As discussed in Chapter 9, having a certification is an optional part of an expert’s qualifications. However, a digital forensics certification can give you some assurance about the examiner. The reason is that most certifications require that the examiner have some amount of verifiable experience prior to allowing her to take the examination.

At the time of this writing, information for some certifications that require the candidate to pass a criminal background check are: the Certified Computer Examiner (CCE) (http://www.isfce.com), the Digital Forensics Certified Practitioner (DFCP) (www.dfcb.org), and the Certified Forensic Computer Examiner (CFCE) (http://www.iacis.com). As you can imagine, it would be very embarrassing to put an expert on the stand only to find out that he or she has a criminal record. There is no reason not to ask the examiner if he or she has passed a criminal background check as part of your selection process.

While having a certification is a plus, it is certainly not enough to overcome the deficiencies of an expert who may have other issues that can negatively impact your case.

How does the expert interact with you and your team? Does she seem arrogant or superior? Does she take the time to properly explain technical concepts in easy-to-understand language?

An expert who comes across as arrogant or impatient with nontechnical people will probably not present very well on the witness stand, especially if his attitude is, “I’m the expert, take my word for it.” Experts who have a tendency to talk down to laypersons will continue that behavior in court at the risk of alienating the jury or coming across as less than completely honest.

When the expert is asked a question for which he does not have the answer, does he try to convince you that he does anyway? This is a great risk if the expert must testify. When asked a question about the forensics in a case, the expert must be able to stick to the facts and offer only opinions that are fact based and relevant. If the expert starts trying to confound you with his vast knowledge rather than simply saying, “I don’t know the answer to that question,” you may be in trouble. This can be a sign that he is using jargon to overcome a real lack of in-depth expertise in the subject matter. Chances are that you will be looking for an expert who knows a great deal more than you. The problem is when someone does know more about a subject than you do, how can you judge how much they really know compared to another subject matter expert? Being able to clearly answer technical questions in a manner that is understandable to a layperson is one of the most important skills of an expert. If you are getting the impression that the expert will fall back on jargon rather than clear explanations, you are detecting one of the trouble signs that could become a real problem as the case develops and potentially goes to court, where the expert will need to be able to explain complex technical issues to people who may not use a computer at all.

Does the expert have a professional appearance? While our society has a tolerance for many different styles, when dealing with subject matter experts, that tolerance diminishes rapidly. The expert you engage should present herself in a manner that is acceptable in your local culture and that will convey an image of professionalism and competence. The old saying, “Never judge a book by its cover” does not apply. Everyone has an initial reaction to the appearance of an expert, and that reaction can color their impression of that expert’s testimony. If the impression is negative, that expert will have to overcome the initial reaction caused by her appearance and demeanor.

Does the expert have the time to handle your case properly? If you are having trouble getting the expert to actually examine the evidence in a timely fashion to comply with your court schedule, you will be left with the problem of not having been able to properly prepare for trial or to advise your client as to the forensic evidence in his or her case.

In a federal case in the Midwest, the defense expert was put on the stand even though he had never reviewed the evidence in the case. In the trial transcripts of his testimony, his excuse was that he didn’t have time to review the evidence due to his schedule. This was in spite of the fact that he had been retained for several months prior to trial and the evidence was available for examination at his convenience. This particular expert made grand claims on his website about how he is the best expert available. His trial testimony was arrogant, combative, and he made all kinds of statements that had no factual basis. Needless to say, he didn’t help the case, yet he still got paid a lot of money for his “expert” services.

Some experts will take cases that they really shouldn’t take if they cannot handle the content of the evidence. This is especially true for experts who will take a case involving child pornography, yet they cannot view the images due to a personal aversion to the evidence. (One of the roles of a defense expert in these cases is to verify that the images charged are in fact child pornography as described by law enforcement. It is critically important that the examiner you hire to handle one of these cases have experience.) The only way to do that is to view the images. This is of real importance in cases where the prosecution is not required to provide a list of the specific images being charged. In this instance, the only recourse for the defense expert is to review all of the images and attempt to ascertain what images the prosecution might be using to bring the charges against the defendant. Being unwilling to review the actual contraband images in a case should be a reason for the expert to withdraw from the case or refuse to take the case at all.