Building a Forensic Record for Cross Examination

By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics

Why Forensic Acquisition Carries More Weight Than Screenshots

Winning a high stakes commercial lawsuit, intellectual property dispute or employment trial often hinges on proving what happened inside a computer, smartphone or cloud account on a specific date. Trial attorneys put critical digital exhibits on firm footing when the record comes from a forensic acquisition that preserves the underlying metadata, rather than from PDF screenshots of text messages or files an internal IT technician copied onto a thumb drive. A forensic record answers the questions the other side raises under Federal Rules of Evidence 901, 902(13), 902(14) and 702: where the record came from, whether the copy matches the original, and how the method works.

Separating Automated System Noise from Deliberate Human Action

Since 1992, Global Digital Forensics has provided digital examination, artifact correlation and expert witness engagements for retained trial counsel in federal and state courts, including the records analysis behind Rogers v. BNSF Railway, the first biometric privacy class action to reach a jury, where the district court entered a 228 million dollar judgment before later vacating the damages award for a new trial limited to damages. A defensible forensic analysis corroborates timestamps against independent artifacts and checks software reports against the underlying data. Modern operating systems constantly update file dates during routine background indexing, antivirus scans and cloud synchronization. Our certified examiners correlate multiple independent artifact sources, such as Windows registry shellbags, LNK shortcut files, USB serial connection logs and unified cloud telemetry, to test whether a human user sat at the keyboard and intentionally accessed, copied or wiped the contested data.

Rule 901 and the Certifications in Rule 902(13) and 902(14)

The authentication standard is modest on its face and demanding in practice. Rule 901(a) requires the proponent to “produce evidence sufficient to support a finding that the item is what the proponent claims it is” (Federal Rule of Evidence 901). For digital records the illustrations that matter most are 901(b)(1), testimony of a witness with knowledge, 901(b)(4), distinctive characteristics taken with the circumstances, and 901(b)(9), evidence describing a process or system and showing that it produces an accurate result. A forensic examiner's testimony typically supplies the last of these, explaining the acquisition process, the hash verification and the tools in enough detail that the court can find the record is what it is claimed to be.

The 2017 additions to Rule 902 changed the logistics. Rule 902(13) permits a certified record generated by an electronic process or system to be self authenticating, and 902(14) does the same for data copied from an electronic device, storage medium or file “if authenticated by a process of digital identification,” each supported by a certification of a qualified person (Federal Rule of Evidence 902). In practice that means a hash value computed at acquisition and matched at production, described in a certification from the examiner who performed it, can substitute for live foundation testimony on the copy's integrity. Counsel gives the required notice, and the opposing party has the opportunity to test the process.

The practical lesson is that authentication is built at acquisition, well before trial. A hash computed when the device is imaged, recorded in the custody log and verified when the working copy is made supports a 902(14) certification ready for production. When the starting point is a screenshot or a drag and drop copy made by an employee, a forensic acquisition of the source supplies the record to certify. Our digital forensics expert witness page describes the certifications and testimony we provide, and the earlier sections of this guide explain why the copy made on day one determines what is possible on the last day.

What an Artifact Can Establish and How It Is Corroborated

Every artifact has a scope. A Windows LNK file or jump list entry shows that a file at a given path was opened from a particular user profile at a recorded time. Tying that activity to a person combines the profile record with logon records, badge data and other corroboration, because a shared workstation or a stolen credential is the first alternative the other side raises. A USB device entry in the registry shows that a device with a given serial number was connected and when it was first and last seen. File system artifacts on the device itself and shellbag entries referencing its volume are where the examiner looks for what was copied to it. We state each artifact's scope in the report so the inference chain is visible and defensible.

Timestamps deserve their own care. A file's created, modified and accessed times are set by the operating system under rules that vary by version and by the operation performed, and copying a file to a new volume, extracting it from an archive or syncing it from the cloud each produces its own timestamp pattern. Reading a modified date as the moment a human edited the document calls for checking the file system's internal records and the application's own metadata first, and that check readies the finding for cross examination. We correlate the master file table records, the application metadata and the cloud activity log before stating when a document changed.

The report follows the record precisely. If the data shows a file was opened and a USB device was connected within the same hour, we say that and we name the further sources that would test whether the file was copied to the device. The trial team can then decide whether to pursue the device, the cloud sync logs or the recipient's systems, and the report remains accurate whatever the answer. The metadata viewer and metadata comparison tools let attorneys look at document metadata locally while that decision is made. A report that matches each statement to the data is the one a litigator can rely on.

How the Record Is Built From Preservation to Testimony

The record begins with acquisition under a documented protocol. Devices are imaged through write blockers or acquired live with the method recorded, cloud sources are exported in native format with their audit logs, and each item receives a hash, a custody entry and a label tying it to the custodian and date. The protocol itself is an exhibit: it shows the court that the method was decided in advance and followed, rather than improvised. We align the process to NIST Special Publication 800-86, the Guide to Integrating Forensic Techniques into Incident Response, which organizes the work into collection, examination, analysis and reporting.

Examination and analysis run on verified working copies, and the originals stay sealed. Artifacts are parsed with validated tools and cross checked with a second tool or manual review where a finding is material. Alternative explanations are tested in writing: could a background process have produced this timestamp, could the user profile have been shared, could the cloud client have synced the file without a human action. Each test and its result goes into the examiner's notes, which become the basis for the report and are available to counsel when preparing the expert for deposition.

