In This Chapter
Understanding pretrial procedures
Knowing what to expect in pretrial hearings and motions
Giving a deposition
Trials can be dreadfully time-consuming and expensive. Hurdles, by way of federal rules (as covered in Chapter 2), are in place to resolve civil and criminal cases in a "just, speedy, and inexpensive way." (We're speculating that writers of these rules didn't foresee the age of digital trails, or else they had a weird sense of humor.) If most cases went to trial, the justice system would suffer the equivalent of a denial-of-service (DoS) attack. A DoS attack occurs when a Web site receives so many requests for service that it grinds to a halt. Preventing a court-system DoS attack comprises the pretrial phase. In this busy period — the period before trial — every legal, technical, and constitutional issue can be scrutinized to try to resolve the case.
Note
You interact frequently with retaining and opposing lawyers during this stage.
Depending on where you stand, a pretrial is a good idea because it offers another chance to bring an end to a case before it reaches trial. Pretrial events help identify and weed out nontrial cases to spare public and private costs. The three pretrial procedures used by either side in criminal or civil cases are
Motions
Pretrial hearings
Depositions
Pretrial procedures are part of the legal system. Whether a party is motivated to cut and run, take a plea, or proceed to trial usually depends on the reliability of the evidence, investigative methods, and witnesses. This chapter explains the key pretrial issues and the ability of e-evidence, computer forensics methods, and reports to withstand pretrial attempts to bar them. You see how loopholes can bring a quick end to a case.
A motion is a formal request to a judge to make a legal ruling. Both parties try to maneuver into a better position by using motions.
In civil cases, after the plaintiff files a complaint, the defendant has two options:
File an answer.
File a motion, which is a response to the complaint but doesn't constitute an answer to the complaint.
Lawyers do the filing, but may need the help of a computer forensics expert to respond.
In criminal cases, the prosecution and defense may file any number of motions with the court. If a defendant wants to file a motion, it must be done five days before the trial and must be in writing.
Each motion must be accompanied by the legal reasons to grant the request. Legal reasons tend to be based on the reliability of the evidence, violations of constitutional rights, or violations of rules of evidence.
Note
When e-evidence plays a role in a motion, so do computer forensics experts.
Motions can be viewed as tools by either side in an effort to define the boundaries of the case. Parties can be extremely aggressive with motions.
The legal system uses pretrial motions and motions for pretrial hearings — and uses many of them. In the following sections, we discuss the following three types of common pretrial motions that are relevant to computer forensics in civil or criminal cases:
Motion to suppress evidence (applies to criminal cases)
Motion in limine (applies to civil cases)
Motion to dismiss
We discuss one type of motion in Chapter 2: the Rule 16 motion to discover. It's the request for discovery or e-discovery. This motion controls the exchange of evidence between the opposing lawyers during discovery.
A motion to suppress evidence asks the court to exclude evidence from the trial, such as a motion to suppress a defendant's prior convictions. It's the only motion that applies only to criminal cases. The legal basis in criminal trials is usually that evidence was collected in violation of the defendant's constitutional rights. For example, if a defendant is arrested illegally and his computer is searched after the arrest, the e-evidence found during that search may be inadmissible.
In civil cases, evidence is excluded — rather than suppressed. A motion to exclude evidence is commonly termed a motion in limine.
A motion in limine (pronounced "in lim-in-ay" and means "at the threshold") asks the court to limit the evidence at trial or to rule that certain evidence cannot be used. For example, in a discrimination case, this motion can be used to prevent the introduction of inflammatory evidence or evidence about past cases because it would show a pattern. Or, the prosecutor may want to introduce evidence that cannot properly be linked to the defendant or the alleged crime because of the way in which it was collected.
A motion to dismiss is an attempt to have the charges dismissed. The basis for this motion is that the case doesn't have a sound legal basis, even if all alleged facts are proven to be true.
