- ABA Groups
- Resources for Lawyers
- Career Center
- About Us
Today, family law cases compel attention in the marketplace. Forensics companies know that in a growing number of divorce cases, a huge piece of the puzzle involves gathering evidence from e-mails and chat rooms, authenticating it, and persuading the court to admit it at trial.
Whatever the facts of your case, a solid computer forensics expert must be skilled in collecting, preserving, analyzing, and presenting electronic evidence. He or she must be a gifted communicator, experienced at writing comprehensive yet accessible reports and adept at translating complicated technology concepts into understandable and compelling evidence at trial. The right selection will depend on a number of factors, including the issues in the case, the client’s budget, and the pool of available experts.
In short, reach for your bottle of Advil®. Mistakes are frequent. And if things don’t go well, you could end up with the likes of Bill Murray, Dan Aykroyd, and Harold Ramis, with equivalent expertise in exorcising demons. In the worst case scenario, at the end of the day you may get slimed.
At one end you have the major players—marked with huge price tags and a horrendous disparity of talent among their employees. At the other end, you have Joe Blow, formerly a clerk at your local big-box office supply store, who fiddles with computers at night and finds forensics “cool.” He launches his new career by acing a couple of courses at the local junior college and landing a meaningless certification from a vendor. He promptly launches his Web site and advertises his service to the world at “blue light special” prices. Hmmm, do you pay a fortune for a big hitter or take a chance on Joe?
Many experts hail from law enforcement or the military. Compared with Joe, their training looks terrific. However, their skills vary widely and their experience can be spotty. Rarely do they possess extensive technical backgrounds. Most practice their trades in a compartmentalized world, working almost exclusively on child pornography, intruder detection, and identify theft cases. Many have little civil experience and are on unsettled ground in the private sector. Although these credentials mark many of our dearest and most accomplished forensic friends, this caution is well-founded.
The largest players in the industry provide both computer forensics and electronic evidence services. Some of the biggest names include:
• Applied Discovery® (owned by LexisNexis®)
Needless to say, a host of other well-known firms are emerging in this burgeoning industry.
Computer forensics is not cheap. Small cases may run in the $5,000 to $10,000 range, and larger ones can quickly reach six figures. Rarely is it possible for an expert to quote a final figure upfront. First, he or she must glimpse the girth of the elephant. Proffering estimates based on a cursory examination of the facts is akin to what lawyers experience when a new client demands to know upfront what the final bill will be.
As a general rule, the larger the forensics firm, the larger the bill. It is not uncommon for the big boys to charge $500 an hour. In high-quality boutique firms, $250 to $300 an hour is more common. A firm charging less than $200 an hour should mandate a meticulous inquiry into its credentials, references, number of courts for which the firm is qualified, standing in the industry, etc.
Heed this advice well: some technologists bill fairly. They turn their clocks off while a process is running and work on someone else’s case. They account accurately and precisely for time spent. Others (who often bill at lower rates) charge for every moment “at work” and sometimes beyond. We have seen countless invoices for nine or ten hours a day, with no time off for lunch, bathroom breaks, chatting with colleagues, meetings, phone calls on other matters, etc.
We have found some “bargain basement” experts who bill well below the market rate compensate by tallying many more hours. A conundrum for a client. Will the lower rate result in a lower bill? Or will the higher rate, accurately applied, result in a smaller total? In the end, calling multiple references is your best bet here.
Our best advice is to hire the most experienced and best qualified expert you can afford. Regardless of the size of the firm you choose, consider the following factors in vetting prospective candidates.
At a bare minimum, an expert worth his or her salt must speak the English language clearly and fluently. We have many wonderful and brilliant friends of foreign descent, some of whom do not possess the English language skills to pass muster in court. The last thing you need at trial is confusion resulting from a mispronounced word or an incomprehensible accent that distracts from otherwise compelling testimony.
Beyond basic proficiency in English, your expert must be skilled at simplifying. He or she must be able to present technical matters in lay terms, with analogies that a judge or jury can understand. Geek-speak is worse than useless in a courtroom. You will come to revere an expert who makes popular-culture analogies easily in terms of television, cars, sports, and other matters that John Q. or Judge Q Public can relate to as part of everyday life.
Our best advice: Hire the most experienced and best qualified expert you can afford.
How often attorneys forget that this is the electronic era. You can maintain chain of custody perfectly well by shipping a computer from California to New York if that’s where the best expert is located. Although it is true enough that local experts are often preferred where monies are tight and travel expenses may be at issue, many lawyers lose sight of the value of having the best possible expert, irrespective of location. If a significant amount is at stake or the case is likely to end up at trial, limiting yourself to local experts may prove to be a disservice to your client. Well-known experts have clients across the nation and beyond because their expertise is respected and so often sought.
