COURSE

DFIR Investigations and Witness Testimony

Course

Is it time for you to testify? This course is for digital forensics and incident response professionals who are preparing to testify. Learn more about what makes an expert witness, as well as what is involved in the process from collection and analysis to testimony. Gain confidence with defending your work before you take the witness stand!
Start Course
Start course for free
Full access included with 
Insider Pro
 and 
Teams

1

H

50

M
Time

intermediate

i
Designed for learners who have no prior work experience in IT or Cybersecurity, but are interested in starting a career in this exciting field.
Designed for learners with prior cybersecurity work experience who are interested in advancing their career or expanding their skillset.
Designed for learners with a solid grasp of foundational IT and cybersecurity concepts who are interested in pursuing an entry-level security role.
Experience Level

2

i

Earn qualifying credits for certification renewal with completion certificates provided for submission.
CEU's

Enrollees

Learners at 96% of Fortune 1000 companies trust Cybrary

About this course

Read More

Skills you'll gain

Course Outline

1
The Role of an Expert Witness
0
H
10
Min
1
Forensic Concept Review
0
H
19
Min
1
Investigative Process
0
H
16
Min
1
The Expert Report
0
H
11
Min
1
The Origins of the American Legal System
0
H
8
Min
1
The Trial Process
0
H
5
Min
1
Rules of Evidence and Procedure
0
H
11
Min
1
Providing Depositions and Affidavits
0
H
4
Min
1
Expert Testimony
0
H
15
Min
1
Testimony Do’s and Don’ts
0
H
6
Min
1
Course Review and Next Steps
0
H
5
Min

Expert Testimony Do's and Don'ts

Free

6m

Written vs. Oral Testimony

Free

2m

Voire Dire of Experts

Free

7m

Judge vs. Jury Trial

Free

2m

Federal Rule of Evidence 702

Free

4m

Format of the Expert Report

Free

4m

Evidence Identification

Free

4m

Investigation Planning

Free

5m

"Seeking the Truth"

Free

7m

Affidavits vs. Declarations

Free

2m

Original vs. Appellate Jurisdiction

Free

1m

Anatomy of a Trial

Free

3m

Federal Rule of Civil Procedure 26

Free

2m

Consulting vs. Testifying

Free

2m

Importance of Every Word

Free

2m

Facts vs. Expert Witness

Free

3m

Evidence Preservation

Free

3m

Investigation Bias

Free

7m

Direct Examination

Free

2m

State Courts and Federalism

Free

3m

Federal Criminal Rule of Procedure 16

Free

1m

Drawing Conclusions Revisited

Free

1m

Evidence Handling and Storage

Free

5m

Checklists and Standard Procedure

Free

2m

Cross Examination

Free

2m

State and Local Rules

Free

2m

The Importance of Peer Review

Free

1m

Drawing Conclusions

Free

2m

Chain of Custody

Free

2m

Work Product Doctrine

Free

2m

Supplemental Reports

Free

2m

Examination Notes and Analysis Documentation

Free

5m

The Role of an Expert Witness
Heading
Module 1: Introduction
1
Hr
5
Min
Forensic Concept Review
Heading
Module 1: Introduction
1
Hr
5
Min
Investigative Process
Heading
Module 1: Introduction
1
Hr
5
Min
The Expert Report
Heading
Module 1: Introduction
1
Hr
5
Min
The Origins of the American Legal System
Heading
Module 1: Introduction
1
Hr
5
Min
The Trial Process
Heading
Module 1: Introduction
1
Hr
5
Min
Rules of Evidence and Procedure
Heading
Module 1: Introduction
1
Hr
5
Min
Providing Depositions and Affidavits
Heading
Module 1: Introduction
1
Hr
5
Min
Expert Testimony
Heading
Module 1: Introduction
1
Hr
5
Min
Testimony Do’s and Don’ts
Heading
Module 1: Introduction
1
Hr
5
Min
Course Review and Next Steps
Heading
Module 1: Introduction
1
Hr
5
Min
Expert Testimony Do's and Don'ts

6m

Testimony Do’s and Don’ts
Written vs. Oral Testimony

2m

Providing Depositions and Affidavits
Voire Dire of Experts

7m

Expert Testimony
Judge vs. Jury Trial

2m

The Trial Process
Federal Rule of Evidence 702

4m

Rules of Evidence and Procedure
Format of the Expert Report

4m

The Expert Report
Evidence Identification

4m

Forensic Concept Review
Investigation Planning

5m

Investigative Process
"Seeking the Truth"

7m

The Role of an Expert Witness
Affidavits vs. Declarations

2m

Providing Depositions and Affidavits
Original vs. Appellate Jurisdiction

1m

The Origins of the American Legal System
Anatomy of a Trial

3m

The Trial Process
Federal Rule of Civil Procedure 26

2m

Rules of Evidence and Procedure
Consulting vs. Testifying

2m

Expert Testimony
Importance of Every Word

2m

The Expert Report
Facts vs. Expert Witness

3m

The Role of an Expert Witness
Evidence Preservation

3m

Forensic Concept Review
Investigation Bias

7m

Investigative Process
Direct Examination

2m

Expert Testimony
State Courts and Federalism

3m

The Origins of the American Legal System
Federal Criminal Rule of Procedure 16

1m

Rules of Evidence and Procedure
Drawing Conclusions Revisited

1m

The Expert Report
Evidence Handling and Storage

5m

Forensic Concept Review
Checklists and Standard Procedure

2m

Investigative Process
Cross Examination

2m

Expert Testimony
Course Description

“We need you to testify.” From fear to excitement, nervousness to confidence, the emotions these words evoke can vary. “But I have never testified before.” If this is one of your reactions, then this course is for you.

