Page 1
INSTRUCTINGEXPERTS · A GUIDE FOR UK LAWYERS
How Lawyers Should Instruct a Digital
Forensic Expert
Selection, Instruction, the Forensic Science Regulator's Code and the Report the
Court Will Accept
COMPUTER FORENSICS LAB
DISCOVERY. UK
§ ABOUT THE AUTHOR
PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES FSR CODE DECLARATIONS
SINGLE JOINT EXPERT APPOINTMENTS CPR 35 / CRIMPR 19 REPORTS
FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS
In this guide
01 Executive summary
02 The problem in plain English: the instruction shapes the evidence
03 Choosing the expert: competence, accreditation and the right specialism
04 Drafting the instruction: scope, questions, materials and boundaries
05 The Forensic Science Regulator's Code: declarations of compliance and non-compliance
06 The report: CPR 35, CrimPR 19 and what the court expects
07 Managing the engagement: independence, adverse findings and single joint experts
08 Source architecture: where else the evidence lives
09 Worked examples
10 Common mistakes and technical limitations
11 Questions to ask · Suggested wording
12 Checklist and red flags · When to involve a digital forensic expert
13 Frequently asked questions
14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION
Executive summary
THE HEADLINE POINT: INSTRUCTFORTHEQUESTION, NOT THE ANSWER: CHOOSEBY
COMPETENCEANDACCREDITATION, SCOPEPRECISELY, PROTECTINDEPENDENCE, AND
INCRIMINALWORKMAKESURETHEFSRCODEDECLARATIONISTHEREANDHONEST
§ 02 · FIRST PRINCIPLES
The problem in plain English: the instruction shapes the
evidence
§ 03 · THERIGHTEXPERT
Choosing the expert: competence, accreditation and the right
specialism
Page 2
§ 04 · THE LETTER
Drafting the instruction: scope, questions, materials and
boundaries
§ 05 · THESTATUTORYLAYER
The Forensic Science Regulator's Code: declarations of
compliance and non-compliance
§ 06 · THE REPORT
The report: CPR 35, CrimPR 19 and what the court expects
§ 07 · THERELATIONSHIP
Managing the engagement: independence, adverse findings and
single joint experts
§ 08 · THEWIDERMAP
Source architecture: where else the evidence lives
SOURCE OPPONENT / PLATFORM / QUALIT Y- COUNTERPART DELETED/
CLASS THIRD CLOUD SYSTEM DEVICE RECOVERABLE
SUPPLIED BY
INSTRUCTING
PART Y
HELD BY EXPERT'S
PART Y RECORDS
§ 09 · IN THE WILD
Worked examples
EXAMPLE1 · THEDECLARATIONTHATWASMISSING
EXAMPLE2 · THELETTERTHEJUDGEREADALOUD
EXAMPLE3 · THEADVERSEFINDINGHANDLEDCORRECTLY
Page 3
§ 10 · WHEREITGOESWRONG
Common mistakes and technical limitations
Common mistakes
Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS
Questions to ask · Suggested wording
Ask your client
Ask the prospective expert
Ask the opponent (of their expert evidence)
SUGGESTED WORDING · CORE PA R AG RAPHSOFANINSTRUCTIONLETTER
§ 12 · QUICK CONTROL
Checklist and red flags · When to involve a digital forensic
expert
The instruction checklist
Red flags
When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS
Frequently asked questions
Does the Forensic Science Regulator's Code apply to a defence-instructed expert? Our preferred expert cannot declare full compliance. Can we still instruct them? Will the court see our letter of instruction? Can we comment on the expert's draft report? Our expert's findings hurt our case. What are our options? Is a single joint expert right for digital evidence?
§ 14 · REFERENCE
Glossary
CPR 35.10
SFR1 / SFR2
Sources and authoritative references
DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST
Working with Computer Forensics Lab
Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB
NEWENQUIRIESEMAILE - DISCOVERY