Computer Forensics Expert Witness Services

What a computer forensic examination covers

The examination has two halves: getting a verifiable copy of the evidence, and reading the artifacts the operating system left behind without changing them.

Acquisition and verification

Acquisition is done through a hardware or software write-blocker, so the examiner’s own tooling cannot alter the source. The output is a forensic image — E01 or Ex01 with embedded metadata and per-block checksums, or a raw sector-for-sector copy — and a hash computed over the source at acquisition and again over the image at verification. Those two values matching is what allows the examiner to say the copy is the evidence. Where the values do not match there is usually a legitimate reason, most often a live acquisition from a running system whose state changed while it was being read; what damages an opinion is a mismatch that was never recorded and cannot be explained.

Analysis is then performed on a working copy, never the original, and every tool and version used is recorded so that the sequence can be run again. Encrypted volumes, RAID sets, solid-state drives with aggressive garbage collection, and machines that cannot be powered down each change the acquisition strategy, and the strategy chosen is documented alongside its consequences.

The artifacts, and what each one actually records

The value of a computer examination lies in the operating system’s own bookkeeping. On Windows the principal records are:

• The master file table ($MFT) and change journal ($UsnJrnl) — file names, sizes, and four timestamps per file in both $STANDARD_INFORMATION and $FILE_NAME attributes, plus a rolling record of creations, renames, and deletions. A discrepancy between the two timestamp sets is the classic signature of timestamp manipulation.
• Registry hives — USBSTOR and MountedDevices for removable media history; UserAssist, RecentDocs, and typed-path lists for what a user opened; shellbags in USRCLASS.DAT for folders browsed, including folders on media no longer present; AmCache and the application compatibility cache for programs that existed on the system.
• Prefetch files, LNK files, and jump lists — evidence of execution with run counts and timestamps, and shortcut records that embed the path and volume serial number of the device a file was opened from.
• Windows event logs — interactive and network logons and failures, explicit-credential use, process creation where auditing was enabled, service installation, and the record of a log being cleared.
• System resource usage monitor (SRUM) — bytes sent and received per application per user, in hourly buckets, which is often the only local record bearing on how much data left a machine.
• Browser, mail, and cloud-sync artifacts — history, downloads, cached content, session recovery files, local mail stores, and the local databases written by OneDrive, Google Drive, Dropbox, and Box clients.
• Volume shadow copies — historical states of the same file system, frequently containing a version of a document from before it was altered or deleted.

macOS and Linux keep a different but equally rich set: FSEvents, Spotlight metadata, the unified log, quarantine attributes recording where a downloaded file came from, and per-user activity databases. The method does not change with the platform — only which records answer the question.

Where this comes up

• Departing-employee and trade-secret matters, where the question is what was taken and by what route
• Spoliation disputes, where the question is whether data was deleted, when, and with what intent — and whether it can be recovered
• Employment and internal investigations, where the question is who did what on a device and whether the account holder was the person at the keyboard
• Fraud and financial matters, where documents, their metadata, and their revision history are themselves the evidence
• Rebuttal work, where the task is to test another examiner's method and reproduce, qualify, or contradict their result from the same image

How the engagement runs

1. 01Conflicts and scope. Parties are run for conflicts before anything else. The scoping call establishes the question to be answered, the devices in play, the deadline, the venue, and whether the role is testifying, consulting, or neutral — the answer changes what is discoverable later.
2. 02Preservation and acquisition. On-site or by supervised shipment. Each device is photographed and recorded on a custody form with make, model, and serial; imaged under write-block; and hashed at acquisition and at verification. The custody form travels with the evidence and becomes an exhibit.
3. 03Triage and search protocol. Where an ESI protocol or protective order governs, the search terms, date ranges, and custodians are agreed in writing first. Doing this before analysis rather than after is what keeps the results from being re-litigated as a discovery dispute.
4. 04Analysis. Artifacts are examined against the question, findings are recorded as they are made, and each is tied to the specific artifact it comes from. Findings that cut against the retaining party are recorded the same way — an examiner who reports only helpful results is not offering an opinion, and the omission surfaces on cross.
5. 05Reporting. A draft opinion, then the report itself, with exhibits and a stated basis for every conclusion.
6. 06Testimony. Deposition, Rule 702 hearing, and trial, if the matter reaches them.

What you receive

In federal court the deliverable for a retained testifying expert is a written report meeting Rule 26(a)(2)(B), which is prescriptive about its contents:

Not every matter needs one. A declaration under 28 U.S.C. § 1746 or a state-law affidavit is the right instrument on a preliminary injunction, a spoliation motion, or a motion to compel. A rebuttal report responds to another expert’s opinion and is due within 30 days of that disclosure unless the court orders otherwise. In arbitration the form follows the tribunal’s directions rather than the Federal Rules. What does not change is the underlying discipline: every assertion traces to a specific artifact, and every artifact can be re-examined by an opposing expert working from the same image.

More on how the report is scoped, disclosed, and defended is set out on the expert witness testimony page.

What the evidence can and cannot establish

The most common way a computer forensic opinion fails is not bad acquisition — it is an inference stated more strongly than the artifact supports. Three distinctions do most of the work:

• Account, not person. Logs record an account and a session. Attributing that session to a human being requires something outside the machine — badge records, video, a phone in the same place, an admission — and the report should say which.
• Access, not exfiltration. A file being opened, a device being connected, and data actually leaving are three different findings supported by three different artifacts. Collapsing them is the error opposing counsel is looking for.
• Absence of evidence, not evidence of absence. Artifacts age out, get overwritten, and are disabled by configuration. That a record is not present may mean the event did not happen, or that the system was never keeping the record — and the difference is usually testable.

Stating conclusions in calibrated terms is not hedging; under Rule 702 as amended on December 1, 2023, the proponent must show it is more likely than not that the opinion reflects a reliable application of the method to the facts of the case. The guide to Daubert challenges to digital evidence sets out how forensic opinions are actually excluded, and how they are defended.

Questions counsel ask

Related reading

• What a digital forensic expert witness actually does

  The role across the life of a matter — defensible collection, reproducible analysis, Rule 26 reports, and testimony.

• How to hire and vet a forensic expert

  Testifying versus consulting versus court-appointed, what to demand before retention, conflicts, timing, and what drives cost.

• Daubert challenges to digital evidence

  Rule 702 as amended in December 2023, the four reliability factors, and the ways forensic opinions get excluded.

• Server forensics

  When the answer is not on the endpoint — domain controllers, file shares, and databases across an enterprise estate.