How to be a digital forensic expert witness

The prospect of becoming an expert witness in court can be a daunting one. The question and answer format in which you must testify can seem awkward and inefficient. Used to communicating with your IT security professional peers, you naturally use the technical terms, jargon and acronyms of the trade when describing your findings and recommendations. As part of the legal process, you must become a teacher, presenting your technical testimony in terms that laymen can understand - but without condescending. While the general fact witness may testify only as to what he or she directly knows, an expert may present testimony using the powerful words, "in my opinion". Additionally, the expert may rely upon any information that is available, whether or not it has actually been admitted into evidence. In order to do so, however, you must be qualified by the trial court because of your skill, experience, training, or education. This paper gives a general overview of the legal concepts that govern the use of expert testimony, and gives examples and common-sense advice on how to effectively prepare and present technical evidence in court.