07 Jul DIGITAL FORENSICS
Theres been a turn of events. Dan, who was supposed to stand as an expert witness in a criminal trial, cant make it. This is only your second time standing in as a witness, and you better not mess it up this time!
So, youve been retained as an expert witness for the defense. Your examination of the digital evidence, primarily photos and some Microsoft Word documents, shows that the defendant did not send files containing account information to his home computer. You prove this with the header information in the backup files of the emails on the corporate server and an examination of the clients home computer.
The prosecution is attempting to show that, in your first case that you testified in, you botched an email collection in a civil case. How are you going prove that you are accurate in this case?
Write your response to the attorneys question that provides your qualifications for testimony as a digital forensics investigator and then describe an overview of your process for capturing and examining the header information. Use your own words and not a published list. The language should be easily understood by the people in the courtroom (they are not forensics experts so avoid technical jargon).
