Mgmt Digital Forensics/eDisc - Chapter 15

Voire Dire

- "To see, to say" in French - Questions asked to demonstrate you are an expert witness

For either types of testimony:

- Establish communication early with attorney - Learn about the victim, the complainant, opposing experts or fact witnesses, and the opposing attorney - Learn the basic points of dispute - Keep notes in rough draft form and record only facts (keep opinions to a minimum)

Expert Witness

- Has opinions based on observations - Opinions are formed from experience and deductive reasoning - Opinions make the witness an expert

Understanding prosecutorial misconduct:

- If you have found exculpatory evidence, you have an obligation to ensure the evidence is not concealed - Report the evidence to the prosecutor handling the case and document that communication - If this information is not disclosed to the defense attorney in a reasonable time, you can report it to the prosecutor's supervisor or the judge

Curriculum Vitae (CV)

- Lists your education, training, and professional experience - Used to qualify your testimony - Shows that you continuously enhance your skills - Details specific accomplishments - Lists basic and advanced skills - Includes a testimony log

Guidelines on testifying:

1. Be professional and polite 2. Be conscious of the jury, judge, and attorneys 3. If asked something you cannot answer, say "that is beyond the scope of my expertise" or "I was not asked to investigate that" 4. Avoid overstating opinions 5. Guidelines on delivery and presentation: always acknowledge the jury and direct your testimony to them 6. Movement: turn towards the questioner when asked, and turn back to the jury when answering 7. Place mic six to eight inches from you 8. Use simple, direct language to help the jury understand you 9. Avoid humor 10. Build repetition into your explanations 11. Use chronological order to describe events 12. If you are using technical terms, identify and define these terms for the jury 13. Cite the sources of the evidence the opinions are based on 14. Make sure the chair's height is comfortable, and turn the chair so that it faces the jury 15. Dress in a manner that conforms to the community's dress code 16. Don't memorize your testimony 17. For direct examination, state your opinions, identify evidence to support your opinion, explain the method used to arrive to that opinion, explain the method used to arrive to that opinion, restate your opinion

Reviewing your role as a consulting expert or an expert witness:

1. Do not record conversations or telephone calls 2. Federal information requirements 3. Evaluate the court's expert 4. Brief your attorney on your findings and opinion of the court's expert

Documenting and Preparing Evidence:

1. Document your steps (to prove them repeatable) 2. Validate your tools and verify evidence with hash algorithms to ensure integrity 3. Do not use a formal checklist in final report (opposing attorneys can challenge them) 4. Collect evidence and document employed tools 5. Maintain chain of custody 6. Collect the right amount of information (only what was asked for) 7. Note the date and time of your forensic workstation when starting your analysis 8. Keep only successful output (do not keep previous runs) 9. Search for keywords using well-defined parameters 10. Keep your notes simple 11. List only relevant evidence on your report 12. Define any procedures you use to conduct your analysis as scientific (list textbooks, technical books, articles, etc)

List two types of depositions.

1. Testimony preservation 2. Discovery

Procedures for testifying in court during a trial:

1. Your attorney presents you as a competent expert 2. Opposing attorney might attempt to discredit you 3. Your attorney guides you through your testimony 4. Opposing attorney cross-examines you 5. Your attorney might have an opportunity for redirect examination of material addressed in cross-examination 6. You could also be called later as a rebuttal witness

Why you should avoid contact with the news media:

1. Your comments could harm the case and create a record that can be used against you 2. You have no control over the context of the information a journalist publishes 3. You can't rely on a journalist's promises of confidentiality

Plaintiff

A person who brings a case against another in a court of law

Motion in Limine

A pretrial motion requesting the court to prohibit the other side from presenting, or even referring to, evidence on matters said to be so highly prejudicial that no steps taken by the judge can prevent the jury from being unduly influenced

Your curriculum vitae is which of the following? A. A necessary tool to be an expert witness B. A generally required document to be made available before your testimony C. A detailed record of your experience, education, and training D. Focused on your skills as they apply to the current case

A. A necessary tool to be an expert witness B. A generally required document to be made available before your testimony C. A detailed record of your experience, education, and training

Before testifying, you should do which of the following? A. Create an examination plan with your retaining attorney. B. Make sure you've been paid for your services and the estimated fee for the deposition or trial. C. Get a haircut. D. Type all the draft notes you took during your investigation.

A. Create an examination plan with your retaining attorney. B. Make sure you've been paid for your services and the estimated fee for the deposition or trial.

Defense

At criminal law, a legal position that allows the defendant to escape criminal liability

What is a motion in limine? A. A motion to dismiss the case B. The movement of molecules in a random fashion C. A pretrial motion for the purpose of excluding certain evidence D. A pretrial motion to revise the case schedule

C. A pretrial motion for the purpose of excluding certain evidence

Consulting Expert

Expert retained to give advice but not to testify at trial

Validate your tools and verify your evidence with ____ to ensure its integrity.

