Digital forensics expert witness

Most litigation now turns, at least in part, on electronic records. An expert becomes necessary when a question about those records cannot be answered by the documents themselves and requires specialized knowledge to interpret. Typical questions include:

• Is this email, text message or document authentic, or was it altered or fabricated?
• When was a file created, modified, copied or deleted, and by which account?
• Did a departing employee copy confidential files to USB, personal cloud storage or personal email?
• Who had access to a mailbox or system during a given period?
• Was data actually exfiltrated during a cyber incident, or only exposed?
• Is the opposing expert's methodology sound, and do their conclusions follow from the data?

Under Rule 4.1.01 of Ontario's Rules of Civil Procedure, an expert must give opinion evidence that is fair, objective and non-partisan, stay within their area of expertise, and help the court as reasonably required. That duty prevails over any obligation to the party paying the expert. IT Rapid Support takes digital forensics expert-witness work on that footing.

In Ontario, rule 4.1.01 of the Rules of Civil Procedure requires every expert engaged by or on behalf of a party to provide opinion evidence that is fair, objective and non-partisan, limited to matters within the expert's area of expertise, and to give the court any additional assistance it reasonably requires. The rule states that this duty prevails over any obligation to the party who retained the expert.

Rule 53.03 sets out what an expert report must contain, including the expert's qualifications, the instructions provided, the issues addressed, the opinion and reasons (with factual assumptions, research conducted and a list of documents relied on), and a signed acknowledgment of expert's duty in Form 53. Recent amendments also require the expert to certify that they are satisfied as to the authenticity of the authorities and documents referred to in the report, subject to listed exceptions, and that quotations are accurate.

Rule 53.03 also sets timelines for serving reports before the pre-trial conference. Other provinces, the Federal Court and tribunals have their own rules; we work to whichever regime applies to the matter, and counsel confirms the requirements.

Good expert evidence starts with clear instructions. Because the instructions are disclosed in the report, we ask counsel to put them in writing: the questions to be answered, the evidence provided, and any assumptions we are asked to make. Where a question is outside digital forensics, such as the legal effect of a document or someone's intent, we say so rather than stretch.

Before accepting a retainer we check for conflicts, including prior work for the opposing party. We distinguish between consulting work for counsel (for example, a confidential review of the other side's evidence) and acting as the testifying expert, and we discuss with counsel at the outset which role is intended.

Before an expert report there is usually collection and analysis: see litigation support for counsel, digital forensics in Toronto, Microsoft 365 and Exchange forensics, mobile device forensics and forensics for breach counsel and insurers.

Cross-examination of a digital expert usually targets the process: how the evidence was collected, whether it could have changed, what tools were used, and whether alternative explanations were considered. Our methodology is built to answer those questions.

1. 01

   Defensible acquisition

   Evidence is acquired using write-blocking or read-only methods where possible, in line with ISO/IEC 27037 and NIST SP 800-86, and hashed at collection.

2. 02

   Documented chain of custody

   Every transfer of evidence is logged, so continuity can be shown from source to report.

3. 03

   Work on verified copies

   Analysis is performed on forensic copies whose hash values match the originals; originals are preserved.

4. 04

   Corroboration

   Key findings are tested against more than one artifact or tool, and the report says when they are not.

5. 05

   Stated limitations

   Gaps in the data, assumptions and alternative explanations are set out in the report, not left for cross-examination to find.

Under the Canada Evidence Act (sections 31.1 to 31.8) and section 34.1 of Ontario's Evidence Act, the party introducing an electronic record must prove it is what it claims to be, and the best evidence rule is satisfied by proof of the integrity of the system that recorded or stored it. Both statutes allow evidence of standards, procedures and practices to be presented on admissibility. Expert evidence about how a system recorded data, and whether that record is reliable, often goes directly to these questions.