Testifying and/or writing a report such a critical part of a computer forensics experts job because even the greatest forensic expert's work is all for naught if the knowledge cannot get out of the expert's head. Without someway to convey the discoveries, to pass on the knowledge, there is no benefit from the work. Rather than a useful job, the expert is just carrying out their hobby: learning what they can for the sake of learning it. Testifying or producing a report is what makes that knowledge accessible to others.
Report writing is important because it documents the expert's job in a way that it is repeatable: able to be reproduced and peer reviewed. It records the details of the work such that the expert can remember them when months of other analysis has occured between the examination and when they finally testify about it. (Garnett, 2010) This report is what will remain over time to be accessed by clients, lawyers, future students, and even the expert themself.
Testifying is the most important because it is where the forensic examination yields its fruit. Laywers can present the findings, and deliver a report, but that very sterile presentation misses the social impact of testimony. Jurors or judges, they likely don't have the experience, training, or skill to truely process what they would read in the report on their own. The testifying expert is lending their presence, history, and experience behind the conclusions on the paper, their testimonty bolsters the argument from a lawyer. (Boundless, 2016)
Boundless. (2016, June 18). How to Incorporate Expert Testimony. Retrieved October 12, 2016, from Boundless Communications: https://www.boundless.com/communications/textbooks/boundless-communications-textbook/supporting-your-ideas-9/using-testimony-48/how-to-incorporate-expert-testimony-196-4203/
Garnett, B. (2010, August 25). Intro to Report Writing for Digital Forensics. SANS. https://digital-forensics.sans.org/blog/2010/08/25/intro-report-writing-digital-forensics/.
No comments:
Post a Comment