SWGDE

Menu
Subscribe
Subscribe

published documents

Introduction to Testimony in Digital and Multimedia Forensics

22-Q-001-1.1

View Pdf

Disclaimer and Conditions Regarding Use of SWGDE Documents

SWGDE documents are developed by a consensus process that involves the best efforts of relevant subject matter experts, organizations, and input from other stakeholders to publish suggested best practices, practical guidance, technical positions, and educational information in the discipline of digital and multimedia forensics and related fields. No warranty or other representation as to SWGDE work product is made or intended.

As a condition to the use of this document (and the information contained herein) in any judicial, administrative, legislative, or other adjudicatory proceeding in the United States or elsewhere, the SWGDE requests notification by e-mail before or contemporaneous to the introduction of this document, or any portion thereof, as a marked exhibit offered for or moved into evidence in such proceeding. The notification should include: 1) The formal name of the proceeding, including docket number or similar identifier; 2) the name and location of the body conducting the hearing or proceeding; and 3) the name, mailing address (if available) and contact information of the party offering or moving the document into evidence. Subsequent to the use of this document in the proceeding please notify SWGDE as to the outcome of the matter.

Notifications should be sent to secretary@swgde.org.

From time to time, SWGDE documents may be revised, updated, or sunsetted. Readers are advised to verify on the SWGDE website (https://www.swgde.org) they are utilizing the current version of this document. Prior versions of SWGDE documents are archived and available on the SWGDE website.

Redistribution Policy

SWGDE grants permission for redistribution and use of all publicly posted documents created by SWGDE, provided that the following conditions are met:

  1. Redistribution of documents or parts of documents must retain this SWGDE cover page containing the Disclaimer and Conditions of Use.
  2. Neither the name of SWGDE nor the names of contributors may be used to endorse or promote products derived from its documents.
  3. Any reference or quote from a SWGDE document must include the version number (or creation date) of the document and also indicate if the document is in a draft

Requests for Modification

SWGDE encourages stakeholder participation in the preparation of documents. Suggestions for modifications are welcome and must be forwarded to the Secretary in writing at secretary@swgde.org. The following information is required as a part of any suggested modification:

  1. Submitter’s name
  2. Affiliation (agency/organization)
  3. Address
  4. Telephone number and email address
  5. SWGDE Document title and version number
  6. Change from (note document section number)
  7. Change to (provide suggested text where appropriate; comments not including suggested text will not be considered)
  8. Basis for suggested modification

Intellectual Property

Unauthorized use of the SWGDE logo or documents without written permission from SWGDE is a violation of our intellectual property rights.

Individuals may not misstate and/or over represent duties and responsibilities of SWGDE work. This includes claiming oneself as a contributing member without actively participating in SWGDE meetings; claiming oneself as an officer of SWGDE without serving as such; claiming sole authorship of a document; use the SWGDE logo on any material and/or curriculum vitae.

Any mention of specific products within SWGDE documents is for informational purposes only; it does not imply a recommendation or endorsement by SWGDE.

Table of Contents

1. Purpose

The purpose of this document is to provide guidance and best practices for digital and multimedia examiners and legal professionals in preparing, providing, and reviewing testimony in legal proceedings (e.g., administrative bodies, courts, tribunals) whether testifying for the plaintiff or the defense.

2. Scope

This document addresses both fact witnesses and expert witness testimony for digital and multimedia forensic examiners and considers testimony in the US legal system. This document is intended to be part of a series addressing testimony. Future documents may address topics such as:

  • Legal considerations and challenges
  • Overview of key legislation and rulings

3. Limitations

This document is not intended to be legal advice. Legal issues change rapidly and are subject to interpretation. Therefore, always consult with your appropriate legal counsel regarding all legal matters before acting.

This document is not intended to be a training manual, nor to replace organizational policy or standard operating procedures. This document is not all inclusive and does not contain information regarding specific commercial products. This document may not be applicable in all circumstances. If examiners encounter situations warranting deviation from best practices, they should thoroughly document the specifics of the situation and actions taken.

