Beginning the preparation phase
As a digital forensic investigator, your role in a judicial/administrative proceeding can be defined in two ways:
- Witness (also referred to as a lay or fact witness): You will testify about events you observed. You are just presenting facts that you have personal knowledge of, such as where the evidence was found.
- Expert witness: You can testify to everything a lay/fact witness can, but now you may offer your opinion. You form your opinions based on your training and experience as a digital forensic investigator. It is your ability to provide an opinion that makes you an expert witness.
Your preparation starts with your participation in the investigation. You should treat every investigation as if it will go to trial and you will have to testify. No matter which side you are on in the judicial/administrative proceeding, start communicating with the attorney at the very beginning. Discuss what they need for a successful outcome...
