DFIR Investigations and Witness Testimony


This course discusses the role of the expert witness, the process an expert should follow from collection of digital data to reporting, the act of testifying in court, the rules that govern experts and the do’s and don’ts of good testimony.

1 hour 49 minutes
Join over 3 million cybersecurity professionals advancing their career
Sign up with

Already have an account? Sign In »

Course Content
Module 1: The Role of an Expert Witness
Module 8: Providing Depositions and Affidavits
Module 10: Testimony Do’s and Don’ts
Module 11: Course Review and Next Steps
Course Description

“We need you to testify.” From fear to excitement, nervousness to confidence, the emotions these words evoke can vary. “But I have never testified before.” If this is one of your reactions, then this course is for you.


Basic understanding of concepts such as evidence handling, chain of custody, trial procedure, and digital forensic investigations.

Target audience

  • Digital forensics and incident response professionals who are preparing to testify for the first time.
  • Those interested in learning more about to process from collection and analysis to testimony.

Course Goals

By the end of this course, students should be able to:

  • Understand and articulate the role of an expert witness
  • Know the rules that govern expert witness work and testimony
  • Identify the differences between a consulting expert and a testifying expert
  • Understand the importance of documentation and strong investigation plans
  • Feel comfortable with defending your work on a witness stand
Instructed By
Dustin Sachs
Dustin Sachs
Certificate of Completion
Certificate Of Completion

Complete this entire course to earn a DFIR Investigations and Witness Testimony Certificate of Completion