People

Scientific evidence (expert testimony) is dealt with in the Federal Rules of Evidence (FRE) [3] rules 701-706, the Frye and Daubert cases [4][5], and elsewhere.

Scientific evidence: The US Federal Rules of Evidence (FRE) [3] and the rulings in the Daubert case [4] express the most commonly applied standards with respect to issues of expert witnesses (FRE Rules 701-706).

A witness qualified as an expert by knowledge, skill, experience, training, or education, may testify in the form of an opinion or otherwise, if (1) the testimony is based on sufficient facts or data, (2) the testimony is the product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case. If facts are reasonably relied upon by experts in forming opinions or inferences, the facts need not be admissible for the opinion or inference to be admitted; however, the expert may in any event be required to disclose the underlying facts or data on cross-examination. More and more relevant knowledge, skill, experience, training, and education are typically helpful both in establishing expertise and in actually applying it.

Experts typically have very specialized knowledge about specific things of import to the matter at hand. and anyone put up as an expert that doesn't have the requisite specialized knowledge is subject to being seriously challenged by competent experts and counsel on the other side. Experts who are shown to be inadequate to the task are sometimes chastised in the formal decisions made by the courts, and such witnesses are often unable to work in the field for a period of many years thereafter because counsel for the opposition will bring this out at trial.

Knowledge: A witness may be qualified as an expert by knowledge. Even without any specific education in a field, many people may have gained knowledge from other sources or their own efforts. Such knowledge is considered adequate for expert testimony if the knowledge allows the individual to introduce meaningful testimony based on scientific principles properly applied to the evidence and the matter at hand.

Skills: A witness may be qualified as an expert by skill. Many individuals have special skills, such as skills at processing evidence through particular mechanisms. A good example is the systems administrator who has extensive skills in the use of systems administration tools. These skills may be applied and testimony given as an expert if the witness can show that they properly applied scientific principles to the evidence in this case.

Experience: A witness may be qualified as an expert by experience. Many police officers who retire end up working in related areas and are qualified as experts in particular areas because of their experience in those areas.

Training: A witness may be qualified as an expert by training. There are many training courses offered in digital forensics, and these courses may reasonably qualify a witness to testify about the things they are trained to do, assuming that they are also given training on the scientific principles behind their operation and how to properly apply those principles to matters at hand.

Education: A witness may be qualified as an expert by education. Education typically provides scientific knowledge in relevant fields that can then be meaningfully applied to legal matters in context. Of course the field of education should be reasonably close to the field of expertise if education is being relied upon as a basis for qualification.


Non-Scientific: According to FRE (701-706), non-expert testimony can only be admitted if it is not based on scientific, technical, or other specialized knowledge within the scope of expert testimony. For this sort of testimony, an expert is required.

Clarifying: Non-expert testimony is only admitted if it is helpful to a clear understanding of the witness' testimony or the determination of a fact in issue. Digital forensic evidence is normally introduced by expert witnesses except in cases where non-experts can bring clarity to non-scientific issues by stating what they observed or did. For example, a non-expert who works at a company may introduce the data they extracted from a company database and discuss how the database works and how it is normally used from a non-technical standpoint.

Observation: Non-expert testimony is only admitted if it is rationally based on the perception of the witness. For example, a non-expert can testify about what they did to make backup copies, how they stored those backups, and who else had a key to the storage area, to the extent that they know the answers to these questions from their direct observation. To the extent that the witness is the custodian of the system or its content, they can testify to matters related to that custodial role as well.


Honesty: Witnesses must be honest or they are subject to legal sanction up to an including imprisonment.

Integrity: The integrity of witnesses is fundamental to the judicial process. If a witness doesn't demonstrate integrity they will not be permitted to testify in future trials and will be constantly challenged when others try to use them. Previous writings, public statements, legal proceedings, and other records of past performance are all subject to challenge in legal settings, as long as they are relevant to the issues in the case, which in the case of an expert witness, includes their credibility as an independent expert in the subject at hand. The Internet and other digital fora and media produce a great deal of history that may come into play in legal settings, and the expert in DFE is most likely to have a lot of such information about them readily available on the Internet because that's where much of the work in their field is done. A search for information about a well known person who has done a career worth of work using the Internet can easily yield hundreds or thousands of pages of material, and not all of it will be factually accurate, but it is all available to be used in challenges to the credibility of the witness.

Competence: The person testifying must be competent in the field about which they are testifying. If they are not, and if they are challenged on their competence successfully, they will be drummed out of the legal process.

Professional societies like the IEEE have codes of ethics that are worthy of particular attention to those engaged in working on DFE. In particular, the IEEE code of ethics insists that member agree "... 6. to maintain and improve our technical competence and to undertake technological tasks for others only if qualified by training or experience, or after full disclosure of pertinent limitations".

In the digital computing arena, as in many other arenas today, there is a history of successful individuals exaggerating their backgrounds or qualifications in order to make progress in their careers. But in working on legal issues, this is problematic for all concerned. It is incumbent on anyone working in this field to recognize what they do and do not know and to limit their work and testimony to areas in which they are professionally competent to do the work they are doing.

In addition, to the extent that the potential expert is not comfortable with their knowledge of the particular issues in a case, they have a duty to their clients as well as the courts to identify their limitations to counsel. To the extent that the expert can gain additional competence, knowledge, and experience in a specific subfield through diligent effort in a very short time frame, this is certainly something worth doing, but the expert who is not adequately knowledgeable is risking the well being of their client on their ability to learn quickly, and to do so without notice is certainly unethical.