A second opinion on an opposing forensic report

When is a second opinion worth commissioning?

When the opposing report contains a load-bearing sentence that moves from what an artifact records to what a person did, and the case turns on that sentence.

An opposing forensic report is rarely wrong in the way counsel expects. The examiner usually parsed real files with a mainstream tool and reported what the tool displayed. Where a weakness exists it sits in the space between the artifact and the conclusion — a registry key that records a device attachment asked to prove a file was taken, a log sized to wrap in weeks asked to describe a year, a timestamp shown in one time basis compared against a header in another.

That is a diagnosable condition, and the diagnosis is cheap. Reading the report against the artifacts it cites takes hours, not weeks, and it produces one of three answers: the inferences are supported and there is nothing here; the inferences outrun the data and the question is how much of the record is needed to show it; or the report is so thinly documented that its own method cannot be reconstructed, which is a finding on its own.

• Worth it where a conclusion about conduct rests on one artifact parsed by one tool, where a timeline drives the narrative, where volume of data transferred is asserted, or where the report describes no acquisition and verification detail at all.
• Usually not worth it where the disputed facts are not technical, where the opposing findings are conceded and only their significance is argued, or where the only available criticism is that a different examiner might have chosen different tools.
• Worth it for a different reason where your own examiner needs to know what the other side’s image shows before a deposition, a mediation, or a decision about settlement value. That is a consulting engagement and it does not have to become a report at all.

How does the 30-day rebuttal window work?

Three things in that text decide how a second opinion has to be run, and each of them is routinely missed.

“Absent a stipulation or a court order”

The 30 days is a default that most scheduling orders displace. Courts set expert sequences under Rule 16(b), commonly with affirmative reports, then rebuttals, then a close of expert discovery, and the dates in that order control. The first document to read on receiving an opposing report is therefore the scheduling order and any standing order of the judge, not the rule.

“Solely to contradict or rebut”

This is a scope limit with teeth. A rebuttal disclosure answers the other side’s evidence on the same subject matter. A report that uses the rebuttal slot to introduce a new affirmative case — new devices, new questions, a different theory of what happened — is an affirmative report served late, and the consequence is usually that the new material comes out rather than that the deadline moves.

“After the other party’s disclosure”

The trigger is the disclosure. Not receipt of the images, not production of the examiner’s notes, not the resolution of the dispute about whether you are entitled to either. This is the clause that makes the timing problem structural rather than a matter of diligence.

The trigger is the disclosure. Not receipt of the images.

Why the clock and the acquisition schedule collide

A technical rebuttal that can actually be defended requires working from the same source material, and getting there has a fixed cost that no amount of urgency compresses.

Three forms a second opinion can take

These are genuinely different engagements with different deliverables, different discoverability, and different costs. Choosing among them is a decision that should be made deliberately at the outset rather than arrived at by default.

One conversion to be careful about. Moving a consulting expert into a testifying role is a decision with disclosure consequences, and it has to happen in time for the disclosure the rules or the order require. Deciding late produces the worst of both: an expert whose earlier work is now discoverable and whose disclosure is out of time.

What is answerable from the report alone?

More than counsel usually assume, and it is the engagement available when the window is already running. None of the following requires the images.

1. 01Find the sentences the report rests on. Every forensic report has one or two, and they sit in the conclusions. They are where the verbs change — from “the registry records” to “the user copied”. Mark them and work backwards to the artifacts cited.
2. 02Test each cited artifact against what it records. Device-attachment history does not record file transfer. A shortcut or jump-list entry records that a path was opened through the shell and does not distinguish opening from copying. Shellbags carry no volume serial number, so alone they cannot attribute a folder tree to a physical device. The artifact index sets out each of these with the mechanical reason.
3. 03Check whether retention was established or assumed. A capped and rolling journal cannot describe last quarter. A registry key holding a handful of timestamps is not a connection count. If the report asserts a period longer than the artifact retains, that is visible on the page.
4. 04Look for the time basis, and note its absence. What time zone is each column in? Was the source system’s configured zone during the relevant period established? Was drift measured at acquisition? A report that never states its time basis has left the question open.
5. 05Separate allocated from recovered content. Carved material may be genuine, partial, stale, or assembled from fragments of two records. A table that presents carved and allocated content in the same rows with no distinguishing column has flattened a real difference in confidence.
6. 06Check the disclosure itself against Rule 26(a)(2)(B). Opinions with no stated basis, a missing testimony list, no compensation statement, no exhibits. This is a disclosure argument rather than a reliability argument, and it is decided earlier and more cheaply.

