DFIR Investigations and Witness Testimony

Name: DFIR Investigations and Witness Testimony
Rating: 5 (1 reviews)

Cybrary

Course

This course discusses the role of the expert witness, the process an expert should follow from collection of digital data to reporting, the act of testifying in court, the rules that govern experts and the do’s and don’ts of good testimony.

Time

1 hour 49 minutes

Difficulty

Intermediate

CEU/CPE

5.0

NEED TO TRAIN YOUR TEAM? LEARN MORE

Join over 3 million cybersecurity professionals advancing their career

View all SSO options

Already have an account? Sign In »

Course Content

Module 1: The Role of an Expert Witness

"Seeking the Truth"

Facts vs. Expert Witness

Module 2: Forensic Concept Review

2.1Evidence Identification

2.2Evidence Preservation

2.3Evidence Handling and Storage

2.4Chain of Custody

2.5Examination Notes and Analysis Documentation

Module 3: Investigative Process

3.1Investigation Planning

3.2Investigation Bias

3.3Checklists and Standard Procedure

3.4Drawing Conclusions

Module 4: The Expert Report

4.1Format of the Expert Report

4.2Importance of Every Word

4.3Drawing Conclusions Revisited

4.4The Importance of Peer Review

4.5Supplemental Reports

Module 5: The Origins of the American Legal System

5.1US Constitution

5.2Original vs. Appellate Jurisdiction

5.3State Courts and Federalism

Module 6: The Trial Process

6.1Judge vs. Jury Trial

6.2Anatomy of a Trial

Module 7: Rules of Evidence and Procedure

7.1Federal Rule of Evidence 702

7.2Federal Rule of Civil Procedure 26

7.3Federal Criminal Rule of Procedure 16

1 minute

7.4State and Local Rules

7.5Work Product Doctrine

Module 8: Providing Depositions and Affidavits

8.1Written vs. Oral Testimony

8.2Affidavits vs. Declarations

Module 9: Expert Testimony

9.1Voire Dire of Experts

9.2Consulting vs. Testifying

9.3Direct Examination

9.4Cross Examination

9.5Redirect Examination

Module 10: Testimony Do’s and Don’ts

10.1Expert Testimony Do's and Don'ts

Module 11: Course Review and Next Steps

11.1Course Wrap-Up and Next Steps

Course Description

“We need you to testify.” From fear to excitement, nervousness to confidence, the emotions these words evoke can vary. “But I have never testified before.” If this is one of your reactions, then this course is for you.

Prerequisites

Basic understanding of concepts such as evidence handling, chain of custody, trial procedure, and digital forensic investigations.

Target audience

Digital forensics and incident response professionals who are preparing to testify for the first time.
Those interested in learning more about to process from collection and analysis to testimony.