Five on Forensics Page 1 - Craig Ball

More documents

Recommendations

Info

<strong>Five</strong> on Forensics © 2002-2008 Craig Ball All Rights Reserved heart bypass in an afternoon—it’s just plumbing—but the necessary expertise and attendant high cost spring from the decades it took to learn what to do when things go wrong. A CF expert should clearly communicate hourly rates and anticipated expenses, but there are typically too many variables to quote a bottom line cost. If you can supply reliable information about the systems, electronic media and issues, experience may permit the expert to project a range of expected cost. Recognize that competent examiners routinely decline requests for a “two-hour quick peek.” No one wants to be taken to task in court for missing something because they didn’t have time to do the job correctly. What do other clients think? Before you commit to spend thousands, ask for references and spend a few minutes calling attorneys who’ve worked with the expert. Some client identities might be withheld as confidential, and those supplied probably won’t be the disgruntled folks, but you’re sure to glean something useful respecting billing practices, reporting skill, discretion, preparation or professionalism. If nothing else, an expert unable to identify satisfied clients might not be the one for you. Beware of the Tool Tyke Poorly-trained experts rely on software tools without understanding how they work. They’re Tool Tykes. Of course, all of us trust technologies we don't fully understand, but an expert should be able to explain how a tool performs its magic, not offer it up as a black box oracle. Tool Tykes dodge attacks on their lack of fundamental skills by responding, “The tool is not on trial,” or citing how frequently the testimony of other witnesses using the same tool has been accepted as evidence in other courts. The use of proven tools and software is essential, but even a rock-solid tool in unskilled hands is unreliable. Forensic software suites are principally designed to automate repetitive tasks that would otherwise be performed manually. Your expert should understand those underlying operations, not just know the keystroke required to initiate them. Page 80
<strong>Five</strong> on Forensics © 2002-2008 Craig Ball All Rights Reserved “Your “Witness” by Charles Bragg Cross-examination of the Computer Forensics Expert Craig Ball Today, some 95% of all documents are created using computers. Daily electronic mail traffic far outstrips postal mail and telephone usage combined. Computer technology impacts every facet of modern life, and the crimes, torts and disputes which carry us to the courthouse are no exception. The new field of computer forensics entails the identification, preservation, extraction, interpretation and presentation of computer-related evidence. Far more information is retained by a computer than most people realize, and without using the right tools and techniques to preserve, examine and extract data, you run the risk of losing something important, rendering what you find inadmissible, or even causing spoliation of evidence. Though I’ve been immersed in computer forensics as a trial lawyer and as a computer forensics student, examiner, author and instructor for many years, I’d never come across an article that offered practical advice on the cross-examination of a computer forensics expert. The goal of this paper is to improve the caliber and candor of those who testify as computer forensics experts and to help lawyers get to the truth, not confuse or obscure it. Page 81
Page 1 and 2:
Five on Forensics
Page 3 and 4:
Five on Forensics
Page 5 and 6:
Five on Forensics
Page 7 and 8:
Five on Forensics
Page 9 and 10:
Five on Forensics
Page 11 and 12:
Five on Forensics
Page 13 and 14:
Five on Forensics
Page 15 and 16:
Five on Forensics
Page 17 and 18:
Five on Forensics
Page 19 and 20:
Five on Forensics
Page 21 and 22:
Five on Forensics
Page 23 and 24:
Five on Forensics
Page 25 and 26:
Five on Forensics
Page 27 and 28:
Five on Forensics
Page 29 and 30: Five on Forensics
Page 79: Five on Forensics
Page 109: Five on Forensics
show all

Five on Forensics Page 1 - Craig Ball

Create successful ePaper yourself

Delete template?

Save as template?