© Computer Forensics Expert Witness
Planning
When taking an irregular or new route, the development of a plan enables the computer forensics expert to travel at the shortest distance, while gaining information, related to the matter. This requires the ability to interface with attotneys, clients law enforcement and the courts, in order to help prepare pleadings and make arrangements for pre-trial hearings. As yur expert, I will be sitting with your attorney to plan out a game plan, for your matter.
Acquisition
Part of our arsenal is a very well equipped set of both hardware and software tools. These include tools from Access Data, Tableau Weibetech, Logicube and otheres, to acquire the data. In some cases, law enforcement will perform the imaging of the source data, for defense review. All materials have licenses and except in very few cases, new hardware and software purchases, are a rarity, but does happen, such as hard drives.
Examination
The purpose of the computer forensics examination process is to extract and analyze digital evidence. (NIJ) We utilize forensics software which examine various parts of the computer's hard drive for exculpatory data. We utilize various software tools that are recognized by the courts as to accuracy and content. As your expert, we take it deeper, to find the root causes, any oversights or other anomalies, within the evidence they have collected.
Analysis
The interpretation of the recovered data and putting it in a logical and useful format. (NIJ) - Consultation occurs with client and counsel, for the preparation of deposition, pretrial hearings and trial preparation materials. This phase is where all of the examination work is reviewed, timelines are contructed, and other relationship diagrams and artwork is integrated, which will be incorporated, as exhibits. These documents are not only based upon the examination phase, but research and experience will also be incorporated into the exhibits used in the “Documentation and Reporting Phase.”
Documentation & Reporting
The Documentation and Reporting Phase integrates the computer forensics reports, relevant data and computer forensics trial exhibits, as needed, based upon the output from the computer forensics examination and analysis phases. These include timelines, artwork, narratives and so forth.
Time Drivers
There are a number of time drivers, that push the hours dedicated to the matter. These include, but are not limited to: • Multiple hard drives. • Amount of data to be processed. • Time to obtain protective and court orders. • Pre-trial hearings. • Unavoidable delays. Again, everybody does their best to accomodate, the best way we can.