Good experts have qualified in multiple courts and list those qualifications on the CV. Mind you, most cases of any kind tend to settle, so even the best experts may only appear in court several times a year. However, it is wise to be wary of someone who has only qualified in one court or none at all. You don’t need a greenhorn cutting his or her teeth on your case.
Currently, the most prestigious certification available to private firms is the EnCase Certified Examiner (EnCE) issued by Guidance Software. Another certification rapidly gaining respect is the Certified Information Forensics Investigator (CIFI) issued by the International Information Systems Forensics Association (IISFA), a nonprofit organization. More certifications are emerging, but in the private sector, the EnCE and the CIFI are the certifications to look for.
One caveat: many less-than-honest folks will claim certifications on their CV when, in fact, they took classes or training courses. No meaningful certification was granted, only a “certification of attendance.” If you see a certification you don’t recognize, find out whether a written exam was required. Did the applicant have to prove some minimum time spent in computer forensics? Was the expert certified in computer forensics or merely—the use of a particular forensics tool? What organization issued the certification? Who was on the faculty? Was a practical hands-on component part of the testing? Is there a recertification component?
A good forensic technologist will have a lot of letters after his or her name, indicating a broad range of certifications with a number of different technologies. If you see no certifications, or a “base-level” certification (such as A+), you do not have an individual with a wealth of experience. If the expert is (by way of example) a Certified Novell Engineer, Certified Cisco Network Administrator, Microsoft Certified Professional + Internet, Microsoft Certified Systems Engineer, NT Certified Independent Professional, and a Certified Internetwork Professional, you have someone with an expansive technical background.
Get the expert’s CV early on and study it. Ask questions. Does it reflect extensive speaking and writing? Those who participate frequently in CLE seminars are skilled at answering questions on the fly and tend to be excellent testifying experts; their roles as teachers and writers also enhance their credibility with a judge or jury. What is the expert’s educational and professional background? Is this a broad-based technologist or a new college grad still wet behind the ears with only a narrow sliver of technical knowledge?
Beware of the Jack of All Trades. The individual who claims multiple disciplines—whether as private detective, computer repairman, software engineer, or some combination—may, in fact, be master of none. A forensic technologist worth having is generally billed as a forensic technologist and does not offer a Chinese buffet of services.
Remember the line from the gossip columnist in the movie L.A. Confidential? “Off the record, on the QT, and very hush-hush.” Not all cases are shrouded in secrecy, but a fair number of them are. Well-known figures get divorced, major companies have proprietary information at issue, public figures are in the headlines, and some people are charged with felonies. Make sure that the expert you choose has a confidentiality clause in the retainer agreement and don’t hesitate to ask him or her to sign your confidentiality agreement. Remember as well that the expert may work on your case with others; the entire firm should have an impeccable reputation for keeping secrets. During the course of a major case, the press will undoubtedly come sniffing and probing for information. A good expert knows the standard “no comment” response and is as immovable as the Great Wall of China.
There is no better way to secure a good expert. Ask your potential expert for references and then call them. Did the expert do a thorough, professional job? Was he or she responsive when contacted? Was the work completed on schedule? What was the quality of the report? Did the expert make a credible witness? Was he or she “spinnable”? Experts “for hire” are a nightmare in court.
If your candidate has the attitude that “the truth is the truth,” you may not want that truth in court, but at least you will know the realities of your case, its strengths, and weaknesses. Did the expert stay within budget (not always possible) or at least alert the client to additional costs before incurring them? Perhaps the number one complaint about experts in cases involving electronic evidence is that costs spiraled out of control without notification to the law firm. The result was a highly perturbed client—and law firm.
Nothing can replace a candid interview with a prospective expert. Good experts expect to be vetted. In a few moments’ time, you often can get a reliable sense of how bright, experienced, and articulate the expert is. If you know you will need litigation support, test the expert’s knowledge. When you mention the Daubert test, do you get a blank stare or the knowledgeable response of a seasoned court veteran? Does the forensic firm have a lawyer who can assist you with electronic issues with which you are unfamiliar? A seasoned expert with extensive courtroom experience may be sufficient, but that is a relative rarity.
At the end of the day, you want a good result at a fair price. Don’t be penny wise and pound foolish. Pay good people fairly and you’ll have a credible result. You may not get the answers you want, but what you get will hold up in court. Make no mistake about it, in e-evidence cases, the result frequently comes down to a duel between experts. Your guy gets blown away or their guy gets blown away. What you want is for your guy to be the smartest and sharpest ghostbuster around and the other side to learn what it is to get slimed.
Sharon D. Nelson is president and John W. Simek is vice president of Sensei Enterprises, Inc., a computer forensics and legal technology firm based in Fairfax, Virginia. They can be reached at firstname.lastname@example.org.
Published in Family Advocate, Volume 28, No. 3, Winter 2006. © 2006 by the American Bar Association. Reproduced with permission. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.