4. Definitions of Lay Witness (Fact Witness) and Expert Witness Testimony

  • Digital and Multimedia Examiners provide valuable evidence in legal proceedings in the form of testimony. This testimony primarily falls into two main categories–expert and fact–as defined by the Federal Rules of Evidence 701 and 702 (2021 version) and corollary state counterparts. In general, if an examiner is not testifying as an expert, then they are limited to being a lay witness (fact witness). The terms lay and fact witness are synonymous. A lay witness (fact witness) cannot provide opinions. An expert witness is one who has been qualified by the court for a specific case as an expert. Whether expert testimony is needed is generally made by legal counsel who ultimately will seek qualification of the witness as an expert or tender the witness as an expert. The qualification is based on knowledge, skill, experience, training, and education. As stated in 702, an expert may testify in the form of an opinion or otherwise if:
    • the expert’s scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue;
    • the testimony is based on sufficient facts or data;
    • the testimony is the product of reliable principles and methods; and
    • the expert has reliably applied the principles and methods to the facts of the case.

5. Expectations of Witnesses

5.1 General Expectations

The primary responsibilities for all witnesses involve courtroom etiquette, preparation, and awareness of their testimony. The following are expectations for all witnesses:

  • Tell the Truth.
  • Make the court and counsel aware of potential scheduling conflicts early and whenever a prospective conflict arises.
  • Prepare both with and without legal counsel.
  • Professional conduct is essential.
  • A witness shall punctually appear at court hearings. Arrive on time.
    • Check traffic and parking
    • Know where the courtroom is located or have adequate time upon arrival to locate the courtroom
  • A witness shall appear in court properly attired. Dress appropriately. If uncertain of attire, ask the attorney.
  • Be patient and prepared to wait.
  • Do not discuss testimony with other witnesses , jury members or other persons while waiting to testify.
  • Listen to the question in its entirety and answer only the question asked.
  • Do not hesitate to ask the counsel to repeat the question or clarify if multiple questions are being asked.
  • Do not be afraid to pause to answer a question thoughtfully and accurately, and to allow counsel to object if needed.
  • If the answer to a question is unknown or not remembered, say so. It is important to limit testimony to the scope of knowledge.
  • Answer the questions avoiding technical language as much as possible. Be able to explain technical terms and concepts to the average person.
  • Be mindful of vocal tone and speed.
  • Do not become argumentative on the stand.
  • Barring a question that skews facts, misinterprets analysis, ask to further explain or allow counsel to intervene. If a question is encountered that skews facts, correct the error, but do so as respectfully as possible.
  • When answering questions during direct or cross examination, make eye contact with the trier of fact.
  • Know the process
    • Provide curriculum vitae (CV), report, any notes, etc., to attorney(s) ahead of time
    • Courthouse security requirements and restrictions
    • Bring a proper form of identification
    • Have a means of communicating with the legal team in the event of delays, etc.

5.2 Expectations of Fact Witnesses

There are two primary ways that forensic examiners testify: fact witness and expert witness. The court determines which type of witness is appropriate.

Forensic examiners testify in the capacity of a fact witness when their involvement is limited to using forensic software and providing output in the form of a report. Per Federal Rule of Evidence 701 (2021), a fact witness’s testimony is based on their rational perception and assists in a matter before a court or tribunal. A fact witness is the preferred term used when a digital forensics examiner testifies in a capacity that is not an expert witness. This is also called a lay witness, but the term fact witness is used to highlight the skills and work done by the examiner. The primary responsibility for fact witnesses is to be aware of the limited scope required of their testimony. Fact witnesses should not offer opinions or make judgements. The following are expectations for fact witnesses:

  • Know the forensic techniques, policies and procedures, and science underpinning the work which will be the subject of your testimony.
  • Testimony should be limited to tangible data points and not rely on experience or draw conclusions.
  • For fact witnesses, avoid the use of phrases such as “I think…” or “In my experience…” This implies that you may be giving an opinion.

