The Expert Testimony in Digital Investigations module provides you with the instructions and devices to develop your hands on skills in the following topics.
- Preparing Forensics Evidence for Testimony.
Exercise 1 - Preparing Forensics Evidence for Testimony
In this section, you learn the steps for extracting information to be presented to a court. You also learn how to prepare to testify on digital evidence you have collected. You should be ready to answer specific questions from your attorney as well as opposing counsel.
In the following example, the general counsel at Flashbills has asked you to find a specific e-mail from Randall Simpson’s personal e-mail account that’s stored on his work computer. You’re directed to search for and recover any message containing the word “offshore.” The company’s computing use policy states that the employer reserves the right to inspect and access all data on employees’ computers, including personal data, such as stored e-mail.
The general counsel also tells you that you need to testify on the data you extract to show the chain of custody for your findings. Another examiner has already created a forensic image of Mr. Simpson’s computer, and a paralegal gives you this file, InCh12Randall.001.