1. COS/PSA 413 Day 25

2. Agenda Capstone progress report due Assignment 4 only partially corrected –Wide disparity –Expected 3-4 pages Some only gave me a page or a paragraph Assignment 5 posted –Due December 16 Lab 13 –Due December 14 Today we will be discussing becoming an Expert Witness

3. Game Plan for last 3 weeks Dec 9 –Becoming an expert witness Con’t –Capstone project report due Dec 13 –Final Comprehensive Lab 14 –Meet in OMS Dec 14 –Lab 14 continued –Lab 13 due Dec 16 –Assignment 5 Due –Exam 4 Dec 22 (Thursday) –1-3 PM –Capstones due –Capstone presentations

4. Testifying during Cross-Examination The following are other questions opposing attorneys often ask: What is your standing in the profession of computer forensics? What are the tools used and what are their known problems or weak features? Are the tools you used reliable? Are they consistent? Do they produce the same results?

5. Testifying during Cross-Examination The following are other questions opposing attorneys often ask: Continued... Are the tools safe to use on the original evidence? Have you been called upon as a consultant on how to use the tools from other professionals? Do you keep up with the latest technologies applied to computer forensics journals-papers read or published?

6. Testifying during Cross-Examination In many instances, the opposing counsel give you rapid-fire questions meant to throw you off. For example, they may ask the following questions: Does the vendor certify your tools? Are there other tools available that do the same thing? How do these tools compare to each other?

7. Testifying during Cross-Examination At all costs, you want to avoid losing control, which you can do in any of the following ways: Being argumentative when being badgered by the opposing attorney; being nervous about testifying. Having an unresponsive attorney not objecting to the opposing attorney’s questions. Having poor listening skills and negative body language. Being too talkative when answering questions.

8. Testifying during Cross-Examination Continued... Being too technical for the jury. Acting surprised and unprepared when presented with unknown or new information. Making a mistake and not correcting it immediately and getting back on track.

9. Testifying During Cross-examination Recommendations and practices: –Never guess when you do not have an answer –Use your own words –Be prepared for challenging pre-constructed questions Did you use more than one tool? –Some questions can cause conflicting answers –Rapid-fire questions –Keep eye contact with the jury

10. Testifying During Cross-examination (continued) Recommendations and practices (continued): –Nested questions –Attorneys make speeches and phrase them as questions –Attorneys might put words in your mouth –Be patient –Keep a vigorous demeanor and use energetic speech –Avoid feeling stressed and losing control

11. Preparing for a Deposition There is no jury or judge Opposing attorney previews your testimony at trial Discovery deposition –Part of the discovery process for a trial Testimony preservation deposition –Requested by your client –Preserve your testimony in case of schedule conflicts or health problems

12. Preparing for a Deposition Guidelines for Testifying at a Deposition Be professional and polite. Use facts when describing your opinion. Understand that being deposed in a discovery deposition is an unnatural process; it is intended to get you to make mistakes.

13. Guidelines for Testifying at a Deposition Some recommendations: –Stay calm, relaxed, and confident –Use name of attorneys when answering –Keep eye contact with attorneys –Try to keep your hands on top of the table –Be professional and polite –Use facts when describing your opinion –Ask opposing attorney questions

14. Recognizing Deposition Problems Discuss any problem before the deposition –Identify any negative aspect Be prepared to defend yourself Avoid: –Omitting information –Having the attorney box you into a corner –Contradictions Be professional and polite when giving opinions about opposite experts

15. Preparing for a Deposition You should avoid talking to the news media for the following reasons: Your comments could harm the case. It creates a record for future testimony that can be used against you. Your lack of media training could easily expose you to embarrassing situations. You have no control over the context of the information the journalist will publish.

16. Public Release: Dealing with Reporters Avoid contact with press –Especially during a case Refer press to your attorney Consult with your attorney on how to deal with a journalist Plan to record any interview –Important if you are misquoted or quoted out of context

17. Public Release: Dealing with Reporters Continued.... You cannot rely on a journalist’s promises of confidentiality. Their interests do not coincide with yours or your clients. Be on guard at all times, your comments may be interpreted in a manner that taints your impartiality in a case and future cases. Questions from journalists can become too big of a distraction from your work on the case. Even after the case is resolved, avoid discussing the details with the press.

18. Chapter Summary -When cases go to trial you as a forensics expert play one of two roles; you are either called as a technical witness or as an expert witness. As a technical or scientific witness, you are only providing the facts as you have found them in your investigation. However, as an expert, you have opinions about what you observe. In fact, it is your opinion that makes you an expert.

19. Chapter Summary -If you are called as a technical witness in a computer forensics case, you need to thoroughly prepare for your testimony. Establish communication early on with your attorney. When preparing to testify for any litigation, substantiate your findings with your own documentation and by collaborating with other computer forensics professionals.

20. Chapter Summary -As you process evidence, be sure to always monitor, preserve, and validate your work. Doing so helps to ensure that it can be presented in court. Then submit to your attorney all evidence you collected and analyzed. When writing your report, only list evidence findings that are relevant to the case.

21. Chapter Summary -When you are called to testify in court, your attorney demonstrates to the court that you are competent as an expert or technical witness. Your attorney then leads you through the evidence followed by the opposing counsel cross-examining you. After your attorney has established your credentials and you have presented your evidence, the opposing attorney has an opportunity to ask questions about your testimony and evidence, a process called cross- examination.

22. Chapter Summary -Know whether you are being called as a scientific technical witness or expert witness (or both), whether you are being retained as a consulting expert or as an expert witness. Also be familiar with the contents of your curriculum vita (VC). -A deposition differs from a trial because there is no jury or judge. Both attorneys are present and the opposing counsel asks you questions. There are two types of deposition: discovery and testimony preservation.