Becoming a Better Digital Forensics Witness Part 2

Attorney Craig Ball is a forensic technology expert witness. On his website, Ball in Your Court, he writes on his experience as an expert witness.

Becoming a Better Digital Forensics Witness
Don’t Be Jekyll and Hyde We communicate as much non-verbally as verbally, and it’s fascinating to watch how a witness’ body language and demeanor transform from direct to cross-examination. On direct, witnesses are forthcoming and helpful–their engagement and desire to please manifested in their words and physiognomy. On cross, they lean back, glowering, arms crossed, shifting in their seats, quarrelsome and evasive.

It’s hard not to appear defensive when you’re on the defensive, but stay attuned to your demeanor and body language, and don’t change demeanor between examiners-at least not without a whole lot of provocation.

Open up your posture, unclench your fists and wipe that peevish look off your face. Endeavor not to alter the pace or tone of your answers. Patience is a virtue, so don’t start jabbering just to fill an awkward silence. Be courteous and helpful. Yes, helpful. Of course, it’s not your role to assist the other side; but, being respectful and working cooperatively to move things along helps your side most. Some lawyers will work hard to get a rise out of you. Don’t be drawn in. When you show anger, you squander credibility.
There may be times when anger or umbrage is unavoidable, but be slow to burn. Ideally, the jury or the judge should be awed by your restraint and rooting for you to push back long before you do.

Stay above the Fray Nailing the bad guy isn’t the point-not for you. You are the digital translator, not the prosecutor. The evidence speaks through you, and justice demands you not omit or embellish. As an expert witness, you are not an advocate for either side. That’s the lawyers’ role. You are an advocate for your own findings and opinions. You can and should vigorously support and defend the skill behind and integrity of your forensic process, your reporting and the expert opinions you’ve drawn. Winning the case is not your objective. The only “win” for you is that the judge and jury listened to you, understood you and believed you.

Remember Who Matters Court proceedings aren’t about the lawyers. The lawyer for your side is already persuaded, and the other side’s lawyer isn’t going to come around. They don’t matter.
Court proceedings aren’t about you. Yes, you’re a technical wizard and you’ve worked very hard to uncover compelling evidence. But you don’t matter-check your ego at the door.
The only people in the courtroom who matter are the judge and jury. So, speak to them, look at them and help them understand. Of course, you’ll pay attention to the questioner while a question is asked; but orient yourself so that the jury can always see and hear you well, and endeavor to make eye contact with the jurors when giving longer answers. Be alert to cues from counsel, like questions that begin, “Please tell the jury….” That’s how lawyers remind you that you’re ignoring the most important people in the courtroom.

Couch your testimony in terms and analogies that judges and jurors understand. Never assume they know what you or the lawyers know about the evidence or that they come to court with any pre-existing technical expertise. Engage the jury with references to common experiences and accessible analogies like, “We’ve all seen the hard drive activity light on our computers flash when we aren’t doing anything. That may be an instance where the computer is shifting information from RAM to its memory swap file on the hard drive, like leaving ourselves a note.”

Don’t Quibble Judges and juries hate witnesses incapable of saying “yes” or “no.” A skilled cross examiner frames questions that sound like they can be answered simply, but are calculated to elicit quibbling from the witness. A skilled witness looks for opportunities to plainly respond “yes” or “no,” or something close:
“Yes, as a rule,”
“No, for the most part.”
“There are exceptions, but that’s true.”
“Not in my experience.”
Unless crucial to the case, let the lawyer chase the exceptions.

Craig Ball Attorney and Forensic Technologist Certified Computer Forensic Examiner