Forensic Reporting

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with

Already have an account? Sign In »

5 hours 56 minutes
Video Transcription
Hey, everyone, welcome back to the course on the last module. We wrapped up our discussion and mobile forensics
in this month, and we're just gonna talk about forensic reporting.
So just a quick pre assessment question. According to the Frye standard testimony is inadmissible unless it has been deduced from a well recognized scientific principle or it has gained general acceptance in his particular field.
Is that gonna be true riffles?
Or so that's true. So Frye standard Just remember that scientific related and not related to expert witness testimony that will help you a lot on the exam.
So forensic reports. So basically, the forensic report is used to communicate results of an investigation. Think of it like a first testimony, right? So even if informal reports, you just want to think of it like Okay, well, how do I structure this That way. If opposing counsel was looking at this thing and they were asking me questions about it,
I want to be able to substantiate anything I'm listing here.
So as I mentioned, we got the informal method. Verbal is generally informal. It could be formless. Well, same with written. That one's generally formal, but it can also be informal, as we'll see as well.
So for reports.
So you'll sometimes hear this called a preliminary report as well, so preliminary and formal pretty much the same thing. They're generally the informal aspect of it is had in an attorney's office. So, for example, let's say you're hired by the prosecution. You kind of create just a general, you know, report information
to then verbally tell the prosecutor saying, Hey, you know,
these are the things we're working on, you know? Here's some tests were running, you know, we should probably, you know, depose or get a deposition on these particular people. You know, we should send subpoenas to these people, et cetera, et cetera. So this that informal aspect of it, you're just kind of summarizing what's going on with the investigation.
And then the formal aspect of a verbal report will be something that you would let go, you know, to the border of directors and, you know, speak in front of them on like a civil or, you know, an administrative type of case, you know, order managers. You know, it's like a disability disciplinary action type of thing. You know as well as, uh,
Sometimes it could be a formal verbal verbal report to the jury.
But generally speaking, that would be also a formal written report to the jury as well. So you might be summarizing, like your written report to the jury in a formal aspect. So not so much seen. Mostly you're going to see ah, least on the exam in my sea tested former formal verbal report on that would generally be something like a board
more manager.
Then we have a written report again. This one is generally formal. S O. You know, that's gonna be your actual thing that you declare under oath, right? So you swear that, Yes, this report is mine. You know, this information is correcting it, et cetera, et cetera, because then you're gonna be cross examined on that.
There is also the as I mentioned, the informal aspect of it, you know where you know you can list out everything that's going on with the investigation to date. However, understand that any written report it all can be ah made to be discovered. So, for example, the opposing counsel can request
you're informal report
and a lot of times they will if you have that, and then they'll use that against you on under oath. When you're actually testifying in your actual written report, your formal one, they'll try to compare him and find differences and then question you and discredit you on that aspect.
And also, if you do in formal written report, if you go ahead and destroy that it's actually considered destruction of evidence or spoil elation is to kind of the legal term for that
reports structure. So you know this is this is fairly straightforward. You know you'll have your Astra abstract, your table of contents, the body of the report conclusion, any references, any glossary terms, you know, terminology that people might need to know different acknowledgements, you know, like thank you for your help. So and so and then any appendices
of you, no additional information or graphs, that sort of stuff.
So expert witnesses. So the expert witness is gonna be testifying, you know, opinion based right? So based they based their opinion off of, you know, their educational background, their knowledge, their skills and experience. You know we can we can see all that stuff to some extent off their CV or Kirk curriculum vitae.
But generally speaking, they're just testifying off their opinion of, you know,
here's here's the facts of the information and based on my experience, I think that this occurred.
Then we have our technical with witness. So generally speaking, like your forensic investigator that you know, would just be testifying like, Okay, we found these items on the computer, right? So, you know, we did X, Y and Z. We then found these particular files. We then, you know, copy the files using this format.
And then from there, we, you know, did this and this and this, You know, that's where we come in to play with our chain of custody
that we talked about throughout the course. So
the main thing here to differentiate them between expert witness this they're not offering any type of conclusion or opinion on the evidence there strictly just saying, like, I found this or that. And we did it through this method,
the double standard
eso This is regarding the admissibility of expert witness testimony. Eso number one. The testimony has to be relevant and reliable to the case. The actual case with this is Dilbert versus Merrell Dow pharmaceuticals. So basically, there has to be sufficient facts and data,
you know, that the expert witnesses is pulling from
they they have to use reliable principles of methods, you know, for that data. And then from there, they have to apply those principles of methods to actually formulate their actual opinion. Right. So there's some standards in place to make sure that is the testimony is gonna be relevant.
Then we have our Frye standard. You know, again, this one surround scientific aspect. So, you know, for this to be admissible has to be related to a well recognized scientific principle or discovery. Or, you know, it has to have gained acceptance in the field. Right? So it could be like a new
ah thing going on in the field. A new ah new finding, new creation,
a new experiment, et cetera. But it has to have general acceptance in the field.
Direct versus cross examination. Pretty straightforward here. So, for example, if I'm hired by the prosecutor to testify, that and they call me to the stand, then that's direct, right? So they heart essentially hired me on, and I'm being called to the stand and then cross examination would be, You know, I'm working with the prosecutor,
and then the defense attorney calls me to the stand and they cross examine me,
you know, so that basically the opposing side, right, they cross examine me, asked me a bunch of questions,
deposition the things you want to remember for the examine this that both attorneys air present. Um,
and according to easy counsel, the jury and judge, they're not normally present. Now, there are situations were judge, maybe president in a deposition in real life. But for the purposes of the exam, Just remember that jury and judge, they're not normally present. But do remember that both attorneys are present
and then, you know, in a deposition, the opposing counsel is just asking questions, that kind of see, like what your testimony at trial would be. So just keep that in mind.
So just a quick post assessment question here, the Frye standard relates to the admissibility of expert with witness testimony. Is that true or false?
All right. So we know that once false right, the Frye standard is related to scientific evidence.
The question number to a judge and jury are always present at a deposition. Is that true? Riffles?
All right, so that was false as well. You know, as I mentioned sometimes in real life, a judge's president at a deposition. But according to the City Council, the judge and jury are not present at a deposition.
All right, so in this video, we just talked about our forensic reporting in the next video. We're just gonna have a quick wrap up of the course.
Up Next
Computer Hacking and Forensics

Love the idea of digital forensics investigation? That is what computer forensics is all about. You will learn how to; determine potential online criminal activity at its inception, legally gather evidence, search and investigate wireless attacks.

Instructed By