More On

Making it easy or hard: Computer forensics expert testimony

When dealing with technical testimony, seemingly minor details in how the question is asked can alter the answer you receive

Every time I am preparing for testimony at deposition or trial, I ask the attorney I am working for whether I should make it “easy” or “hard.” Even very experienced attorneys examining a technical witness often ask the wrong question. In a recent exchange during cross-examination at trial, the issue was whether the opposition’s client had altered a hard drive, rendering it inaccessible by a prior computer forensics expert. The opposition attorney first asked about a particular type of disk encryption. In the follow-up question, the attorney changed the hypothetical and did not specify the supposed encryption mechanism. When he confronted me claiming I had changed my answer, I simply explained that no, he had changed the question. When dealing with technical testimony, seemingly minor details in how the question is asked can alter the answer you receive.

If you ask questions regarding a particular folder in a non-Windows environment and describe it with “backslash” instead just “slash,” you may get an unexpected answer. In a transcript of the deposition of a system administrator I saw, an attorney did not initially pick up on the confusion of the technical witness. In other operating systems, like Linux, the folder paths use the keyboard character that leans to the right instead of the backslash, which leans to the left. The witness, as a technologist, could not answer the question as it was asked. Being an inexperienced witness, he did not explain properly the source of his problem. When I am providing expert testimony and encounter such an issue, I fall back on the instructions I got from the attorney defending my deposition: I could simply explain that the examining attorney probably meant forward slash in the folder path and proceed to answer the question with that assumption. But if it is a more adversarial situation, I may simply say I cannot answer the question as asked.

Contributing Author

author image

Peter Garza

Peter Garza is the managing director of Forensic West, Legal Services at DTI. Garza has worked as a consulting, testifying or neutral expert on hundreds...

Bio and more articles

Join the Conversation

Advertisement. Closing in 15 seconds.