Prerequisites

Basic understanding of concepts such as evidence handling, chain of custody, trial procedure, and digital forensic investigations.

Target audience

  • Digital forensics and incident response professionals who are preparing to testify for the first time.
  • Those interested in learning more about to process from collection and analysis to testimony.

    • Course Goals

    By the end of this course, students should be able to:

  • Understand and articulate the role of an expert witness
  • Know the rules that govern expert witness work and testimony
  • Identify the differences between a consulting expert and a testifying expert
  • Understand the importance of documentation and strong investigation plans
    • * Feel comfortable with defending your work on a witness stand

    Train Your Team

    Cybrary’s expert-led cybersecurity courses help your team remediate skill gaps and get up-to-date on certifications. Utilize Cybrary to stay ahead of emerging threats and provide team members with clarity on how to learn, grow, and advance their careers within your organization.

    Cybrary For Business

    Included in a Path

    Included Cert Path

    Instructors

    Dustin Sachs
    Read Full Bio
    Learn

    Learn core concepts and get hands-on with key skills.

    Practice

    Exercise your problem-solving and creative thinking skills with security-centric puzzles

    Prove

    Assess your knowledge and skills to identify areas for improvement and measure your growth

    Get Hands-on Learning

    Put your skills to the test in virtual labs, challenges, and simulated environments.

    Measure Your Progress

    Track your skills development from lesson to lesson using the Cybrary Skills Tracker.

    Connect with the Community

    Connect with peers and mentors through our supportive community of cybersecurity professionals.

    Success from Our Learners

    "Cybrary really helped me get up to speed and acquire a baseline level of technical knowledge. It offers a far more comprehensive approach than just learning from a book. It actually shows you how to apply cybersecurity processes in a hands-on way"

    Don Gates

    Principal Systems Engineer/SAIC

    "Cybrary’s SOC Analyst career path was the difference maker, and was instrumental in me landing my new job. I was able to show the employer that I had the right knowledge and the hands-on skills to execute the role."

    Cory

    Cybersecurity analyst/

    "I was able to earn my CISSP certification within 60 days of signing up for Cybrary Insider Pro and got hired as a Security Analyst conducting security assessments and penetration testing within 120 days. This certainly wouldn’t have been possible without the support of the Cybrary mentor community."

    Mike

    Security Engineer and Pentester/

    "Cybrary really helped me get up to speed and acquire a baseline level of technical knowledge. It offers a far more comprehensive approach than just learning from a book. It actually shows you how to apply cybersecurity processes in a hands-on way"

    Don Gates

    Principal Systems Engineer/SAIC

    "Cybrary’s SOC Analyst career path was the difference maker, and was instrumental in me landing my new job. I was able to show the employer that I had the right knowledge and the hands-on skills to execute the role."

    Cory

    Cybersecurity analyst/

    "I was able to earn my CISSP certification within 60 days of signing up for Cybrary Insider Pro and got hired as a Security Analyst conducting security assessments and penetration testing within 120 days. This certainly wouldn’t have been possible without the support of the Cybrary mentor community."

    Mike

    Security Engineer and Pentester/

    "Becoming a Cybrary Insider Pro was a total game changer. Cybrary was instrumental in helping me break into cybersecurity, despite having no prior IT experience or security-related degree. Their career paths gave me clear direction, the instructors had real-world experience, and the virtual labs let me gain hands-on skills I could confidently put on my resume and speak to in interviews."

    Cassandra

    Information Security Analyst/Cisco Systems

    "I was able to earn both my Security+ and CySA+ in two months. I give all the credit to Cybrary. I’m also proud to announce I recently accepted a job as a Cyber Systems Engineer at BDO... I always try to debunk the idea that you can't get a job without experience or a degree."

    Casey

    Cyber Systems Engineer/BDO

    "Cybrary has helped me improve my hands-on skills and pass my toughest certification exams, enabling me to achieve 13 advanced certifications and successfully launch my own business. I love the practice tests for certification exams, especially, and appreciate the wide-ranging training options that let me find the best fit for my goals"

    Angel

    Founder,/ IntellChromatics.

    courses

    DFIR Investigations and Witness Testimony

    Is it time for you to testify? This course is for digital forensics and incident response professionals who are preparing to testify. Learn more about what makes an expert witness, as well as what is involved in the process from collection and analysis to testimony. Gain confidence with defending your work before you take the witness stand!
    4
    Share
    Start CourseSubscribe for UpdatesNeed to train your team? Learn more
    Start Course for FreeNeed to train your team? Learn more
    1
    H 
    50
    M
    Time
    intermediate
    difficulty
    2
    ceu/cpe

    Course Content

    Course Description

    “We need you to testify.” From fear to excitement, nervousness to confidence, the emotions these words evoke can vary. “But I have never testified before.” If this is one of your reactions, then this course is for you.

