Our series on testifying as a digital forensic expert witness has looked at the role of the computer forensic expert, their qualifications, and preparing a CV. Now we take a closer look at the Daubert rules for qualification.

Federal and State Approach: Qualifying Under Daubert
Supreme CourtAs mentioned previously, before you can be offered as an expert you must establish your qualifications. Each state handles the issue in its own way and you should work with the attorney who hires you to make sure you know what you need to know to properly establish your credentials through testimony. In federal court the approach is consistent throughout the system. You must be able to meet the reliability standards defined in the Federal Rules of Evidence as interpreted by the Supreme Court in Daubert v. Merrell Dow Pharm., Inc., 509 U.S. 579 (1993); General Electric Co. v. Joiner, 522U.S. 136 (1997) and Kumho Tire v. Carmichael, 526 U.S. 137 (1999).

The first thing to understand is that the decision whether you will be allowed to testify is up to the judge. He or she serves as the initial gate keeper. If you pass muster with the judge and are allowed to testify, the jury will then be the final arbiter of your testimony making its decision based on the admissible evidence after they determine how much weight to give to your testimony.

In 2000 the Federal Rules of Evidence were amended to incorporate the Daubert analysis. Rule 702 Fed. R. Ev. provides that the expert witness may only testify if:

  1. the testimony is based on sufficient facts or data;
  2. the testimony is the product of reliable principles and methods; and
  3. the witness has applied the principles and theories reliably to the facts of the case.

The judge must assure that your proposed testimony truly proceeds from scientific knowledge. Procedurally there are a number of ways that the issue of you qualifications can be brought before the judge. One common procedure is to have a Daubert hearing where you testify on direct examination giving your attorney the chance to elicit testimony about your qualifications, the collection activities you engaged in, the reliability of your equipment and methodologies, and your overall knowledge of case facts that would be relevant to the opinions you intend to offer. You would then submit yourself to cross examination by opposing counsel, and thereafter the judge would make a ruling. This might be a separate hearing set some time before the trial. It might also take place during trial, with the jury being excused for the duration of the Daubert inquiry. In some cases, particularly where motions are involved, the determination may be made based on affidavits filed by you with the court.

Typically, you would begin with an explanation of your education and training that resulted in your being hired in the first place. Next you would focus on the facts you were given to serve as the basis for your work. You would also identify the specific issues you were asked to address. You would then turn to your collection activities. You would describe any equipment you used, and any steps you took to test the equipment in advance so you knew it was functioning properly at the time of the acquisition. Obviously, there are many different ways to acquire the electronically stored information so you need to be able to address why the method you chose is an acceptable method that produces reliable results. You would need to explain why you used write blocking technology and what its significance is to the acquisition process. An explanation of the verification of the data using hash values will probably occur at this point so you need to be prepared to go into detail on the type of hash you used, why the results are reliable, and what you did to make certain the hash values you obtained established a valid collection of the source data.

Next you would address the processing of the data and the subsequent analysis. You would describe the equipment and software you used for processing and analysis. You would discuss the methodology you followed in performing your analysis. You would discuss any alternative techniques you used to cross check the results obtained by using your primary tool. You would explain why these techniques generate data that can be replicated by other competent computer forensic examiners, and why as a consequence your opinions as derived from the data can be believed.

With this type of testimony, you should be able to convince a judge that you are qualified and should be allowed to testify as an expert in the case. You may or may not be required to discuss your ultimate opinions and conclusions at this point. The point of the hearing is to determine qualifications, not your ultimate testimony. Nevertheless, you should be prepared to offer all of you final opinions by the time you partake in the Daubert hearing.

Your attorney will typically lead you through the process of qualifying, and you will meet in advance of the hearing to map out a strategy to offer the necessary detailed testimony. Once you've made your case on direct, the opposing attorney will have a chance to cross examine you. He or she will look for any holes in what you have done and focus questions on any deficiencies in your approach, so make an effort to anticipate any areas that might be deficient in the work you did and discuss them with your own attorney in advance to determine how best to respond at the hearing. Be prepared to explain why the distinctions the opposing counsel is trying to make are not ultimately relevant to a determination of the reliability of your direct testimony.

You should not argue with opposing counsel, and you should always be truthful. You should limit your testimony to the questions asked, and not volunteer information. You should not be an overzealous advocate—just tell the truth as you see it. Understand that you will be given one more chance to answer questions posed by your attorney to clear up any misunderstandings that may arise as a result of cross examination. It is your attorney's job to ask the necessary questions to allow you to clarify. You should not be concerned if you cannot offer all of the testimony you would like during cross examination. Assume any rehabilitation will be done during redirect examination at the discretion of your attorney. You may even feel you haven't explained everything you want to explain, but you must rely on your attorney's discretion in determining how much information her or she thinks is necessary at this point in the process.

Bruce A. Olson is an experienced board certified civil trial attorney and a CCE who has testified at both depositions and in court as a computer forensic expert.