Page 1
INSTRUCTINGEXPERTS · A GUIDE FOR UK LAWYERS How Lawyers Should Instruct a Digital Forensic Expert Selection, Instruction, the Forensic Science Regulator's Code and the Report the Court Will Accept COMPUTER FORENSICS LAB DISCOVERY. UK
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES FSR CODE DECLARATIONS SINGLE JOINT EXPERT APPOINTMENTS CPR 35 / CRIMPR 19 REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the instruction shapes the evidence 03 Choosing the expert: competence, accreditation and the right specialism 04 Drafting the instruction: scope, questions, materials and boundaries 05 The Forensic Science Regulator's Code: declarations of compliance and non-compliance 06 The report: CPR 35, CrimPR 19 and what the court expects 07 Managing the engagement: independence, adverse findings and single joint experts 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: INSTRUCTFORTHEQUESTION, NOT THE ANSWER: CHOOSEBY COMPETENCEANDACCREDITATION, SCOPEPRECISELY, PROTECTINDEPENDENCE, AND INCRIMINALWORKMAKESURETHEFSRCODEDECLARATIONISTHEREANDHONEST
§ 02 · FIRST PRINCIPLES The problem in plain English: the instruction shapes the evidence
§ 03 · THERIGHTEXPERT Choosing the expert: competence, accreditation and the right specialism
Page 2
§ 04 · THE LETTER Drafting the instruction: scope, questions, materials and boundaries
§ 05 · THESTATUTORYLAYER The Forensic Science Regulator's Code: declarations of compliance and non-compliance
§ 06 · THE REPORT The report: CPR 35, CrimPR 19 and what the court expects
§ 07 · THERELATIONSHIP Managing the engagement: independence, adverse findings and single joint experts
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives SOURCE OPPONENT / PLATFORM / QUALIT Y- COUNTERPART DELETED/ CLASS THIRD CLOUD SYSTEM DEVICE RECOVERABLE SUPPLIED BY INSTRUCTING PART Y HELD BY EXPERT'S PART Y RECORDS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDECLARATIONTHATWASMISSING EXAMPLE2 · THELETTERTHEJUDGEREADALOUD EXAMPLE3 · THEADVERSEFINDINGHANDLEDCORRECTLY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask the prospective expert Ask the opponent (of their expert evidence) SUGGESTED WORDING · CORE PA R AG RAPHSOFANINSTRUCTIONLETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The instruction checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Does the Forensic Science Regulator's Code apply to a defence-instructed expert? Our preferred expert cannot declare full compliance. Can we still instruct them? Will the court see our letter of instruction? Can we comment on the expert's draft report? Our expert's findings hurt our case. What are our options? Is a single joint expert right for digital evidence?
§ 14 · REFERENCE Glossary CPR 35.10 SFR1 / SFR2 Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, How Lawyers Should Instruct A Digital Forensic Expert, Computer Forensics Lab, https://e-discovery.uk/library/how-lawyers-should-instruct-a-digital-forensic-expert/pdf.