Prior experience as an expert witness is a useful, but not necessarily an essential attribute in a digital forensics specialist. "There's a first time for everything, including expert witness testimony," Gill said. "If the person is competent, articulate, and possesses the skills required to translate difficult technical jargon to layman's terms, previous experience as an expert witness might not be necessary."
To spot unqualified candidates, Damon Petraglia, forensic and information security services director at Chartstone Consulting, a digital forensic service provider headquartered in Fairfield County, Conn., suggested asking a series of case-relevant questions. "These questions should have elements of criminal or civil procedure, rules of evidence, investigative techniques and relevant technological protocols," he said. "The qualified expert will be able to blend these topics to create a holistic investigative view and create a plan, procedure and tool selection to address the needs of the particular case."
In the interview with a candidate, said Petraglia, "it would be good to provide a hypothetical scenario where some type of valued data were stolen from a computer or network." In building the hypothetical, consider whether "email and several network protocols for data transfer have been ruled out as potential avenues of exfiltration," continued Petraglia." Have the candidate identify alternate methods of exfiltration and incorporate a process to investigate. The candidate should identify removable media, including USB devices as a methods of exfiltration. The candidate should then walk through the process for this particular scenario."
Wochna said that the most common mistake an unqualified expert makes is testifying beyond the limits of the supporting evidence. Some forensic examiners profess to be image experts, especially in child pornography cases, and may claim expertise not supported by the profession, said Wochna. "Examiners that, for example, profess to be able to discern the identify of the specific person operating a keyboard during a critical time, generally expose themselves to damaging cross-examination in which they must admit that there are no forensic artifacts that identify unique individuals," he explained.
The cost of hiring digital forensic experts vary widely. "I have seen hourly rates as low as $100 per hour to upwards of $600 per hour," Gill said. Location, experience, and the size of the expert's support team all play a role in the determining hourly rates. "Also, some states [such as Calif. and Fla.] require forensic examiners to be licensed and bonded as a private investigator, which can drive up costs," Gill observed.
Wochna suggested looking for a digital forensics expert who has a consistent track record of working closely with attorneys. "The best examiners are those that provide the attorney [with] the good, the bad, and the ugly of a case and allow the attorney to strategically use the expert’s opinion to identify issues associated with the claims, defenses and damages," he said.
Interviewing multiple forensics specialists before making a final decision is always a good idea, advised Gill. "Even though several [experts] may be good, you might find one in particular that works best with your style," he noted. It's also useful to gradually build a portfolio of experts knowledgeable in different forensic areas, Gill said.
Peter Coons, a senior vice president at D4 eDiscovery, a digital forensics company headquartered in Rochester, N.Y., said that forensics expert candidates should be scrutinized as closely and carefully as applicants for a full time job. "Ask for a resume/CV [curriculum vitae] and [then] call references," he said. "Ask if you can review transcripts of prior testimony both written and oral, give the person a five-minute Q&A session that's like a mock trial — direct and cross — and ask them what they like and dislike about testifying."
Before beginning to look for a forensics expert, Sizemore said that a lawyer should learn as much as possible about the type and scope of digital evidence involved in the pending case. "Not only will your knowledge enable you to narrow your search for a qualified forensics expert, but it will ultimately help you control the cost of the engagement," he said.
John Edwards is a freelance writer based in Arizona. E-mail: jedwards@gojohnedwards.com.
Subscribe to Law Technology News