5.3 Expectations of Expert Witnesses

The expert witness serves to educate and, at times, render an opinion, to assist the trier of fact in understanding matters outside the education and experience of the average person. As the expert witness is given wider latitude in their testimony, they are subject to a wider set of queries during both direct and cross-examination. A witness is qualified as an expert based on their knowledge, skill, experience, training, or education. The scope of testimony for an expert is not limited to their work. Experts can be cross examined on the entire discipline and can provide conclusions based on their knowledge and experience. Experts, however, should exercise appropriate restraint in their testimony by limiting their opinions to their training and experience.

Be aware that experts are paid for their time, not their opinion, nor should the amount of compensation affect a forensic examination or the results of the analysis. As an expert, this is a potential line of questioning regarding compensation and bias which will be covered at a later point in this document. Be aware that as an expert witness you are held to a higher standard and be cognisant of your digital footprint (e.g., social media, professional online presence, posts, adverse action, criminal activity) as this is potential fodder for opposing counsel.

5.4 General Considerations for Trial Preparation

  • Be aware of the use of technical jargon. Explain technical concepts using common language a lay person can understand.
  • Do not use the phrase “reasonable degree of scientific certainty” or similar phrases. They do not have an established meaning and may be subject to admissibility rules.
  • Do not use the phrase “to the exclusion of all others” or similar. These phrases imply a level of certainty that is generally unmeetable.
  • Do not allow testimony to exceed the facts established through examination. (i.e. ascribing “intent,” evidence found in user profile vs. “this person did this,” etc.)
  • Be prepared to explain the general functions performed by the tool rather than the programming of the tool. In other words, the examiner should be able to say what the tool does rather than how it works.
  • Be clear on who was responsible for the work. If testimony pertains to tasks performed by other individuals (e.g., sequential assembly-line forensic process, retired or ill analyst, etc.), explain how the information was received, how an assessment of the work performed, and how the reliability of the work was determined.
  • Be prepared to describe training and experience associated with the tool(s)/method(s) used in analysis
  • Be prepared to describe succinctly and in lay terms how the examination and analysis were performed.

5.4.1 Expert Witness Trial Preparation

It is highly recommended that attorneys conduct a thorough pretrial discussion which should include witness qualification, tools/methods used and any limitations, findings/reports, and trial strategy. Be aware, not all attorneys consult with expert witnesses prior to trial. The areas below should be inclusive in the pretrial discussion:

  • Qualifying questions
    • provide/discuss CV
    • particularly relevant training/certifications
      • related to this case
      • are they current
    • professional organizations
    • challenges to expert training, certifications and qualifications
    • publications or research – peer reviewed?
    • previous experience in court as an expert
    • character issues
  • Quality
  • Findings
    • Has counsel reviewed results/written report(s) including any supplemental materials to support findings and opinions?
    • Scope of opinion is defined
    • Opinions or conclusions included in exam results
    • Opinions or conclusion supported by data in report
    • Correlating opinions and limitations, results, or conclusions
      • g., if opinion leads to A and B, it may not lead to C
    • What results are they wanting to discuss in direct?
    • Are the findings repeatable?
    • Are the findings reproducible?
  • Trial Approach
    • Are there any pretrial rulings that could impact testimony?
    • What is being accomplished by the testimony?
      • What key points should be shown?
      • What information needs to be emphasized?
    • Are there complex issues that may behoove a prepared response/explanation (e.g., timestamps)?
      • Acknowledge the limitations of the evidence
    • Potential challenges:
      • report
      • methods
      • tools
      • chain of custody
      • data and interpretations of data
      • alternate interpretations and opinions
      • authentication to original evidence
      • previous issues within the examiner’s organization
      • previous testimony
      • the laboratory’s quality system, if applicable
      • verification of findings and opinions
      • peer review
      • potential bias
    • There may be other sources, digital or other, that corroborate data referred to in the examiner’s testimony. Be aware that testimony may be corroborated or questioned based on other witnesses’ testimony. It may be helpful to work with the trial attorney so the scope of expected testimony is understood and how it may be connected to or associated with testimony from other witnesses.
  • Trial Exhibits/Demonstratives and Presentation
    • Has the examiner presented this before in court? How was it previously presented? What worked well and what did not work well?
    • Is the format of your exhibits in the appropriate format to be displayed in the jury deliberation room? (like mp4, jpeg, etc)?

