Computer forensic examiners are from Mars, attorneys are from Venus
by Keith Chval - Co-founder of Protek - Wednesday, 27 March 2013.
Also, the importance of timeliness and of an appropriate sense of urgency doesn’t dissipate once the initial crisis situation has passed. Whether driven by investigative or litigation demands, critical deadlines will continue to present themselves. The last thing counsel needs is to add uncertainty about whether the examiner will complete her work on time to his list of pressures. Once again: How can you make him look good and his life easier?

Communications must be clear and concise, no techno-babble

By far, the most commonly voiced frustration by my panel of attorneys was examiners who use techno terminology and jargon that only Bill Gates could love. Stop it!

Michael Elkon, a Fisher & Phillips litigator in Atlanta, paid an examiner with whom he worked the highest of compliments for her ability to put technology in laymen’s terms, “An examiner gave me a great explanation as to what you can and cannot tell from a file registry that I still use at least once a month when talking to clients, and I end up sounding smarter to my clients. I would have a harder time doing my job without being able to explain to clients what the registry can show with respect to thumb drive usage.”

Before speaking with counsel, or writing a report or affidavit to be shared with counsel, you MUST step back and check that you are communicating in a way that the common man on the street could understand. Where a technical term must be used, consider including a definition or explanation of the term. To explain technical processes, consider analogies to non-technical, everyday experiences with which others would already be familiar.

A "data dump" does not a "report" make

For Mike Wexler, a Seyfarth Shaw litigator, the first frustration that came to his mind was “Information that is not user friendly and doesn’t answer basic fundamental issues…we receive big printouts that are not boiled down in any way and are too technical.”

Wexler’s lament has been repeated by many of the polled litigators. This is right at the heart of the “How can I make the attorney look good? How can I make the examiner’s life easier?” mindset.

First, while some of the “extraneous” data in a report or spreadsheet that you produce may mean something or may even be critical to you, counsel may not care one iota about it. It only creates confusion and adds to the crushing volume of data through which counsel must wade through to get to what he actually needs.

Get rid of all the non-essential fields, columns, rows, records, non-user created files, and other unimportant things! Take the time to think through what’s truly going to be useful and meaningful to counsel, and cut out all the rest. Then, create a template for yourself and continually improve upon it so the next client, and the next client, and the next reap the benefits of your work.

Similarly, give some thought to how you identify and label items. For example, rather than having a spreadsheet with tabs labeled “LT1,” LT2,” LTn,” why not label them “Jones LT,” “Smith LT,” “Thomas LT”? Whatever fits, but the point is to identify and label things in such a way as to make it as easy as possible for counsel to immediately know to what it refers. (How can I make his life easier?)

Silence is golden

Silence kills. Nothing is more frustrating to counsel than not knowing what’s going on with your examination. What’s been completed? What’s your initial sense of the situation (understanding it’s preliminary and subject to change)? What are the next steps? When do you expect they’ll be done? Are you hitting any snags? Should we be considering any other avenues? Where are we at on costs?

These are all critical questions, the answers to which counsel should never be left wondering about. And don’t leave counsel to have to chase after you for the information. Take the lead and send, or call, with a regular update. Not only is counsel interested in knowing, but you can also be sure that his client is calling him asking the exact same questions. Once again: How can I make his life easier and make him look good?


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Mon, Feb 8th