This discussion deals with the final issue any computer forensics examiner or any other witness to an event will face – testifying under oath to what you know. Each person who testifies is a witness and as we discussed several weeks ago, will present testimonial evidence. As an expert witness, which is how a computer forensic examiner will be generally be presented, you are not providing eye-witness testimony to a crime, but are testifying about what you as an expert found or did not find during your collection, preservation, and examination of physical evidence (real evidence).
Many times and in most jurisdictions, before you actually testify before the jury (or judge if the trial is just before a judge) about your role in the case and your analysis and examination of the evidence, you may have to go through a preliminary hearing where the party that wants you to testify offers you to the court (outside the presence of the jury) as an expert. This may occur on a date before the trial, or during the trial. In doing so, you will testify first under direct examination by that attorney regarding your expertise and perhaps the admissibility of digital forensics as evidence in general. You will prepare for this examination with attorney beforehand. Once the attorney conducts the direct examination, during which time you will be discussing your training, experience, education and certifications as well as whether you have ever testified as an expert in any other trial, the attorney would most likely then offer you to the court as an expert and ask the judge to accept you as such (the sequence of this process varies from jurisdiction to jurisdiction).
It is generally at that point that the other side’s attorney will then have an opportunity to cross-examine you. Under cross-examination, that attorney is able to ask you leading questions – which in general have the answer contained within the question. For instance, where the government’s lawyer (in a criminal trial) would ask you: “Agent Witness, please tell us of your educational background.” The defense attorney would be able to phrase a question like this: “Isn’t it true that you never received a college degree in computer science”? The opposing counsel gets to cross-examine you to try to defeat your being named as an expert. In cases where you have already been determined to be an expert by the court on previous occasions and testimony, there is less of a chance the opposing counsel will be successful in discrediting your testimony admissible as an expert. But, for a new examiner, the first couple of times before the court will be more demanding as to your expertise.
After both sides have had a chance to question your bone fides as an expert, the counsel wishing you to be accepted will make a motion that you be accepted as an expert. Once that is complete, you will be asked about the matter at hand, and will testify to your collection, preservation, and examination of physical evidence. This is also where the opposing counsel will be especially alert for any weakness or contradictions in your testimony.
For this week’s discussion, complete the following questions below in detail. Please discuss thoroughly and substantively in your post.
1. List at least 5 questions you think you would be asked initially on direct examination being qualified as an expert?
2. List at least 5 questions that you might be asked by opposing counsel regarding your expertise on cross-examination?
3. Describe why it is important AND how you would testify to limit any contradictions?