5.5 Post-Proceeding Testimony

Being a witness, lay or expert, in the area of digital and multimedia forensics, is an ongoing learning process. Following testimony, a witness should not hesitate to meet with counsel and learn of any issues with their testimony to refine the delivery of facts and results derived from training and experience.

Appendix: General Guidelines for Witness Testimony Handout

PRE-TESTIMONY POINTERS:

  • Have I reviewed my report and underlying data and engaged in an honest assessment of the situation, admitting any potential issues that may result from my testimony, and maintaining my integrity as a person providing testimony in a court or tribunal?
  • Am I prepared to give an honest and fair assessment of what I observed, even if I don’t agree with it personally?
  • Have I reviewed any paperwork and transcripts of prior judicial proceedings? Are they correct? If they aren’t correct, the matter could be due to a recording error by a court reporter. It may not be the case that: “If it says it in there, it must be right.”
  • Have I engaged in a prep session with counsel?
    • Do I know the layout of the courtroom or place where I will testify?
    • Do I know the physical set-up of the courtroom? Do I know where the judge, jury and audience will be seated?
    • Do I know the sequence of questioning and the form (Direct v. Cross) the questioning will take?
    • Do I understand objections, what “sustained” and “overruled” mean and to wait for a judge’s ruling on an objection before answering?
    • Do I have a basic understanding about hearsay so I know what I can and cannot testify about?
    • Do I understand any pre-trial rulings that might affect my testimony?
    • Have I informed counsel of any potential date and time obligations that may conflict with my testimony?
    • Have I reviewed all maps, photographs and diagrams for use in trial?
  • Do I know where the courtroom is located?
  • Have I left enough time to leave my house/office to get to the courtroom or place where I will provide testimony in time?
  • Where is parking? How much is parking? Can I pay by credit/debit card? How long is my parking good for?
  • Did I provide my CV/resume, report, notes, and all underlying data to the attorney?
  • Do I have contact information for the Court and/or Attorney if I am delayed or have an unforeseen circumstance?
  • Am I dressed professionally? Do I have my credentials? Do I have a copy of my report and CV with me?
  • What are the security requirements for entry into the courthouse or place where I will provide testimony?
  • Am I sitting in an area that is separated from jury members and other witnesses who may be called?
  • Do I know not to discuss testimony with another potential witness, or in the hallways or elevator such that a juror may overhear my comments during a recess? A mistrial caused by a juror overhearing a witness outside of Court is a distinct possibility.
  • Do I have something to occupy my time if I have to wait to be called as a witness?

THE TESTIMONY:

  • Always be honest. Tell the truth. If you do not remember something, you can ask to review any document that may refresh your memory. If you are estimating, you should make that clear to the jury.
  • Always act calm and Do not be baited into being argumentative. Be professional.
  • Am I speaking in a loud, clear voice, making eye contact with the jury when testifying?
  • Am I being factual in my testimony, avoiding any personal opinion or feelings that may affect my observations and/or opinion?
  • Am I listening carefully to the questions asked? Does the question incorporate disputed facts or facts not in evidence?
  • Do I understand the question? If not, ask for If you don’t know the answer, you should say so.
  • Am I avoiding technical language? Am I able to explain technical terms and concepts to the average person?
  • Am I answering the question asked and only the question asked?
  • During cross-examination, am I looking at the attorney who is asking questions or the jury? Remember, you must be honest and fair. The “correct” response is the honest response. Nothing more. Nothing less.
  • Am I prepared to admit my faults or any limitations to my testimony?
  • Do I know where to go if the Court adjourns my testimony for a break, lunch, or for the day?

History

Revision Issue Date History
1.0 DRAFT
1/13/2022
Initial draft created and voted by SWGDE for release as a Draft for Public Comment.
1.0 DRAFT
6/9/2022
Draft revised and re-released for Public Comment.
1.1 FINAL
9/22/2022
No comments received. Moved forward for vote with no changes as Final Approved Document.

Version: 2.1 (March 7, 2024)

View Pdf