The method for the deeper technical work — unstated assumptions, over-read artifacts, unvalidated tool output, custody gaps and timestamp errors — is set out at length in rebutting an opposing digital forensics expert. This page is about the decision and the clock.

How do second opinions actually get lost?

On procedure, not on merit. The reported rulings on rebuttal and defence forensic experts are dominated by designation and scope failures, and the substantive fight often never happens.

• Defective designation. In Donaldson v. State the trial court excluded the defendant’s forensic expert on two grounds — non-compliance with expert-designation discovery requirements and lack of qualification — and the appellate court affirmed on the discovery ground alone, expressly declining to reach qualification. Confirm in writing that the designation was made in the form and by the date the local rule requires.
• Collected but never disclosed. In Furmanite America v. T.D. Williamson an examiner who had done the collection was permitted to testify as a fact witness about the data he obtained and the procedures he used, and barred from expert opinion because he had never been disclosed and had filed no report. An examiner retained early to collect can end up a fact witness by default; if the engagement may produce opinions, get disclosed at the outset.
• Outside the notice. In United States v. Dillingham testimony about cleaning software should have been excluded because it was outside the expert notice and inadequately supported. Findings that emerge after disclosure need a supplement, not a mention at trial.
• No method available for the material supplied. In Sennett v. State a defence examiner retained to challenge e-mail authenticity was excluded: he had not examined the computers, conceded his tooling could not be run on paper copies, and offered no verifiable method. Where only printouts exist, the scope that survives is what the document shows on its face and what it does not — absent headers, an unverifiable transmission path — rather than a conclusion that it was fabricated.
• Framed around the wrong expertise. In State v. Cooper a defence witness with fifteen years in computer network security was cut back for lacking forensic-analyst credentials, and the Court of Appeals held that narrowing was an abuse of discretion. A rebuttal witness addressing whether artifacts could have been planted is not required to hold the same certifications as the examiner who recovered them; frame the engagement around the mechanism being asserted.

What a rebuttal should concede

The strongest second opinions are narrower than counsel initially wants. They concede what is well supported, identify precisely where the inference outruns the data, and state what additional evidence would have resolved each open question — which gives the court a method it can evaluate rather than a competing conclusion it has to choose between.

An equally aggressive counter-narrative is a poor trade. A rebuttal that builds an alternative theory on the same thin record is vulnerable to exactly the critique it is making. A statement about the limits of the record cannot be dismantled by attacking an inference, because it makes none. And courts narrow opinions far more readily than they strike experts wholesale, which means the rebuttal that asks for the narrowing is asking for the relief most likely to be granted.

Frequently asked questions

Related reading

• Rebutting an opposing forensic expert

  The method: unstated assumptions, artifacts asked to carry more than they record, unvalidated tool output, time basis, and reproducibility.

• Expert witness testimony

  Testifying, consulting and neutral engagements, and what each role does to discoverability of the work product.

• Rule 26 report check

  The six mandatory elements of a retained expert's report, run against a disclosure you have received or are about to serve.

• Daubert challenges to digital evidence

  What to do with the findings once you have them — the grounds, the failure modes, and how a motion is framed.

• The Daubert Docket

  The rulings cited on this page in full, with the court's reasoning and the opinion each holding was read from.

Attorney advertising / expert services. General information about evidence law and forensic practice, not legal advice, and not a substitute for checking the rules and case law of your own forum.