Either side can bring a motion to dismiss. If the prosecutor handling a criminal case determines that there's not sufficient evidence to obtain a conviction, he may file a motion asking the judge to dismiss the case. This motion is made after the case has been completely investigated, and after the police have exhausted all avenues for obtaining additional evidence. The judge may grant the motion to dismiss if she is satisfied that the case cannot be proven in a trial.
A variety of other motions may be filed before trial that pertain to you or your work, including the ones described in this list:
Forensics: Motions challenging computer forensics reports will be filed, so plan for them. Motions may be filed by defense lawyers seeking independent testing or review of the e-evidence.
Beginning in the 1990s, the U.S. Supreme Court imposed greater scientific rigor on forensic testimony. In a defining 1993 decision, Daubert vs. Merrell Dow Pharmaceuticals, the court demanded that such testimony not simply meet the existing standard of "general acceptance" in its field but also address some of the hallmarks of scientific inquiry — testing, peer review, and rates of error. (See Chapter 5 for more information about Daubert.)
Depositions: Motions may be filed seeking to interview under oath — called taking a deposition — other witnesses, including expert witnesses, or to block their depositions.
Production of evidence: Defense attorneys almost always file a motion seeking Brady material, which is exculpatory evidence that could possibly indicate that the defendant isn't guilty.
Such exculpatory material is named after the Supreme Court case Brady v. U.S. Defendants are entitled to receive, before trial begins, prosecution evidence that includes police and lab reports, statements made by defendants, names of expert witnesses, photographs, financial records, evidence of wiretapping and other surveillance, and any evidence that might help the accused demonstrate his innocence. Withholding such evidence by a prosecutor can be grounds for a new trial.
Pretrial hearings are an opportunity for negotiation in good faith between the parties. Judges can also hear evidence to determine whether the parties involved in the case followed the law and the United States Constitution and that the evidence was collected legally.
Note
Pretrial hearings are critical because they determine what jurors will hear or learn from the evidence and witnesses.
All the e-evidence you examine can be examined also by the opposing side's computer forensics expert. Requests may be made at a pretrial hearing for tests of your e-evidence methods. Plan to respond to this request for an explanation of what you did to arrive at your conclusions.
E-evidence, as well as your tools, techniques, and methodologies used in an examination, is subject to being challenged in a court of law or in other formal proceedings. If you don't have proper documentation, including chain of custody, you have a problem.
Defense lawyers may attempt to stop prosecutors from presenting certain e-evidence. They might argue that it was illegally obtained or should be barred as irrelevant. Prosecutors may do the same. You may be asked for your opinion about the strength of the e-evidence. This is not the time to be overly optimistic or to exaggerate.
Suppose that an emergency situation occurs with a high probability that e-evidence might be compromised or destroyed, so you seize the computer without a warrant. At pretrial, the opposing side may claim that no emergency situation existed, so the warrantless search was illegal and the e-evidence was obtained illegally. You may be slapped with that type of accusation; and not answering to the satisfaction of the judge isn't an option. Your chain of custody documentation is critical when you find yourself in this spot, which you read in Chapter 2.
If the primary incriminating evidence is suppressed at a pretrial hearing, there may be nothing left of the case. You might think "This can't be the end!" The judge's decision to toss your e-evidence can be appealed, but a discussion of the court of appeals and appellate processes is way beyond the scope of this chapter.
Your work as an expert witness may begin with giving a deposition before trial. A deposition (or depo) is your testimony given under oath to tell the truth.
Up to this point, you worked as an investigator. Now you're an expert giving factual and accurate testimony about the e-evidence and your methods. You're allowed as an expert witness to offer an opinion as testimony in court without having been a witness to any occurrence relating to the lawsuit or the crime. (See the section "Swearing to tell truthful opinions.") You're speaking on behalf of a computer or digital device, which you may find to be a bizarre experience.
The party seeking discovery has the right to depose any experts, including you. What's different about depositions as compared to trials is that direct examination is conducted by the opposing attorney. If a cross-examination takes place, it's done by the attorney who retained the expert. (Chapter 16 covers direct and cross-examination). No one asks you to be deposed. You're notified that you will give a deposition.
