courses
Free

DFIR Investigations and Witness Testimony

Is it time for you to testify? This course is for digital forensics and incident response professionals who are preparing to testify. Learn more about what makes an expert witness, as well as what is involved in the process from collection and analysis to testimony. Gain confidence with defending your work before you take the witness stand!
4
Share
Start CourseSubscribe for UpdatesNeed to train your team? Learn more
Create Free AccountNeed to train your team? Learn more
1
H 
50
M
Time
intermediate
difficulty
2
ceu/cpe

Course Content

The Role of an Expert Witness
Forensic Concept Review
Investigative Process
The Expert Report
The Origins of the American Legal System
The Trial Process
Rules of Evidence and Procedure
Providing Depositions and Affidavits
Expert Testimony
Testimony Do’s and Don’ts
Course Review and Next Steps
Investigation Bias

7m

Investigative Process
Investigation Planning

5m

Investigative Process
Examination Notes and Analysis Documentation

5m

Forensic Concept Review
Chain of Custody

2m

Forensic Concept Review
Evidence Handling and Storage

5m

Forensic Concept Review
Evidence Preservation

3m

Forensic Concept Review
Evidence Identification

4m

Forensic Concept Review
Facts vs. Expert Witness

3m

The Role of an Expert Witness
"Seeking the Truth"

7m

The Role of an Expert Witness
Course Wrap-Up and Next Steps

5m

Course Review and Next Steps
Course Description

“We need you to testify.” From fear to excitement, nervousness to confidence, the emotions these words evoke can vary. “But I have never testified before.” If this is one of your reactions, then this course is for you.

Prerequisites

Basic understanding of concepts such as evidence handling, chain of custody, trial procedure, and digital forensic investigations.

Target audience

  • Digital forensics and incident response professionals who are preparing to testify for the first time.
  • Those interested in learning more about to process from collection and analysis to testimony.

    • Course Goals

    By the end of this course, students should be able to:

  • Understand and articulate the role of an expert witness
  • Know the rules that govern expert witness work and testimony
  • Identify the differences between a consulting expert and a testifying expert
  • Understand the importance of documentation and strong investigation plans
    • * Feel comfortable with defending your work on a witness stand

    This course is part of a Career Path:
    Become an Incident Handler
    In this Career Path, you will learn the incident response process, from building an incident response kit and developing an incident response team, to identifying, containing, and recovering from incidents. We then steer away from a traditional “defensive-only” approach to introduce you to the attacker’s world.

    Instructed by

    Instructor
    Dustin Sachs

    As a recognized expert in the field of cybersecurity, Dustin has run proactive risk assessments, incident response forensics, and worked in security operation centers (CSOCs) to strengthen the security posture for his client and employers and is a trusted partner in the immediate aftermath of cyber events.

    Dustin has submitted written and oral testimony in local, state, and Federal courts. He is a frequent thought leader and speaker on a wide variety of cybersecurity matters.

    Provider
    Cybrary Logo
    Certification Body
    Certificate of Completion

    Complete this entire course to earn a DFIR Investigations and Witness Testimony Certificate of Completion