Hash Algorithms

Independent Recollection

Information you know about this case and others without being prompted

Discovery Deposition

Part of the discovery process for a trial

Customary Practice

Procedures that are traditionally following in similar cases

____ from both the plaintiff's and defense's attorneys is an optional phase of the trial. Generally, it is allowed to cover an issue raised during cross-contamination of a witness.

Rebuttal

Testimony Preservation Deposition

Requested by your client and preserves your testimony in case of schedule conflicts or health problems

Closing Arguments

Statements that organize the evidence and state the applicable law

Repeating a trial, the term ____ means rejecting potential jurors.

Strikes

When you give ____ testimony, you present this evidence and explain what it is and how it was obtained.

Technical/Scientific

Jury Instructions

The attorneys propose instructions to the jury on how to consider the evidence, and then the judge approves or disapproves

Impaneling the jury

The process of selecting individuals to serve on a jury from the jury pool

How to preparing technical definitions/concepts:

Use your own words and language

Fact Witness

- Provides facts found in investigation - Explain what evidence is and how it was obtained - Does not offer conclusions, only facts

Examples of definitions to prepare ahead of time:

1. Digital forensics or computer forensics 2. Hashing algorithms 3. Image files and bit-stream copies 4. File slack and unallocated space 5. File slack and unallocated space 6. File timestamps 7. Computer log files 8. Folder or directory 9. Hardware 10. Software 11. OS

What to check to find opposing experts strengths and weaknesses:

1. Internet 2. Curriculum vitae 3. Deposition banks

Typical order or trial:

1. Motion in limine 2. Impaneling the jury 3. Opening statements 4. Plaintiff 5. Defense 6. Rebuttal 7. Closing arguments 8. Jury instructions

Federal information requirements regarding reviewing your role as a consulting expert or an expert witness:

1. Other cases in which you have testified as an expert witness in the last four years 2. Ten years of any published writings 3. Previous compensations for testifying

List three items you should include in your CV.

1. Previous expert testimony 2. Work experience 3. Training you provided or contributed to 4. Professional awards or recognition

Avoiding testimony problems:

1. Recognize when conflict-of-interest issues apply to your case 2. Avoid agreeing to review a case unless you are under contract with that person 3. Avoid conversations with opposing attorneys 4. You should receive payment before testifying 5. Don't talk to anyone during court recess 6. Make sure you conduct any conferences with your attorney in a private setting

Testifying during cross-examination:

1. Use your own words 2. Keep in mind that certain words have additional meanings 3. Be aware of leading questions 4. Never guess when you do not have an answer 5. Be prepared for challenging pre-constructed questions 6. Rapid-fire questions 7. Sometimes opposing attorneys declare that you are not answering the questions 8. Keep eye contact with the jury 9. Sometimes opposing attorneys ask several questions inside one question 10. Attorneys make speeches and phrase them as questions 11. Attorneys might put words in your mouth 12. Be patient 13. Most jurisdictions now allow the judge and jurors to ask questions 14. Avoid feeling stressed and losing control 15. Never have unrealistically high self-expectations when testifying; everyone makes mistakes 16. Avoid being argumentative when being badgered by the opposing attorney, having poor listening skills or using defensive body language, being too talkative or talking too fast, being too technical for the jury to understand, or acting surprised and unprepared to respond when presented with unknown or new information

Providing qualifications for your testimony:

1. Using voire dire to demonstrate you are an expert witness 2. Attorney asks the court to accept you as an expert on digital forensics 3. Opposing attorney might try and disqualify you (depends on your CV and experience)

When preparing your testimony consider the following questions:

1. What is the client's overall theory of the case? 2. What is my story of the case? 3. What can I say with confidence? 4. How does my opinion fir into the theory of the case? 5. What is the scope of the case? Have I gone too far? 6. Have I identified the client's needs for how many my testimony fits into the overall theory of the case?

Techniques to use during direct examination:

1. Work with your attorney to get the right language 2. Be wary of your inclination to be helpful 3. Review the examination plan your attorney has prepared 4. Provide a clear overview of your findings 5. Use a systematic easy-to-follow plan for describing your methods 6. Practice testifying 7. Use your own words when answering questions 8. Make sure to be aware o the following terms: independent recollection, customary practice, documentation of the case 9. Present your background and qualifications 10. Avoid vagueness 11. When you are using graphics in a presentation, make sure the jury understands your explanations

What should you do if you realize you have made a mistake or misstatement during a deposition? A. If the deposition is still in session, refer back to the error and correct it. B. Decide whether the error is minor, and if so, ignore it. C. If the deposition is over, make the correction on the corrections page of the copy provided for your signature D. Call the opposing attorney and inform him of your mistake or misstatement. E. Request an opportunity to make the correction at trial.

A. If the deposition is still in session, refer back to the error and correct it. C. If the deposition is over, make the correction on the corrections page of the copy provided for your signature

During your cross-examination, you should do which of the following? A. Maintain eye contact with the jury. B. Pay close attention to what your attorney is objecting to. C. Help the attorneys, judge, and jury in understanding the case, even if you have to go a bit beyond the scope of your expertise. D. Pay close attention to opposing counsel's questions. E. Answer opposing counsel's questions as briefly as is practical.

