Part 1 of this series looked at the role of the computer forensic expert as a testifying witness in court. Now we take a closer look at the qualifications of an expert witness.

CV and Qualifications
The most important document you will prepare as a digital forensic expert witness is your CV or resume.Apart from the expert report, probably the most important document you are likely to create as an expert witness is your Curriculum Vitae (CV) or resume. This is the first document an attorney considering hiring you will look at, and it is the first document an attorney planning to cross examine you will look at in preparation for your examination. It will invariably be included as an exhibit to your professional report. It will be attached as an exhibit to any affidavit you may submit to the court. It will undoubtedly be the first thing you are examined on at deposition or trial. Understand, therefore, that whatever you state in the CV must be the truth. Any exaggeration or falsehood will eventually be uncovered and you will be forced to acknowledge any false statements under oath, possibly in front of a Judge and jury. Perjury charges are possible if you are not honest. The damage to your credibility by any false information in your CV, even if the expert work you've done is one hundred per cent accurate, will be incalculable.

Competent opposing counsel will always scrutinize your CV before examining you. They will check to make certain that each educational degree or professional certification you list on your CV was actually granted, at the time indicated, by the institution listed. They may make inquiry of third party sources to determine whether the presentations you list as having been given were in fact given by you; and, if available, they will attempt to obtain any written materials or PowerPoint documents you may have used in your presentation. They will probably attempt to acquire copies of every article you list as having published, and if given half a chance they will attempt to use what you've said in a prior publication against you, typically taken out of context, in the case in which you are now involved. Thus, you should make an effort to keep copies of everything you publish from the published source and be prepared to review them prior to any courtroom testimony to be properly prepared.

A good CV should include an initial general narrative description of your qualifications to make clear from the outset that you should be considered an expert in your field. If the document is offered as an exhibit, you want the juror who reads it (just like the attorneys) to be immediately impressed with your qualifications. Details can follow below. Career highlights, practical experience, specialized education or certifications, honors and membership in learned groups and societies, and reference to significant publications you've written and presentations you've given should all be included in the introductory narrative in order to set the proper initial tone.

Your CV should include a description of any relevant education. If a degree was obtained, indicate the source and type of degree. If a certification was obtained, indicate the source and type of certification. Be certain to include all relevant computer forensic, computer security, or other computer certifications with a description of the sponsoring organization. If it was a general course, but no degree or certification was available, like a CCE Bootcamp or a SANS training session, indicate in a general sense the nature of the coursework you completed, who the sponsor was, and the duration of the training.


Work experience should also be listed in detail. Anticipate that opposing counsel will check each identified employer to confirm employment, so don't fail to list any employer you had after you graduated from high school. Your entire employment history and not just your history in the computer forensics area is of interest, so be complete. Be prepared to explain any adverse employment situation should it exist. Don't leave out such former employers. It is better to list the hostile employer and be prepared to explain whatever problem there was than to attempt to hide the situation by omission. If there is a gap in your employment timeline you'll be forced to address it in the course of cross examination, and attempting to obscure an adverse situation by omission will only make matters worse. Face things head on and be prepared to offer an explanation why things did not work out. Most of us have had at least one job where things didn't work out for whatever reason. It's the hiding of information that is damaging to your credibility.

Publications and presentations should be listed in standard bibliographic format. You should go back in time at least 10 years. (Under the recently amended Rule 26(a)(2)(b) Fed R. Civ. Pro., an expert's report must contain a list of all publications authored in the previous 10 years.) Be prepared to be confronted with what you've written at some point. A common technique is to take a random statement from an article you've written out of context and attempt to use it to get you to agree to something in the current case. Alternatively, they may use it to make it appear you are willing to take both sides of a particular issue and are therefore not credible. Normally you can review the publication and make any necessary clarifications if you anticipate this technique may be used against you. The key is to be cognizant of what you've published, and keep copies so you can refer to it if necessary.

Professional associations you belong to, and professional or academic honors you received, should be included as well. Anything else you've studied or done that would be potentially relevant to your qualifications as an expert should also be included. Remember that formal education is not the only way to obtain expertise. Relevant experience can be obtained in many ways so don't be afraid to include information about any non-traditional learning or training you've received.

It is also useful to maintain a list of all cases in which you have testified either at deposition or trial either as part of your CV or as a standalone document. Under the recently amended Rule 26(a)(2)(b) Fed R. Civ. Pro., an expert's report must contain a list of all cases during the previous 4 years in which the witness testified as an expert at trial or by deposition. Keeping such a list as part of your CV or as a companion document makes the process of providing the required information in your report that much easier.

Be sure to keep your CV up to date, and if it isn't up to date, bring it up to date before you testify at deposition or trial or offer it as an exhibit to any pleading or report. Your CV speaks for you, and you want it to be as descriptive and up to date as possible in describing who you are and why your opinions should matter in a case in which you are involved.

Bruce A. Olson is an experienced board certified civil trial attorney and a CCE who has testified at both depositions and in court as a computer forensic expert.