Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Expert Witness and Report Writing - II November 26, 2008

Outline l Report Writing for High tech investigations l Expert Testimony in High tech investigation l Reference: Chapter 14, 15 of Textbook

Report Writing l Understanding the Importance of Reports - Limiting report to specifics - Types of reports l Guidelines for writing reports - What to include in preliminary reports - Report structure - Writing reports clearly - Designing layout and presentation of reports - References l Generating report with forensics tools

Understanding the importance of reports l Reports are the means to communicate effectively the findings of the expert witness l Therefore reports have to be specific and to the point l Reports could be verbal reports or most often written reports

Guidelines for writing reports l Preliminary reports may include tentative conclusions – this could be interim reports l Final reports must have structure - Abstract, Table of contents, Body of report, Conclusions, Reference, Glossary, Acknowledgements, Appendix, l Actual References may have to attached to the report. l Writing style has to be precise - Need to communicate well, Grammar and vocabulary are crucial, Punctuation and spelling have to be correct - Need to justify all conclusions.

Using Forensics Tools l Many tools like ENCASE have report writing capabilities l Advantages of using these tools is that can include screen shots directly from the tools l Chapter 14 describes the use of both ProDiscover and FTK for writing reports

Expert Testimony l Preparing for Testimony l Testifying in Court l Preparing for a deposition or hearing l Preparing forensic evidence

Preparing for Testimony l Be very thorough with your report l Document the evidence and prepare it in a format that can be understood l Be prepared to explain every sentence in your report and evidence l Have a current resume l Know all the definitions l Need to deal with the news media

Testifying in Court l Be prepared for intense cross examination l Think before you say anything and be prepared to justify all your statements l Learn about testifying during direct examination (questions from your attorney) and testifying during cross examination (opposition’s attorney) l Review the details in Lecture #29 l More details in Chapter 15

Preparing for a Deposition or Hearing l Deposition is not testifying in court l There are no judge and jury l Both attorneys are present and ask questions l Hearing is similar to a deposition and can be carried out in an administrative agency or legislative body or court

Using Forensics Tools for Testimony l Tools like ENCASE can be used to gather information needed for testimony l Similar to generating reports l Chapter 15 describes how Prodiscover and FTK can be used to prepare testimony