How Lawyers Should Instruct A Digital Forensic Expert

INSTRUCTINGEXPERTS · AGUIDEFORUKLAWYERS How Lawyers Should Instruct a Digital Forensic Expert Selection, Instruction, the Forensic Science Regulator's Code and the Report the Court Will Accept COMPUTERFORENSICSLAB DISCOVERY . U K § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES FSR CODE DECLARATIONS SINGLE JOINT EXPERT APPOINTMENTS CPR 35 / CRIMPR 19 REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the instruction shapes the evidence 03 Choosing the expert: competence, accreditation and the right specialism 04 Drafting the instruction: scope, questions, materials and boundaries 05 The Forensic Science Regulator's Code: declarations of compliance and non-compliance 06 The report: CPR 35, CrimPR 19 and what the court expects 07 Managing the engagement: independence, adverse findings and single joint experts 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : INSTRUCTFORTHEQUESTION , NOTTHEANSWER : CHOOSEBY COMPETENCEANDACCREDITATION , SCOPEPRECISELY , PROTECTINDEPENDENCE , AND INCRIMINALWORKMAKESURETHEFSRCODEDECLARATIONISTHEREANDHONEST § 0 2 · FIRSTPRINCIPLES The problem in plain English: the instruction shapes the evidence § 0 3 · THERIGHTEXPERT Choosing the expert: competence, accreditation and the right specialism § 0 4 · THELETTER Drafting the instruction: scope, questions, materials and boundaries § 0 5 · THESTATUTORYLAYER The Forensic Science Regulator's Code: declarations of compliance and non-compliance § 0 6 · THEREPORT The report: CPR 35, CrimPR 19 and what the court expects § 0 7 · THERELATIONSHIP Managing the engagement: independence, adverse findings and single joint experts § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives SOURCE OPPONENT / PLATFORM / QUALIT Y- COUNTERPART DELETED/ CLASS THIRD CLOUD SYSTEM DEVICE RECOVERABLE SUPPLIED BY INSTRUCTING PART Y HELD BY EXPERT'S PART Y RECORDS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEDECLARATIONTHATWASMISSING EXAMPLE2 · THELETTERTHEJUDGEREADALOUD EXAMPLE3 · THEADVERSEFINDINGHANDLEDCORRECTLY § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask the prospective expert Ask the opponent (of their expert evidence) SUGGESTEDWORDING · CORE PA R AG RAPHSOFANINSTRUCTIONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The instruction checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Does the Forensic Science Regulator's Code apply to a defence-instructed expert? Our preferred expert cannot declare full compliance. Can we still instruct them? Will the court see our letter of instruction? Can we comment on the expert's draft report? Our expert's findings hurt our case. What are our options? Is a single joint expert right for digital evidence? § 1 4 · REFERENCE Glossary CPR 35.10 SFR1 / SFR2 Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY