Not Your Mother’s Expert

One of the first lessons you learn about handling electronic evidence is that you can’t get it, keep it or use it without the help of specialized computer experts. When faced with a situation that requires, for example, the preservation of critical e-mail on your client’s laptop, it is most definitely not the right time to indulge your do-it-yourself (do-it-cheap?) fantasies. This is true even if you have followed this writers’ (and other far more noteworthy writers’) admonition to learn all you possibly can about electronic evidence, e-discovery and the like for the sake of keeping your law license.

The first lesson is followed quickly by the second: not all computer experts are created equal. With electronic evidence playing a starring role in more and more litigation these days, there seems to be no shortage of bit players claiming to be estars. I refer to those computer experts with seemingly better marketing skills than forensic skills. As, there is no court standard on the credentials or experience necessary to establish e-discovery or computer forensic expertise, it will be up to you to distinguish between qualified and unqualified computer experts.

So what’s the big deal? We’re trial lawyers. We hire experts of all shapes and sizes every week. You’ll do what you normally do: Ask a buddy who he used in his case. Or sniff around one of the expert directories on the internet. As a side note, an embarrassing number of colleagues have asked me whether they can just use the IT guy at their law firm or their client’s IT staffer to do the job. The answer is no. No, you can’t. Please just trust me on this. They are not forensically trained (see lesson number two) and you may lose original electronic evidence.

Certainly, its valuable to confer with other trial lawyers about your individual case requires you to do more than that. First, you must be clear about the kind(s) of computer services your individual case demands. If you need to gather, search, filter and produce large volumes of electronically stored information you require electronic data discovery services. But if you need to make an image of a party’s hard drive, authenticate or date an important e-mail so that it is admitted into evidence, or retrieve a damning document that a party attempted to delete, then it’s a computer forensic expert that you should hire. While its true that not all computer forensic experts can take on major e-discovery projects, its also true that few but the largest EDD firms can provide true computer forensic services. One author sums up how important it is for an attorney to know exactly what computer services he or she requires:

The e-discovery phase involves identifying, collecting and cataloging responsive electronic records in anticipation or at outset of litigation. E-discovery vendors must reduce the data set to a manageable number of relevant, important files. They must ensure that the process is reliable and format the data for attorney review without corrupting the data.

Computer forensics involves identifying, analyzing and forming opinions about electronic evidence to be introduced in court. Since data analyzed during the computer forensics phase are often hidden or embedded within digital files or computer systems, the computer forensics consultant must uncover, preserve and analyze it so it is admissible.¹

There are many large, reputable, and experienced EDD firms in the marketplace, including, in no particular order, Kroll OnTrack, Merrill Corporation, Fios, and Applied Discovery, and more. Of course, even when dealing with a reputable EDD firm, you must be careful to look beyond the resumes of those at the top of the letterhead. That is, you must inquire as to who will be actually working on your case and carefully review the credentials and background of those persons. Good EDD firms should be able to handle data in any format and be product-neutral. They should also be able to offer you references from actual clients that you should take the time to check out. Most importantly, a good EDD firm should be able to fix a price for a large majority of the project. Probably the most frequent complaint about EDD firms is that costs spiraled out of control or that the attorney was not consulted before additional costs were incurred. Generally speaking, the larger the firm, the larger the bill. Its not unusual for the larger firms to charge $500 an hour; on the other hand, if you’re about to hire a computer expert who charges less than $250 an hour, you might want to revisit his or her credentials and actual experience in the courtroom. In any event, be sure to get a detailed cost estimate up front and in writing.

Computer experts aren’t licensed. There is no single governing body for computer forensics or standardized exam required before hanging out a shingle and claiming expertise. However, you can look for and expect meaningful forensic certifications. Many of the most experienced computer forensic experts come from the world of law enforcement or the military. But in the private world, the most prestigious certification is the EnCE (EnCase Certified Examiner) issued by Guidance Software. Other respected certifications include Certified Information Systems Security Professional; Certified Computer Examiner; or Certified International Information Systems Forensics Investigator. There are significant technical certifications such as Certified Novell Engineer, Certified Cisco Network Administrator, or Microsoft Certified Professional, but product certifications in and of themselves may not mean anything. It is important to find out whether your expert earned a meaningful certification or just a “certificate of attendance”. Was a written exam required? The bottom line is you want a computer expert who is certified in a computer discipline like forensics not just in the use of a particular computer software or tool.

Of course, like all experts we hire, it is helpful if they have solid experience in the courtroom and are comfortable when they testify in court. Also, like all experts we hire, you should consider the expert’s communication skills. But, I don’t think its overstating the point, to suggest that it may be challenging to find a computer expert who doesn’t get lost in geekspeak. Remember your testifying computer expert will need to translate complex technical subjects to a jury, a judge, and to you. If your computer expert can’t explain things well enough for you to understand, how well will he or she do in front of a jury?

To sum up, as trial lawyers, we routinely undertake a vetting process before engaging an expert for our cases. Never is this more important than in the area of computer expert services where the quality of the technical work can determine what, if any, electronic evidence is procured and whether that electronic evidence is admissible in court.

Finally, an excellent resource to consult is The Electronic Evidence and Discovery Handbook authored by Sharon Nelson, Bruce Olson and John Simek. Among other things, it contains an EDD vendor checklist and guidelines for hiring an electronic discovery or computer forensic expert. Another useful resource on this subject is the ABA’s Electronic Evidence and Discovery: What Every lawyer Should Know.