The best way to instruct a digital forensics expert

What is the best way to instruct a digital forensics expert?

If you’re a solicitor dealing with criminal, civil or corporate matters I am sure this is a question that may well run through your mind. After all, the majority of those who instruct us are highly trained and highly educated individuals, but rarely do they have a background in computing. I’ve had barristers comment on how they were worried that they were using technical terms incorrectly and sounding silly.

Many solicitors may worry that the service they want isn’t possible and may not know how to ask if it is. I have even had IT professionals’ comment that they were worried their own expertise would not be sufficient to assist our investigation. Talking to someone about a complex field of knowledge, one in which they are the expert and you are not, can be daunting.

This is something I empathize with and something I face personally all the time. I am an expert in digital forensics, with no formal grounding in The Law, yet almost all of my cases require my involvement in the legal proceeding that follows. I need to speak with legal experts about their field of knowledge and try to use the right terms without sounding silly… it is daunting.

So, to address the question of how best to instruct a digital forensics expert. Some advice based on my own experience:

• Be honest;
• Ask questions;
• Ask the expert’s opinion;
• Be flexible.

Be Honest:

If you don’t understand the topic, tell the expert. It is nothing to be ashamed of and ignorance is just an opportunity to learn. If you don’t understand, we can explain. Explaining complex topics in simple ways is a major part of digital forensics in practice, and one of the reasons you instruct a digital forensics expert in the first place. If you think we have explained something badly, say so and let us try a different approach; you don’t sit there quietly nodding, only to later Google to try and understand. We are here to help; please just ask.

Ask Questions:

• What better way is there to get to the answers than to ask questions? If you want to know more about a certain type of data, don’t hesitate to speak up.
• Do you want a quicker return on the results? ask us if it is possible.
• Do you want a phone call to walk through our report of findings? With pleasure.
• If you want to know what is possible for a certain investigation, ask away.
• The more questions you ask, the more we can help.

Ask the Expert’s Opinion:

This is quite a big one for me, I should probably put it further up the list. Please, ask my opinion!

You may have an idea of the best way to conducting a forensic investigation, having previously received good results from a particular workflow. Every investigation is different, so please still ask for my opinion and we can discuss what is best, and why I believe that is the case. There may be different areas of investigation that you haven’t considered, or it may be that the method you expected to use is not suitable this time around. Ask for my advice and I will happily give it.

Be Flexible:

Another big one here. We have undertaken many investigations and our experience affords us a good idea of how best to approach them. You may think you understand the topic, given that you are acutely knowledgeable in its context, but please come to the table with an open mind. If I suggest a different approach, give that new approach due consideration. Be willing to consider alternative examination methodologies, different devices to include within the scope of your investigation, different time scales for a turnaround, different approaches. The world of computing is fast-moving, and digital forensics has to keep up; what worked for you previously may no longer be suitable.

To summarize this blog, I suggest that in order to instruct a digital forensics expert on a topic outside your usual remit, you simply have an open conversation with us first. At CYFOR, prior to every one of our corporate forensic investigations, you will have a free consultation call between a member of our commercial team and a member of our technical team. These scoping calls can range from a quick five-minute chat to complex, technical discussions lasting much longer! We aim to make sure that everyone involved has considered all available options prior to instruction and that everyone involved understands what needs to be done. The best way to do that? Have a little chat.