    Prerequisites

    Basic understanding of concepts such as evidence handling, chain of custody, trial procedure, and digital forensic investigations.

    Target audience

  • Digital forensics and incident response professionals who are preparing to testify for the first time.
  • Those interested in learning more about to process from collection and analysis to testimony.

    • Course Goals

    By the end of this course, students should be able to:

  • Understand and articulate the role of an expert witness
  • Know the rules that govern expert witness work and testimony
  • Identify the differences between a consulting expert and a testifying expert
  • Understand the importance of documentation and strong investigation plans
    • * Feel comfortable with defending your work on a witness stand

    This course is part of a Career Path:
    Become an Incident Handler
    In this Career Path, you will learn the incident response process, from building an incident response kit and developing an incident response team, to identifying, containing, and recovering from incidents. We then steer away from a traditional “defensive-only” approach to introduce you to the attacker’s world.
    Incident Handler Collection

    This collection focuses on the incident response process – from building an incident response kit and developing an incident response team, to identifying, containing, and recovering from incidents. We cover the traditional “defensive-only” approach, then introduce you to the attacker’s world.

    Instructed by

    Provider
    Cybrary Logo
    Certification Body
    Certificate of Completion

    Complete this entire course to earn a DFIR Investigations and Witness Testimony Certificate of Completion

    Coming mid-July
    Cybrary Reimagined.
    Level up with structured, role-aligned career paths.
    ALL NEW!
    Cybrary Reimagined.
    Celebrate Cybersecurity Awareness Month with our buy 2, get 1 offer!
    Level up with structured, role-aligned career paths.
    Valid until October 31. Elevate your skills today!
    Start Now
    This is the default text value
    career-paths
    career-path

    Heading

    Heading 1

    Heading 2

    Heading 3

    Heading 4

    Heading 5
    Heading 6

    Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.

    Block quote

    Ordered list

    1. Item 1
    2. Item 2
    3. Item 3

    Unordered list

    • Item A
    • Item B
    • Item C

    Text link

    Bold text

    Emphasis

    Superscript

    Subscript

    Start CourseNeed to train your team? Learn More
    Start Path for FreeNeed to train your team? Learn More
    This is some text inside of a div block.
    Share

    Purpose Statement

    Cybrary Career Paths are comprehensive training programs designed to prepare you for the most in-demand roles in the cybersecurity workforce. Each path follows a Learn, Practice, Prove model and includes different activity types aligned to key topics within the path’s security domain. As you progress through the path, your progress will be measured in real time using Experience Points (XP) that serve as a comprehensive capability score for each topic. Upon completing all of the requirements for a path, you will be rewarded with a shareable digital badge via Credly.
    This is some text inside of a div block.
    H 
    This is some text inside of a div block.
    M
    Time
    This is some text inside of a div block.
    difficulty
    This is some text inside of a div block.
    ceu/cpe

    Overview

    Heading 1

    Heading 2

    Heading 3

    Heading 4

    Heading 5
    Heading 6

    Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.

    Block quote

    Ordered list

    1. Item 1
    2. Item 2
    3. Item 3

    Unordered list

    • Item A
    • Item B
    • Item C

    Text link

    Bold text

    Emphasis

    Superscript

    Subscript

    Frequently Asked Questions
    No items found.
    What Will I Learn?
    Foundations
    Focused on the core IT competencies that cybersecurity professionals need to succeed in any career path.
    Defensive Security
    Focused on trying to find the bad guys. Topics such as threat intelligence, threat hunting, network monitoring, incident response. Defensive security is a reactive measure taken once a vulnerability is found through prevention, detection, and response.
    Engineering and Operations
    Focused on building and operating information systems.
    Governance, Risk, and Compliance
    Focused on the core IT competencies that cybersecurity professionals need to succeed in any career path.
    Leadership and Management
    Focused on program design and oversight. Covers project and program management.
    Offensive Security
    Focused on validating security controls by trying to break them (i.e. penetration testing or ethical hacking). Topics such as Kali Linux, metasploit, scanning, and privilege escalation. Offensive security seeks out the problem or vulnerability through ethical hacking and finds a solution to disable the operation.
    Offensive Security
    Focused on the core IT competencies that cybersecurity professionals need to succeed in any career path.
    Path Outline

    Heading 1

    Heading 2

    Heading 3

    Heading 4

    Heading 5
    Heading 6

    Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.

    Block quote

    Ordered list

    1. Item 1
    2. Item 2
    3. Item 3

    Unordered list

    • Item A
    • Item B
    • Item C

    Text link

    Bold text

    Emphasis

    Superscript

    Subscript

    Course Outline

    What Our Learners Are Saying

    Join 3 million+ users, including 96% of Fortune 1000 companies who use our platform to upskill their teams. See what the buzz is about - start learning for free!

    No items found.
    This is some text inside of a div block.
    threat-actor-campaigns
    threat-actor-campaigns