What is a Computer Forensic Expert in a Criminal Case?

March 31, 2022 Don Pumphrey, Jr. Criminal Defense Social Share

An expert witness, whether testifying for the defense or prosecution, plays a key role in a criminal case by assisting the judge or jury in reaching a decision. There are countless kinds of expert witnesses, but as technology has evolved and grown exponentially, computer forensic experts have become critical in cases involving electronic devices.

Technological developments have led to new forms of evidence that can be used to either incriminate or exonerate you in the courtroom.  If you face criminal charges for a crime involving a digital device, it is imperative to understand how digital forensics works, as well as how a computer forensic expert witness can assist in your defense. This blog will discuss the science of computer forensics generally and highlight the role a computer forensic expert witness plays in the courtroom. We wrote a previous blog on the impact of Forensic Interview Experts, which can be read here. 

Computer Forensics – What is it?

Computer forensics is also referred to as cyber forensics or digital forensics. Computer forensics is the professional investigation of data from digital devices that can be used as evidence in a criminal case. It is the science behind acquiring, preserving, retrieving, analyzing, and presenting digital evidence in a court case. The application of computer forensics in an investigation is a way to present suitable evidence in a court of law.

Cybercrime is often fought by authorities through computer forensics, who are in charge of tracking, locating, and extracting digital information that is necessary in a criminal investigation. Hard drives of computers are typically searched by computer forensic specialists. The goal is to try and uncover any hidden or deleted files using encrypting decoding software or file recovery programs.

Aside from computers, information for a criminal investigation can be found through network servers, smartphones, tablets, databases, and other digital devices. Considering we now live in a much more technologically advanced age, computer forensic expert witnesses can be extremely important in a criminal case. To read about the importance of other experts in a criminal case, such as an accident reconstruction expert, visit our blog here. Further, to read about the role a use of force expert plays in a criminal case, visit our blog here. 

According to the Bureau of Labor Statistics, computer forensics is expected to grow by 17% over the next ten years, due to the larger number of cases involving computer related crimes. Both local and state governments typically hire computer forensic experts to help with the increased demand.

Types of Digital Evidence

The following is a list of potential digital evidence:

• Computers
• Hard Drives
• Cell Phones
• Surveillance
• Email
• Social Media
• Cloud Storage
• Servers
• Websites
• Gaming Consoles

Computer Forensic Expert Witness Qualifications

There are certain qualifications required to be a computer forensic expert witness in a criminal case. For one, the expert must have a strong background in the subject with high credentials. Many experts in this field have a bachelor’s degree in computer science, information technology, or study issues related to security. Computer forensic expert witnesses often have certain professional certifications, such as Computer Hacking Forensic Investigator (CHFI) certification, Certified Computer Forensics Examiner (CCFE) certification, or certification from the Digital Forensic Certification Board (DFCB).

Once retained, a computer forensic expert will use their knowledge of forensic methodologies, tools, and procedures to review, recover, or analyze the digital media on computers, mobile devices, thumb drives, social media data, or cloud data in order to build the best defense for the defendant. They will also work alongside the attorney to assess how digital evidence has been collected or handled by the prosecution. Further, the expert may prepare reports on computer forensics evidence and provide expert witness testimony in cases, often cybercrime cases that often involve sexual offenses.

The role of the expert witness once they are in the courtroom is to prove to that the evidence they offered through their testimony is both truthful and sound. When offering their testimony, the expert must remain:

• Knowledgeable – The expert witness must be knowledgeable about the Federal Rules of Evidence and show they have a strong understanding of their field as well as the evidence collected in the case.
• Organized – The expert witness should be able to easily refer to the evidence they found through computer forensics. Reports should always be up to date and include results on previous or new evidence.
• Alert – The expert witness should be able to maintain composure and answer any questions on stand promptly.
• Ethical – The expert witness must display objectivity and have an understanding of the standards of conduct in the courtroom.

Specific Key Features of a Computer Forensic Expert Witness

To be an expert witness in the computer forensic field, one must know the ins and outs of computer devices. Evidence is pieced together by the use of the tools, equipment, or inner workings of a computer device. Aside from a traditional computer, computer forensics can extend to handheld devices—such as cell phones, iPads, or even networks connecting several computers together. By obtaining knowledge about these types of devices, the expert can help raise a claim that there was a computer issue that played a part in the alleged criminal conduct.

The following is a list of tasks the computer forensic expert can complete to help find a defense in a case:

• Piecing together broken computer programs
• Using a computer device to track down or connect user profiles
• Using software programs to help restore lost data
• Using discs to hack into other computer programs

Computer Forensic Procedure

The following is an explanation of how the computer forensic procedure works in a criminal case:

• Digital data with evidentiary value will be seized in accordance with extremely strict guidelines for collecting and storing digital data
• The acquisition of digital data in order to make a secure copy to prevent tampering. Also assigning a cryptographic hash to prevent the alteration of data.
• The expert will complete an analysis of the data
• The expert will produce a report based on the examined or uncovered evidence, which may be offered in court along with their testimony.

Things to be Aware of with Computer Evidence

A lot of time with crimes involving computers or the internet, people believe simply deleting the evidence is sufficient. However, with the use of a computer forensic expert, deleted information can be entirely recovered, as the hard drive with still contain deleted evidence almost indefinitely, unless overwritten or intentionally erased.

For example, a person may believe deleting an incriminating email is enough to stay out of trouble. However, it could still be in the “slack space” on the hard drive even if it is deleted from the email’s trash. Many people become confused when the evidence in their case is all digital, which is where a computer forensic expert can be of assistance.

In addition, it is important to know that the police must obtain a search warrant in order to search your electronic devices for digital evidence. Just as if they are requesting to search your car or your home, the authorities must secure a search warrant to look at the data retrieved in an obtained hard drive. There should be extensive scrutiny of digital evidence, as it is the type of evidence that is more susceptible to manipulation. Again, this is where the use of a computer forensic expert can be extremely helpful to work alongside an experienced defense attorney.

Finding a Defense Attorney in Tallahassee, Florida 

As technology continues to develop, the legal world must continue to adapt to the ever-changing advancements. It is absolutely necessary to have a clear understanding of digital evidence and how a computer forensic expert can assist in your criminal case. Don Pumphrey and his legal team at Pumphrey Law strive to stay on top of technological evolution and how it can impact evidence. If you or a loved one have been accused of a crime involving computer evidence, it is important to seek out the help of an experienced Florida criminal defense attorney. Pumphrey Law Firm will find and retain a knowledgeable computer forensic expert to ensure that all applicable defenses in your case are explored. Call (850) 681-7777 or leave an online message today for a free consultation.

  Social Share