Bench & Bar of Minnesota is the official publication of the Minnesota State Bar Association.

Putting communication and clients first in digital forensic analysis

Within the software development community, production methodologies are adjusting rapidly to account for an increase in active consumer participation and involvement. The status quo is no longer suitable when consumers have specific demands regarding what their software must be able to do for them. Software engineers are no longer able to simply guess what their clients want; they need to know. Attorneys and service providers are no different.

Agile development requires a flexible, adaptive approach in which smaller deliverables are presented to consumers in order to gain immediate feedback. Failures are small and quickly remedied, and learning is paramount. This kind of methodology requires a high degree of communication with the client and an ability to adjust based on feedback.

While agile development is typically spoken of within a software context, service providers can learn a lot from the approach, specifically in regard to the importance of client communication. For example, final deliverables, such as analysis reports, should be the product of a collaborative effort between counsel and their forensic expert.

While forensic engagements leave no room for failure and revision given the sensitivity of digital evidence to alteration or spoliation, a degree of flexibility is often required as a case twists and turns and new strategies have to be adopted. Digital evidence demands a high degree of care—as well as knowledge of admissibility regulations—from the outset of a case, yet a forensic analyst must also be able to adapt to shifting priorities that may emerge during the development of the evidence.

The most skilled forensic experts are adept at utilizing a wide range of tools and methodologies to obtain relevant data and construct narratives of digital activity. Given the ubiquitousness of digital devices, members of the legal community need to be assured that their forensic experts are well-apprised of recent developments both in technology and the law concerning digital evidence. Ongoing education and training are vital in this effort, especially when it comes to communicating the importance and relevancy of particular pieces of evidence.

Admittedly, those within the technology sector are often believed to be poor communicators, and with good reason. It is often difficult to convey technological findings to individuals who are not in the same field. In addition to being tasked with discovering and recovering digital evidence, digital forensic experts must be able to relay their findings in an understandable, and thereby useful, way. An expert needs to keep relevant individuals in mind while writing analysis reports or providing testimony. Communication is key, and the best experts are able to relate complex findings in simple terms.

Just as consumers are often now active participants in the development of their software products through feedback, communication with clients throughout the progression of a digital forensic engagement ensures that analysis results are thorough, accurate, and ultimately understandable to the target audience.

Depending on the life cycle of a case and the facts that come to light, a forensic expert needs to be adept at collaborating with clients to shape analyses and provide the best results. If testimony is required, digital forensic experts need to be both technically and communicatively skilled. Digital evidence is objective and often provides the key piece of data required to make or break a case. But if it is not communicated in a clear and convincing way to juries and judges, it ceases to be useful; the point of the analysis may get lost in technical language. As technology and digital evidence get more complicated, the best digital forensic experts find ways to make it appear simple.

MARK LANTERMAN is the chief technology officer of Computer Forensic Services. A former member of the U. S. Secret Service Electronic Crimes Taskforce, Mark has 28 years of security and forensic experience and has testified in over 2,000 cases.

Leave a Reply

Articles by Issue

Articles by Subject