Hiring an Expert: Who and Why

Albert Barsocchini is Assistant General Counsel at Guidance Software, Inc., in Emeryville, California. You can reach him at www.guidancesoftware.com
The following checklist is for both the propounding and responding party in any matter involving electronic discovery.

1. Why use an expert?

  • Courts mandate that computer evidence be collected in a forensically sound manner.
  • Properly recover deleted, hidden, and temporary files normally invisible to the user.
  • Prevent data from being damaged or destroyed.
  • Safely extract relevant data.
  • Preserve the chain of custody.
  • Avoid business disruption.
  • Preserve appropriate privileges.

2. Qualifying the expert

  • How many hours of formalized forensic training?
  • EnCE certified or comparable?
  • Number of cases investigated and frequency?
  • Types of cases?
  • Times testified?
  • Investigation training?
  • Background?

3. What to communicate to the forensic expert witness?

  • What exactly you are looking for and trying to accomplish?
  • Case type
  • Names of parties and potential witnesses
  • Existing evidence to support case
  • Possible evidence location(s)
  • Key words
  • Events timeline
  • Output format

4. What can an expert accomplish?

  • Recover deleted, hidden, and temporary files.
  • Find "timeline" evidence: when a file was created, modified, last accessed.
  • Find proof of evidence/document destruction.
  • Provide Web and user activity.
  • Password cracking and recovery.
  • Store and analyze evidence in a state-of-the-art computer forensics laboratory.

5. Working with the forensic expert

  • Do learn about the computer forensic profession.
  • Do hire an unbiased expert.
  • Do check out the expert's credentials.
  • Do prepare your expert for testimony.
  • Don't put off hiring your expert.
  • Don't wait for the opposition to bring out weak points in your expert's report.

6. Will you get the data

  • Is it reasonably obtainable?
  • How specific is the request?
  • What is the likelihood of success?
  • Availability of other sources?
  • Does the benefit outweigh the burden?
  • Purpose of the data (day to day vs. emergency backup)?
  • Cost to gather the data?
  • Resources available to requesting party?

7. How to get the data

  • Send preservation letter.
  • Take the deposition of the person most knowledgeable.
  • If possible, agree on inspection protocols.
  • Expressly request electronic documents.
  • Narrow the request for electronic documents.
  • Focus on the probative value of the information.
  • Specify the production format.
  • Know the technology that is being used to store and retrieve the target documents.

8. How to respond to an electronic discovery request

  • Take responsibility for the relevant documents.
  • Immediately locate and preserve all computer-based evidence.
  • Document evidence-preservation efforts.
  • Evaluate (jurisdiction issues, specificity of request, volume and location of data requested).
  • Limit production by key words, dates, active data.
  • Extract relevant data into a designated folder.
  • Object to it as burdensome, overly broad, and cost prohibitive.

9. Cost shifting—Who should bear the cost?

  • The extent to which the request is specifically tailored
  • The availability of such information from other sources
  • The total cost of production, compared with the amount in controversy
  • The total cost of production, compared with the resources available to each party
  • The relative ability of each party to control costs and its incentive to do so
  • The importance of the issues at stake in the litigation
  • The relative benefits to the parties of obtaining the information. See Zubulake v. UBS Warburg, 217 F.R.D. 309 (S.D.N.Y. 2003) FA

Published in Family Advocate, Volume 29, No. 3, Winter 2007. © 2007 by the American Bar Association. Reproduced with permission. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.