How to instruct a digital forensics expert

In Ontario, rule 4.1.01 of the Rules of Civil Procedure requires an expert's opinion evidence to be fair, objective and non-partisan, and states that this duty prevails over any obligation to the party who retained them. Courts in other provinces apply similar principles. An expert who looks like an advocate loses weight, so independence is worth checking before you retain anyone.

Ask the candidate:

• Have you worked for the opposing party, its counsel or a related company?
• Have you previously examined this evidence or these systems in another capacity, such as the client's IT provider?
• Are you being retained as a consulting expert, a testifying expert, or both, and how will you keep those roles distinct?
• What is your experience with the specific sources at issue (Microsoft 365, Google Workspace, iPhone, Android, a particular business system)?
• Have you prepared reports that meet the applicable rules for expert evidence in this jurisdiction?

Under rule 53.03 the expert's report must set out the instructions provided, the nature of the opinion sought and the issues it relates to, and the factual assumptions relied on. Write the letter expecting it to be read by the other side and the court.

1. 01

   Background

   A neutral summary of the dispute, the parties and the relevant period. Avoid argument.

2. 02

   Questions

   Specific, answerable technical questions. 'Was the document titled X created before or after March 1, and on which device?' is better than 'Did the defendant fabricate the document?'

3. 03

   Evidence provided

   A list of every item provided, with its source and how it was obtained, so the report can identify what was relied on.

4. 04

   Assumptions

   Any facts the expert is asked to assume, stated as assumptions. The expert should be free to say if an assumption is inconsistent with the data.

5. 05

   Deliverables and timing

   Preliminary findings, report deadline, and any procedural deadlines for service.

6. 06

   Applicable rules

   The rule or practice direction governing expert evidence in the forum, and a request for a signed acknowledgment of the expert's duty (Form 53 in Ontario).

• Legal conclusions: whether a contract was breached, whether conduct was negligent, or who is credible
• Intent or state of mind: an expert can say a file was copied, not why
• Conclusions fixed in advance: instructions that read as a request to confirm a theory undermine the report
• Questions outside the expert's field, such as accounting or handwriting, unless the expert is qualified in them

How evidence reaches the expert can become an issue. Where possible, let the expert collect directly from the source so acquisition is documented from the start, following ISO/IEC 27037 guidance. If the client or another party has already collected material, give the expert everything about how that was done: who, when, what tool, and any hash values.

Never forward emails or copy files as the method of handover. Forwarding changes headers and dates; copying can change file system timestamps. Provide original devices, native exports or forensic images, and keep a record of each transfer.

Ask for a short preliminary briefing once the expert has looked at the evidence, before a full report is written. It tells you early whether the evidence supports your theory, whether further collection is needed, and whether a report is worth commissioning at all.

Agree with the expert how drafts will be handled and what will be put in writing at each stage. Rules and case law on the disclosure of draft reports and communications with experts vary, so discuss this with the expert at the outset.

The Sedona Canada Principles' emphasis on proportionality applies to expert work too. Start with the questions that decide the case, and expand only if the answers justify it.

• Conflict check completed and role (consulting or testifying) agreed
• Instruction letter with neutral background, specific questions, evidence list and stated assumptions
• Applicable expert evidence rule identified, and Form 53 or equivalent requested
• Evidence collected by the expert, or prior collection fully documented with hash values
• Approach to drafts and communications agreed
• Preliminary briefing scheduled before full report
• Written estimate based on agreed scope, with points at which scope is reviewed
• Service deadlines for the report calendared