Both computer forensics and e-discovery are areas of expertise where both investigative and analysis techniques are used to determine the existance of potential legal evidence. The evidence might be sought in a wide range of computer crimes or misuse, including but not limited to theft of trade secrets, theft of or destruction of intellectual property, and fraud. Computer specialists can not only state that they have found the potential evidence, as an expert witness, they must understand how the system, software and tools that are utilized function. This must be relayed on both a technical level and also relayed in a manner that all actors can understand. Only then can the information help during depositions, or actual litigation.

Computer specialists are bound by facts. It has to be proven beyond a reasonable doubt that the evidence presented did exist at the times, locations, and format that has been presented. Experts must remain objective, the facts alone offer sufficient material for legal presentation. Discernment of how to answer the questions giving too much or too little information is also pertinent.

The expert has the knowledge to know when to seek alternate formats of the same data for discovery. The discovery process can be served well by a knowledgeable expert identifying more possibilities that can be requested as possibly relevant evidence.

The courts are supposed to use the Daubert Rule to qualify the witness as an expert. Some courts still use the Frye test to qualify expert witnesses. Neither Daubert nor Frye require any kind of certification. Following is the crux of the the Daubert Rule :

If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue
a witness qualified as an expert by knowledge, skill, experience, training, or education
may testify thereto in the form of an opinion or otherwise, if
– (1) the testimony is based upon sufficient facts or data
– (2) the testimony is the product of reliable principles and methods
– (3) the witness has applied the principles and methods reliably to the facts of the case

Simply put, the examiner must be able to demonstrate appropriate knowledge, skill, experience training OR education and that the testimony is based upon sufficient facts or data and the testimony is the product of reliable principles and methods and the principles and methods were applied in this particular case.

Note that there is no mention of certification. A valid certification is used to:
• Test to determine if the examiner’s results can be validated and duplicated.
• Test to determine if the examiner used sound “generally accepted” forensic procedures and methodologies.

Some courts still use the Frye Rule which is far less stringent than the Daubert Rule. In this scenario experts with an A+ certification without computer forensic certification may be deemed an expert. With this in mind doing your own homework on background and experience is as always the best step.