasons for them;

(ii) the facts or data considered by the witness in forming them;

(iii) any exhibits that will be used to summarize or support them;

(iv) the witness's qualifications, including a list of all publications authored in the previous 10 years;

(v) a list of all other cases in which, during the previous 4 years, the witness testified as an expert at trial or by deposition; and

(vi) a statement of the compensation to be paid for the study and testimony in the case.

Case documentation is obviously important, but if you offer any opinions in your report, you have to support them very well. The FRCP uses the word "report" but I think when examiners think of a report, they're mostly thinking of that think EnCase spits out (or something similar). Those reports are often inadequate. I use those reports as exhibits to my expert report so I can take a more free-form approach to explaining the results of the investigation.

Some important points here
- Did you include all these elements and sign the report? Maybe you produced a report that the attorney assumed was your expert report but you assumed was for his information only. What if he submits that as your report? You could be bound to it.
- Your blog postings for the past 10 years should be listed. Have you published anything that turned out to be false or contradicts what is in your report now? That could be used against you. This is the reason I really hesitate to post anything technical in nature on a blog.
- How do you couch your compensation in a way that makes it clear you are an impartial expert and not a hired gun–even though one side is paying you.

Can you provide what you see as a possible solution to the issue?

My proposed solution is more training. You can read about this until you go cross-eyed, but it won't have the same impact as seeing it in action will. Whitepapers, blog posts, etc obviously help, and maybe that's a good start, but if anyone is serious about being a good expert witness (which is worlds apart from being a good technical investigator) they need some training before they get on the stand.

I am willing to help put this together. I mentioned the NACVA courses because they are already set up with most of the elements we would need. I would like to add some items specific to writing reports in digital forensics, but 90% of the course could be taught as-is. I could piggy-back on the existing NACVA courses.

I envision this training would occur after the investigator is a good technician and his or her career is advancing to the point where he or she may be asked to testify.

Sorry, it's the old "double negative" bug Forensic Focus polls are famous for!

BTW, there are 2 DID NOT options in the poll above. I'm not sure which one you intended to be a "DID" option.

I don't know how that happened. Sorry. I proof read it twice and still had such an obvious mistake.

Sorry, it's the old "double negative" bug Forensic Focus polls are famous for!

Any chance you could edit the poll and clear the results so people can vote in it? I meant for the first option to be the positive and the second to be the not.

I've testified dozens of times in State. Federal and International courts. Generally, most attorneys don't have a lot of trial experience with expert witnesses. I've found that it's helpful to explain to the attorney what questions they need to ask in order to elicit the responses that accurately express your findings, as well as what questions and answers are likely to come out from the opposition.

As an example, if you're examining a computer for evidence of a theft of IP (and your findings indicate it happened) you might tell your attorney

1. Ask me what I examined.
2. Ask me whether there were indications of an external device connected.
3. Ask me whether there were indications that company documents were accessed from that device.

As far as "contrary questions" go, sometimes an attorney wants to ask them himself - other times, he wants the opposition to ask (or not ask) them.

In either case, try and anticipate the weaknesses in your own argument

"Can you say WHO was behind the keyboard at the time of this access?" (No, or 'No, but there was access to Mr. Defendant's Gmail account 1 minute prior and his bank account 1 minute after the file transfer' are both good answers)

The most important advice I ever received regarding expert testimony has been

1. Don't be evasive - if your answer seems bad news for your client, it's the attorney's responsibility to rehabilitate you as a witness.

2. Make opposing counsel be clear in their questions. A simple "Could you rephrase that, I'm not sure I understand your question." will save a lot of heartache.

3. Remember, you are there to clarify complicated details in the case. You are there to assist the Court (and jury) in understanding things that are integral to the matter. If you aren't a partisan hack (or an idiot), you'll be fine. Withering cross-examination isn't bad if you're simply stating and interpreting facts. When it gets ugly is when you're making baseless assumptions, or drawing conclusions that support your case regardless of the evidence.

In closing - every time on the stand sucks to some degree, in my opinion. The uncertainty of the moment is disquieting for everyone I've conferred with. Having testified in criminal and civil matters, here and abroad, they've all gone well in the end - but the lead-up and execution has been stressful every time.

My two cents.

Although I have not testified in digital forensic cases, I have testified as expert witness and as an investigating detective in numerous other criminal cases and depositions. Call it fortunate, before every major criminal case, the prosecutor prepared me for the case. We went over the evidence, what questions he/she would ask, and my response. We also discussed what kind of questions to expect from the defense attorney and my response. A good defense attorney can make an investigator look totally incompetent. It happened to me a few times but I have learned from it. By the time the defense attorney was done I was beginning to doubt my own abilities. )

He messed with my head. (but in my defense, it was very early in my career). )

Two things I learned early on, are to maintain eye contact and do not volunteer information. Only answer what you are asked.

I have never testified in a trial for CF expert testimony; however, I have testified for CF cases in preliminary trials, which all took a plea deal afterwards. I've also testified a handful of times in non-CF criminal cases; and hundreds of times in preliminary trials.

My advice-

1. Study your report the night before testifying. You don't want to look incompetent and having to keep referring to your report while on the stand.

2. Keep in contact with the attorney (good side or bad side- which ever you side you are testifying for) and go over the case and ask, "What are the issues we are facing?" Any good attorney will know what flaws each case has. To expand on this, yes– most attorneys will make an effort to speak with you prior to testifying. However, our DA – and I'm sure most DA offices – are overloaded with cases, so clearing time to speak to all their witness can be a daunting task. I would advise to keep in touch with them the weeks prior to testifying.

3. While on the stand– don't take things personal! Don't be argumentative! Don't be sarcastic! Just give your testimony, without emotions. Calm, courteous, and confident. Listen to the question being asked, don't rush into your answer…pause for a moment and think about your answer.

4. Remember you are explaining confusing information (computer technology) to people who barely understand how to make a new file on their desktop. Use real world examples that can help the jurors/judge/attorneys what you are trying to articulate. The way I do this, is by practicing explaining certain aspects of CF to colleagues in my office that work non-CF cases; or even my family and friends. They are your prospective jurors. If you can get them to understand, than you should have no problem explaining yourself to a jury.