The report ties each opinion to its sources with enough specificity that another examiner could reproduce the finding from the same images and exports. When testimony is required, the examiner presents the same chain in plain language, with demonstratives drawn from the actual artifacts rather than illustrations. Our guide to preparing the expert file for Rule 702 scrutiny shows how that report is structured against the reliability standard, and the two documents are meant to be read together. Reproducibility is the property that answers opposing experts most directly, and it is built in from the first export.

The Cross Examination Themes We Prepare For

Cross examination attacks digital evidence along predictable lines, and preparing for them is part of the engagement rather than an afterthought. The first theme is custody: who had the device between seizure and imaging, was it powered on, could anyone have altered it. A custody log with names, dates and hash values answers it. The second is tool reliability: what software produced the finding, what version, how was it validated. A record of the tool versions, the validation data sets and the second tool confirmation answers it. The third is the alternative explanation, and the written tests described above answer it.

The fourth theme is the examiner's independence and scope. Was the examiner told what to find, what materials did counsel provide, what assumptions were supplied. Rule 26(a)(2)(B) requires the report to disclose the facts or data considered and the assumptions relied on, and Rule 26(b)(4) protects most other communications with counsel while leaving those categories discoverable. We keep a disclosed materials list from the first day so the answer at deposition is a document rather than a recollection, and so the retaining attorneys know in advance what will be visible.

Our report should be tested the way the other side will test it. Find the opinion, trace it to the artifacts, check that the artifact's scope supports the opinion without a gap, and look for the alternative explanations and how they were excluded. Where the report names a further source, consider whether to pursue it. A report that passes that reading in chambers passes it in the courtroom. The COMLAB v. Kal Tire case study describes a matter in which document metadata analysis and the court's evaluation of the expert's testimony were central to the outcome.

Preparing Your Digital Evidence Strategy Before Discovery Closes

Bringing a seasoned testifying expert into your matter early allows your legal team to draft targeted Electronically Stored Information protocols, keep collection in forensic hands from the start and build clear demonstrative exhibits that judges and juries immediately grasp. Test your working files right now using our zero upload Metadata Analyzer and call Global Digital Forensics at (800) 868-8189 to run a conflict check and speak with a senior testifying examiner. The initial consultation is free.

The Cross Examination Themes and the Record That Answers Them

The other side attacks digital evidence along predictable lines, and the guide describes preparing for each one. This table pairs the usual challenge with the part of the record that answers it and the rule that frames the question, so a trial team can test a report the way the other side will. Read it as a checklist against your own exhibit before disclosure. Where an entry in the answer column needs more support, strengthening it before disclosure prepares the finding for deposition.

In COMLAB v. Kal Tire, the court accepted Joseph Caruso as an expert in computer forensics and found his testimony on manipulated invoice metadata highly credible, the kind of record this guide builds from acquisition forward.

Check Embedded Metadata in the Metadata Analyzer

Drop a working copy of the disputed document, image or spreadsheet into the Metadata Analyzer, and keep the original untouched. It reads the embedded metadata with ExifTool in your browser and shows the creation, modification and author fields, the software that last saved the file and the hash of the exact bytes you examined, so a later reader can confirm you looked at the same file. Read the dates as what the application recorded, and confirm when a person acted against the surrounding system artifacts, because an export or a copy rewrites some of them. Nothing uploads. When the fields contradict the story a witness is telling, preserve the original and call so the surrounding system artifacts can be examined.

When two versions of the same document are in play, load both copies into the Metadata Comparison Tool. It lists the metadata differences first, so you see at once whether the author, the creation time, the last saved time or the editing application changed between the two, and then reports the content and byte level comparisons separately so a cosmetic difference and a substantive one are each read for what they are. Record the hashes it shows for each copy. The copies stay on your computer. When one copy carries fields outside what the workflow the other side describes would produce, call, because the next step is examining the device that produced it.

How to Begin and What Happens on the First Call

Our Preservation Checklist: Quarantine the Device, Hold the Account sets out the items to secure in the order they expire. Have ready the propositions you need to establish or test, the devices and accounts involved and where they are now, who has handled them, any collection already performed and by whom, the procedural posture and the deadlines for expert disclosure. The examiner asks what the dispute concerns, what the evidence is expected to show, what has been preserved and how, whether an opposing expert has been disclosed and what form the deliverable must take. The conversation produces a written proposal that identifies the sources, the acquisition or reacquisition needed, the analyses to be performed, the report format and the timing drivers tied to the court's schedule. The initial consultation is free. Call (800) 868-8189 at any hour.

Technical References and Further Reading

Primary sources and provider documentation behind this guide: SP 800-86, Guide to Integrating Forensic Techniques into Incident Response.

Authorities cited in this guide: Federal Rule of Evidence 901. Supplies the authentication standard quoted in the guide and the process or system illustration in 901(b)(9), current text at Cornell LII. Federal Rule of Evidence 902. Establishes the self authentication provisions for electronic records and copied data in 902(13) and 902(14), effective December 2017, current text at Cornell LII. Federal Rule of Civil Procedure 26. Governs expert report content and the protection of expert communications and drafts, current text at Cornell LII. NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response. Establishes the four phase forensic process the guide references, final publication August 2006.