The final step in the digital forensic investigator’s casework is to provide expert testimony in a court of law. In the United States, Federal Rule of Evidence 702 provides that, in order for a witness to be qualified as an expert, the expert must simply be shown to have "knowledge, skill, experience, training, or education" regarding the subject matter involved. Under this standard, trained computer forensics experts have qualified as experts in the US courts.

Moot court involves the presentation of information and conclusions to a panel of judges. Those panels are typically comprised of attorneys, professors, and judges. In this capstone course, the panel of judges will include the instructor and peer students from other cybersecurity M.S. tracks, including Cybersecurity Technology and Cybersecurity Management and Policy. In this scenario, you will be testifying as the digital forensic expert and reporting out on the information gathered from the steps performed throughout this course.

The Compilation Report-Out will provide the foundation for your testimony. Court testimony will involve the presentation of evidence as well as the engagement in meaningful and rigorous justification central to cyber incidents and international law. Expert testimony will focus on the challenges facing the field of digital forensics from new technologies (e.g., cloud storage, mobile devices), and international law specific to eDiscovery. During your testimony, you need to be prepared to answer relevant questions, including:

1. What are the legal challenges associated with cyber incidents involving foreign countries? How do internal laws affect eDiscovery? Reference and discuss all international laws that may influence a forensic investigation in the country that your team is assigned.
2. What are the legal challenges of accessing and retrieving electronic evidence stored on foreign soil? Assuming cloud storage was used, what procedures were followed to access and retrieve digital evidence stored in the cloud?
3. Specific to the country that your team was assigned, how did the international laws and jurisdictions influence the processes and procedures followed during the forensic investigation?
4. What conflicts arose between ethics and international laws during the forensic investigations? How did these conflicts affect the investigations? How were the conflicts mitigated/resolved?
5. What steps were taken to protect United States soil and citizens during the international investigation? Describe any risks to the country, businesses, or citizens from your investigations.

Deliverable

Each student will provide testimony as a digital forensics and cyber investigations expert in a moot court setting. This testimony is to be captured (taped), with examination and cross-examination from peer DFC students and the instructor. Testimony will include a summary of the three prior projects in this course, scenario specifications and information, and synergy of all student deliverables, including reports and lab exercises. Additionally, the expert testimony will succinctly answer the eight relevant questions using information gleaned from course activities and results.

Guidance Software publishes a guide to expert testimony, including examples of cross-examination in the courtroom.

References

Federal Rules of Evidence. (n.d.). Rule 702: Testimony by expert witnesses. http://federalevidence.com/rules-of-evidence