A. Maintain eye contact with the jury. B. Pay close attention to what your attorney is objecting to. D. Pay close attention to opposing counsel's questions.

When using graphics while testifying, which of the following guidelines applies? A. Make sure the jury can see your graphics. B. Practice using charts for courtroom testimony. C. Your exhibits must be clear and easy to understand. D. Make sure you have plenty of extra graphics, in case you have to explain more complex or supporting issues.

A. Make sure the jury can see your graphics. B. Practice using charts for courtroom testimony. C. Your exhibits must be clear and easy to understand.

Which of the following describes expert witness testimony? A. Testimony designed to assist the jury in determining matters beyond the ordinary person's scope of knowledge B. Testimony that defines issues of the case for determination by the jury C. Testimony resulting in the expression of an opinion by a witness with scientific, technical, or other professional knowledge or experience D. Testimony designed to raise doubt about facts or witnesses' credibility

A. Testimony designed to assist the jury in determining matters beyond the ordinary person's scope of knowledge C. Testimony resulting in the expression of an opinion by a witness with scientific, technical, or other professional knowledge or experience

Conflicting out

An attempt by opposing attorneys to prevent you from serving on an important case

Rebuttal

An optional phase of the trial. Generally, it is allowed to cover an issue raised during cross-examination of a witness

When working for a prosecutor, what should you do if the evidence you found appears to be exculpatory and isn't being released to the defense? A. Keep the information on file for later review. B. Bring the information to the attention of the prosecutor, then his or her supervisor, and finally to the judge (the court). C. Destroy the evidence. D. Give the evidence to the defense attorney

B. Bring the information to the attention of the prosecutor, then his or her supervisor, and finally to the judge (the court).

The most reliable way to ensure that jurors recall testimony is to do which of the following? A. Present evidence using oral testimony supported by hand gestures and facial expressions. B. Present evidence combining oral testimony and graphics that support the testimony. C. Wear bright clothing to attract jurors' attention. D. Emphasize your points with humorous anecdotes. E. Memorize your testimony carefully.

B. Present evidence combining oral testimony and graphics that support the testimony.

What expressions are acceptable to use in testimony to respond to a question for which you have no answer? A. No comment. B. That's beyond the scope of my expertise. C. I don't want to answer that question. D. I wasn't asked to investigate that. E. That's beyond the scope of my investigation.

B. That's beyond the scope of my expertise. D. I wasn't asked to investigate that. E. That's beyond the scope of my investigation.

In answering a question about the size of a hard drive, which of the following responses is appropriate? A. It's a very large hard drive. B. The technical data sheet indicates it's a 3 terabyte hard drive. C. It's a 3 terabyte hard drive configured with 2.78 terabytes of accessible storage. D. I was unable to determine the drive size because it was so badly damaged.

B. The technical data sheet indicates it's a 3 terabyte hard drive. C. It's a 3 terabyte hard drive configured with 2.78 terabytes of accessible storage. D. I was unable to determine the drive size because it was so badly damaged.

At trial as a fact or expert witness, what must you always remember about your testimony? A. You're responsible for the outcome of the case. B. Your duty is to report your technical or scientific findings or render an honest opinion. C. Avoid mentioning how much you were paid for your services. D. All of the above

B. Your duty is to report your technical or scientific findings or render an honest opinion.

Opening Statements

Both attorneys provide an overview of the case, with the plaintiff's attorney going first

What kind of information do fact witnesses provide during testimony? A. Their professional opinion on the significance of evidence B. Definitions of issues to be determined by the finder of fact C. Facts only D. Observations of the results of tests they performed

C. Facts only D. Observations of the results of tests they performed

Which of the following describes fact testimony? A. Scientific or technical testimony describing information recovered during an examination B. Testimony by law enforcement officers C. Testimony based on observations by lay witnesses D. None of the above

C. Testimony based on observations by lay witnesses

If you're giving an answer that you think your attorney should follow up on, what should you do? A. Change the tone of your voice. B. Argue with the attorney who asked the question. C. Use an agreed-on expression to alert the attorney to follow up on the question. D. Try to include as much information in your answer as you can.

C. Use an agreed-on expression to alert the attorney to follow up on the question.

____ is an attempt by opposing attorneys to prevent you from serving on an important case.

Conflicting out

A ___ differs from a trial testimony because there is no jury or judge.

Deposition

Deposition

Differs from the trial testimony because there is no jury or judge. Both attorneys ask you questions with the purpose of the opposing attorney to preview your testimony before trial

You provide ____ testimony when you answer questions from the attorney who hired you.

Direct

The ____ is the most important part of testimony at a trial.

Direct examination

There are two types of depositions: ___ and testimony preservation.

Discovery

____ evidence is evidence that exonerates or diminishes the defendant's liability.

Excuplatory

Documentation of the case

The written records you have maintained

Voir dire is the process of qualifying a witness as an expert.

True