Basically, depositions are sworn question-and-answer conversations. You're asked questions by the opposing attorney, and the questions and your answers are recorded by an official court reporter. No judge or jury is present, but otherwise your testimony is similar to the way it is in the courtroom. Depositions have these three purposes, to
Obtain relevant information
Avoid surprises at trial
Motivate a settlement before trial
Tip
Before you give a deposition, the lawyer on the case will want to prepare you. Agree to it! Any preparation helps you be a more competent and convincing witness. Good opinions can go bad quickly without proper preparation.
The persuasive power of e-evidence and your qualifications and testimony during pretrial have a direct effect on which e-evidence becomes admissible — and can affect the result of the case.
At the deposition, you're testifying out of court and under oath, so you have to tell the truth and remain ethical. Everything you say — and we mean every word you say — is recorded by the court reporter. Actually, everyone involved in the deposition is recorded. Make sure that you form and express your opinions so that they reflect the truth. When you're presenting your opinions, you should
Give your opinion the weight it deserves.
Do not try to make your opinion more important than you know it is by overstating it.
Know the meaning of every acronym you use.
Even if you would never refer to DOS as disk operating system, your job is to know what all acronyms mean. For example, if you refer to an MD5 hash, you must be able to answer the question, "What does MD5 stand for?"
Prepare convincing opinions based on a thorough analysis to the best of your ability.
When you agree to the terms and scope of your work for the case (see Chapter 5), you create a responsibility. When giving an opinion about an issue that you didn't analyze in order to save money, you can't avoid blame by saying "I didn't get paid enough to do that."
Prepare to explain your review of the opinions of the opposing side's computer forensics expert and reasons why you disagree with them.
You have to explain why your opinions are correct and why the opposing side's opinions aren't correct, or are less correct. You have a double role to fulfill regarding opinions. For example, when asked why you disagree with the other expert's opinion, you need convincing reasons to show that you considered other possibilities. You want your opinion to look thorough, knowledgeable, and respectful of all opinions regardless of how off-the-planet they are.
Know the weakness of each opinion.
Every opinion is based on an assumption or interpretation. Opinions aren't facts — they're only based on facts (see Chapter 7). You have to fess up to the weakness of your opinion and then provide a reasonable explanation of how or why that weakness doesn't change the opinion. A reasonable explanation is one that's more likely than not to be correct. You keep the testimony under control by knowing your strengths and weaknesses and being prepared with answers. No one said that testifying as a computer forensics expert was easy — but we think that it's always interesting.
Be concise.
When you're not well prepared, you probably talk too much or act evasive. Unless it's a riveting, media-crazed case, no one wants useless details. Rambling on is a sign that you're talking around the issues because you can't zero in.
Note
Court reporters play a critical role in legal proceedings where spoken words must be preserved as a written transcript. The reporters are responsible for ensuring a complete, accurate, and secure legal record.
Answering questions truthfully may not be easy. You should let the opposing lawyer know that you need clarification or a different wording of the question in these types of situations:
You need a question reworded.
The opposing lawyer may not be wording things exactly right, in your opinion. He may be doing it deliberately to trick you, or unintentionally out of limited knowledge. Either way, don't answer until the question is reworded. To dramatize the difference, suppose that he's used to Latin phrases and you're used to hexadecimal. In response to a question that you can't answer as asked, you might say something simple but blunt, such as "I'm not able to answer your question as worded. Would you rephrase it?"
Warning
If you're inclined to help others, don't do so at deposition. Good witnesses stick to doing their job, which is only to answer questions and not to offer or volunteer any additional information.
You need a question stated more precisely.
The opposing lawyer's wording of the question may not be as precise as you need for it to be in order to give an answer. You may want to answer the question, but feel that you first have to correctly formulate the question for the lawyer. Asking questions isn't your job. You're the computer forensics expert witness, not the lawyer. Don't ask what the lawyer meant to ask. Respond by asking for clarification about the vague or misleading part of the question.
