EnCE · Domain 8
Reporting, Testimony and Legal Process
About 12% of the exam
Report structure
- Executive summary
- Scope and authority
- Evidence described
- Methodology
- Findings
- Limitations
- Summary written for a non-technical reader
- Each finding answers a scope question
- Describe an artifact once, cite it repeatedly
- Limitations stated without being asked
If a finding cannot be traced back to a named artifact, it belongs in the opinion section or nowhere
Methodology section
- Tools with versions and settings
- Which hash algorithms were used and when
- Whether acquisition and verification values matched
- Any deviation from standard procedure
- Steps another examiner could repeat
- Who performed each stage of the work
Limitations worth disclosing
- Logical extraction left unallocated space unexamined
- Encrypted content could not be opened
- Retention had already removed some periods
- Live acquisition changed the running source
- Only certain devices were made available
- Tool support for a format was incomplete
Live acquisition in the report
- Explain that the source changed while copying
- The hash verifies the image, not the disk
- Record what was running during collection
- Note the footprint the collection left
- Justify why live collection was necessary
- Show the verification you could perform
Admissibility framework
Reliability tests
- General acceptance in the relevant community
- Testing with a known error rate
- Peer reviewed and published methods
- Standards that control the operation
- Gatekeeping extends to technical experience
Authentication
- Matching hashes across the copies
- Custody record without unexplained gaps
- Testimony describing the collection method
- Certification can substitute for a witness
Document rules
- Duplicates admitted like originals ordinarily
- Genuine authenticity questions change that
- Business records need a foundation witness
- Machine generated output is not a statement
A hash proves the copy matches what was acquired, but a witness still ties that acquisition to a specific device
Peer review
- A second qualified examiner checks the findings
- Review tests support, not writing style
- Verify key findings with a second tool
- Investigate discrepancies rather than choosing
- Document the reconciled result
- Record who reviewed and when
Expert roles
- Consulting expert
- advises counsel, usually not disclosed
- Testifying expert
- opinions and basis become discoverable
- Role change
- reviewed material may become discoverable
- Fact witness
- describes what was done, not opinions
- Court appointed
- neutral examiner serving the court
- Rebuttal expert
- responds to the other side's report
Written expert report contents
- Complete statement of every opinion
- The basis and reasons for each
- Facts and data actually considered
- Exhibits used to support the opinions
- Qualifications and recent publications
- Prior testimony and compensation terms
Deposition conduct
- Answer only the question asked
- Decline new analysis on the spot
- Ask for clarification rather than guessing
- Do not speculate beyond the evidence
- Concede what the evidence cannot exclude
- Correct an error as soon as you notice it
Refusing to run an unplanned analysis in the room is not evasion; controlled and documented conditions are the point
Testimony technique
Credibility
- Explain in plain language, not jargon
- Stay neutral toward the retaining party
- Show the method, not just the conclusion
- Admit the limits of your findings
Common questions
- Could someone else have used the computer
- Could the timestamps have been altered
- Did you examine every device
- Was your tool ever independently validated
Exhibits
- Every event traceable to record evidence
- No entries the evidence does not support
- Simple visuals a jury can follow
- Consistent time zone throughout
Production and privacy
- Images often contain unrelated personal data
- Raise scope concerns with counsel early
- Filtering or a neutral review can narrow production
- Protective orders restrict access and use
- Tiered designations limit who may read material
- Document what was produced and to whom
Closing the engagement
- Disclose conflicts as soon as you notice them
- Record the return or destruction of evidence
- Retain the case file per the schedule
- Keep working copies until authorized to delete
- Note the authority for the disposition
- Capture lessons for the standard procedure
Rapid recall
- Gatekeeping
- judge screens expert evidence for reliability
- General acceptance
- the community accepts the technique
- Foundation witness
- establishes how records were kept
- Duplicate
- copy admitted like the original
- Protective order
- limits access to produced material
- Discoverable
- the other side may demand it
- Reconciled result
- explained outcome after tools disagreed
Know the order
- Confirm the scope questions
- Assemble the evidence descriptions
- Write method then findings
- State limitations
- Peer review
- Issue and testify
Write the method before the findings, because a method that cannot be repeated makes findings worthless
Reference strip: reporting and court
Report sections
- Executive summary up front
- Scope, authority and evidence
- Methodology and tools
- Findings with citations
- Limitations and caveats
Admissibility
- Reliability and general acceptance tests
- Authentication through hash and custody
- Duplicates and best evidence
- Business records foundation
Expert duties
- Complete statement of opinions
- Facts and data considered
- Qualifications and prior testimony
- Compensation terms disclosed
Testimony
- Plain language explanations
- Neutral stance under pressure
- Concede what evidence cannot exclude
- Exhibits traceable to the record
Case closure
- Conflicts disclosed promptly
- Production limited appropriately
- Evidence returned or destroyed
- Case file retained per schedule
Quick exam traps
- Trap: A hash match alone authenticates the evidence completely
- Trap: Reporting only the findings that support the client is acceptable
- Trap: An expert should never concede an alternative explanation
- Trap: The same reliability standard applies in every court
- Trap: A duplicate image is inadmissible when the original exists
- Trap: Performing quick analysis during a deposition is helpful
- Trap: Peer review is unnecessary when the examiner is experienced
cybercertprep.com · original revision sheet written from the public body of knowledge