DFIR Investigations and Witness Testimony

“We need you to testify.” From fear to excitement, nervousness to confidence, the emotions these words evoke can vary. “But I have never testified before.” If this is one of your reactions, then this course is for you.

Prerequisites

Basic understanding of concepts such as evidence handling, chain of custody, trial procedure, and digital forensic investigations.

Target audience

• Digital forensics and incident response professionals who are preparing to testify for the first time.
• Those interested in learning more about to process from collection and analysis to testimony.

Course Goals

By the end of this course, students should be able to:

• Understand and articulate the role of an expert witness
• Know the rules that govern expert witness work and testimony
• Identify the differences between a consulting expert and a testifying expert
• Understand the importance of documentation and strong investigation plans
• Feel comfortable with defending your work on a witness stand

• The Role of an Expert Witness
• "Seeking the Truth"
• Facts vs. Expert Witness
• Forensic Concept Review
• Evidence Identification
• Evidence Preservation
• Evidence Handling and Storage
• Chain of Custody
• Examination Notes and Analysis Documentation
• Investigative Process
• Investigation Planning
• Investigation Bias
• Checklists and Standard Procedure
• Drawing Conclusions
• The Expert Report
• Format of the Expert Report
• Importance of Every Word
• Drawing Conclusions Revisited
• The Importance of Peer Review
• Supplemental Reports
• The Origins of the American Legal System
• US Constitution
• Original vs. Appellate Jurisdiction
• State Courts and Federalism
• The Trial Process
• Judge vs. Jury Trial
• Anatomy of a Trial
• Rules of Evidence and Procedure
• Federal Rule of Evidence 702
• Federal Rule of Civil Procedure 26
• Federal Criminal Rule of Procedure 16
• State and Local Rules
• Work Product Doctrine
• Providing Depositions and Affidavits
• Written vs. Oral Testimony
• Affidavits vs. Declarations
• Expert Testimony
• Voire Dire of Experts
• Consulting vs. Testifying
• Direct Examination
• Cross Examination
• Redirect Examination
• Testimony Do’s and Don’ts
• Expert Testimony Do's and Don'ts
• Course Review and Next Steps
• Course Wrap-Up and Next Steps