You didn't hear the question.
You may not have heard or understood each of the words in the question. Despite sharing the same currency, people in Brooklyn, Boston, and Biloxi with their respective accents don't seem to share the same version of English. Ask for the question to be repeated to be sure that you heard it correctly.
Depositions can be the most painful and mentally exhausting activity you perform during the case.
The questioning lawyer (the deposing lawyer) has a lot of leeway in the types and scope of questions to ask, unlike at trial. It can make a deposition sort of a scavenger hunt. The deposing attorneys can ask you questions that are leading, vague, hypothetical, or beyond your competence. Your lawyer can object for the record, but you're still stuck answering the question. As always, there are exceptions, but your lawyer will know about them and stop you from answering.
Note
Your job is not to win the case. If your goal were to win, you would be a hired (biased) expert. You present your opinions and let the chips fall where they may.
You're also being sized up by the opposing lawyer during the deposition. You're the enemy, so to speak. The lawyer is looking for ways to disqualify or discredit you by checking out how you react, how prepared and confident you are, and how the jury will react to you.
During the deposition, remember these five things not to do:
Don't make assumptions about what the question means or the lawyer's motivation for asking it.
Ask for rephrasing if you're unsure of the question. Say "I don't understand your question. Please repeat it or clarify it or rephrase it."
Don't argue or get defensive.
You're being sized up for court. Your strength as an expert witness is also being rated by the opposing lawyer. If that person sees that you can be made to look erratic or unprofessional in court by provoking you to argue or look defensive, that becomes a weakness in your side's case.
Don't allow your answer to get cut off.
Always finish your answer because the ending may be critical to the truth. If you're cut off, wait until it's your turn to speak, and then politely ask whether you can finish your answer. Wait for the answer. Then turn to the jury and give your answer from the beginning. Being polite is a good weapon because it makes it much tougher for opposing counsel to discredit you.
Don't act like you're trying to win a marathon.
When you're tired, ask to take a break, which you have the right to do. You can't be on top of your game if you're exhausted. (You're also more likely to be ornery.)
Don't talk when someone else is talking.
The court reporter must record every word and who said it. It's impossible to record more than one person's words.
During the deposition, remember these five dos:
Be simple, clear, concise, complete, and jargon free.
Wait until the lawyer has finished asking the question so that you know you heard the entire question.
Allow yourself a moment to think before you answer.
Say "I don't recall" when you truthfully don't recall or remember.
Say "I don't know" when you truthfully don't know.
When your deposition is done, the lawyer advises you of your right to review and sign the transcript. You probably don't want to read the transcript thoroughly and critically or make any corrections to it. You've invested many hours (yes, hours!) of your life in the deposition. Don't quit now.
Note
Don't waive your right to review or to sign. And, never sign the transcript if you haven't read it carefully.
You need to review and correct your testimony in your deposition because
It may be entered as testimony.
If your mistakes are found and pointed out in front of the jury, your credibility tanks.
As lawsuits and criminal cases become more complicated, lawyers may turn to video depositions. Imagine the worst home video you've seen. Now stop imagining that video before you stress out. That short exercise should make you recognize the importance of being well prepared to testify with all your reports and papers organized and labeled. Of course, you should be prepared regardless of whether you're starring in a video.
What you say, how you sound, and how you appear when testifying influence the jury, and thus, the case.
You sound your best if you understand what to expect and how to respond so that you're not surprised or stressed out. As in many careers, you need to practice to be good at your sport, art, music, craft, or testimony. For example, you can attend conferences that teach you how to testify. Practice giving opinions and testimony about each case too. Ask the lawyer who retained you for a rehearsal to prepare you, but don't memorize your testimony. Then rehearse on your own as part of your preparation work before giving a deposition or appearing in court.
Anything that adds stress isn't good for you or the case. When you feel relaxed and confident, it shows.