Forensics Report and Witness


Forensics Report

Computer forensics report
a report which provides detailed information on the complete forensics investigation process.

Object of investigative report
to eliminate uncertainty and confusion, consistency is more important than the exact format

ps:
when approached by a reporter about a case that you worked, refer the reporter to the attorney that retained you

...

鑑識報告的目的
溝通鑑識的檢驗結果,Commuciate results of computer forensic examination
讓報告易讀,Organize the information so that anyone can read and understand the report without reference to enclosures or other material
將證據與證詞一同呈現,Present evidence as testimony
表達專家意見,Express expert opinion
列出收取費用,Specify fees paid for expert's service

Report需符合以下
Explaining method
Data Collection
Including Calculation
Providing for uncertainty and error analysis
Explaining results
Discussing results and conclusion
Providing reference
including appendices
Providing acknowledgements
Litigation support reports versus technical reports

Report禁忌
jargon
slang
colloquial

refer
http://wenku.baidu.com/view/da7fbcd0360cba1aa811da11.html?re=view
...

Report classification
verbal formal report:口頭正式報告,a report delivered under oath to jury
verbal informal report:口頭非正式報告
written formal report:正式書面報告
written informal report,不可外流的草稿,以免被質疑正式報告的可信度
ps:
pdf is the preferred format for digital report

 

#########################################################

Witness

Witness classification
techincal witness:
技術人員或從業人員
do the actual fieldwork
technical testimony does not offer a view in court

expert witness:
在特定領域有專業性的權威,
has absolute field knowledge
expert testimony offers a view in court

ps:
lay witness
與expert witness相對,指對其所要證明的事項缺乏專業知識的證人。一般這類證人以意見或推論形式作出的證言限於以下兩種情況:1合理地建立在證人感知的基礎之上的;2有助於清楚地理解他的證言或有助於對爭議的事實作出裁決。
refer
http://lawyer.get.com.tw 

...

Expert witness(專家證人)
具有專家資格,並被允許幫助陪審團理解某些普通人難以理解的複雜的專業性問題的證人。
專家證人提供的意見稱為專家證言。
refer
http://lawyer.get.com.tw

Role of expert witness in Court
assist the court in understanding evidence
aid the attorney to get to the truth
fully express expert opinion

Expert witness type
computer forensics experts
medical & psychological experts
civil litigation experts:民事訴訟
construction & architecture experts
criminal litigation experts:刑事訴訟

Expert witness's qualifications in US federal rules
four years of pervious testimony(indicates experience)
ten years of any published literature
previous payment received when giving testimony

...

Preparing for testimony
Go through the documentation thoroughly
Establish early communication with the attorney
Substantiate the findings with documentation and by collaborating with other computer forensics professionals

...

證據成為法庭上論罪的依據
常見的有以下
美國聯邦證據法
general acceptance test/Frye standard/Frye test
Daubert standard/Daubert criteria

Frye standard(佛萊法則)
a legal precedent regarding the "admissibility" of scientific examinations or experiments in legal cases

Daubert standard(道伯特法則)
a legal precedent set in 1993 by the supreme court of the united states regarding the admissibility of expert witnessses' testimony during federal legal proceedings

refer
https://en.wikipedia.org/wiki/Frye_standard
https://en.wikipedia.org/wiki/Daubert_standard
http://www.lawbank.com.tw/treatise/pl_article.aspx?AID=P000192367
環境訴訟之科學證據及法庭技巧


ps:
Work Product Protection(訴訟律師工作內容之保護)
以專家之意見用於防禦對造關於故意侵權之主張時,亦會 牽涉是否放棄「訴訟律師工作內容之保護」(work product protection)的問題。美國實務上有所謂「訴訟律師工作內容保護理論」(Work product doctrine),係指訴訟律師為進行訴訟所蒐集或準備之工作內容享有不被揭露之保護。
refer
http://www.saint-island.com.tw/news/shownewsb.asp?seq=290&stat=y

2015-10-19 14:45:32發表 2015-10-19 14:46:20修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows
unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識

資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2



  登入      [牛的大腦] | [單字我朋友] Powered by systw.net