Attorney Guide

Questions to Ask the Opposing Digital Forensics Expert at Deposition

Most digital forensics reports are not wrong on the analysis. They are weak on the record: what was done, in what order, with which tool build, and how the examiner got from an artifact to a conclusion. Deposition is where that weakness shows, but only if you ask in the right order. This is the sequence I use when I review the other side's report, organized the way Rule 702 is organized.

1. Qualifications and disclosures

Start with the disclosure package, not the findings. A qualified examiner should be able to answer every one of these without looking anything up.

• Walk me through your current CV. Which of these certifications are active today, and when does each expire?
• List your expert testimony in the previous four years: case, court, and whether you testified for the party that retained you.
• Have you ever been excluded or limited as an expert, in any court, on any subject?
• How are you being compensated in this matter, and how much have you billed to date?
• What materials did you review? What materials were offered to you that you chose not to review, and why?

2. Methodology and tools

The report should name every tool and version. If it does not, that is the first line of questioning, because reproducibility starts there.

• Name every tool you used and the exact version or build of each.
• Which recognized methodology did you follow: NIST, SWGDE, ISO/IEC 27037, or your own? Where is it written down?
• Were any features you relied on marked beta, experimental, or unsupported by the vendor at the time?
• In your report, which statements are direct tool output, which are your interpretation of that output, and which are your opinion?
• Could another qualified examiner repeat your steps from your notes alone and reach the same result? Where are those notes?

3. Evidence handling

Chain of custody is where an otherwise solid report collapses under cross. Ask for the documents, then ask about the gaps.

• Who handled the device or media between collection and your examination? Show me the log.
• What hash values were calculated at acquisition, and at which later steps were they verified?
• Did you analyze the original evidence or a forensic working copy? How do you know the copy was complete?
• Was a write blocker used during acquisition, and where is that documented?
• Where was the evidence stored between sessions, and who had access?

4. Findings and conclusions

Every conclusion should trace to a specific artifact, exhibit, or log entry. Ask for the trace on the three conclusions that matter most to the case.

• For this conclusion, which exhibit or log entry supports it? Walk me from the artifact to the sentence in your report.
• What alternative explanations did you consider, and why did you reject each one?
• When you wrote "consistent with," what did you mean? Would "proves" have been accurate? Why not?
• What are the limitations of your analysis, and where are they stated in the report?
• Your report says an event occurred on the device. Where does it establish who caused that event?

5. The Rule 702 questions

Since December 1, 2023, Rule 702(d) has required the party offering an expert opinion to show, more likely than not, that the method was reliably applied to the facts of the case. That is a question about this report, not about the discipline in general. State courts that follow Daubert or Frye ask the same things in slightly different words, and the questions below work under any of them because they go to reliability.

• Has the method you used been tested? By whom, when, and with what results?
• Has it been peer-reviewed or published? Where?
• Does it have a known or potential error rate? What is it, and is it disclosed in your report?
• What standards control how the technique is operated, and did you follow them here?
• Is the method generally accepted among digital forensics examiners? How would you show that?
• Show me where your report demonstrates that the method was reliably applied to these specific facts, not just that the method is sound in principle.

6. Red flags that become questions

Some patterns in a report are almost always worth a line of questioning.

• Screenshots instead of forensic artifacts. Where is the underlying artifact and its metadata? A screenshot strips both.
• "Deleted" without explanation. How was the item recovered? Carved from unallocated space, or from a database record? Was it overwritten in part?
• Time stamps without a time zone. What time zone is the report using, and how was the device clock validated?
• Opinions about who did something. What evidence authenticates the user of the device at that moment, as opposed to the device itself?
• Proprietary tools with no methodology. Can you explain what the tool does to reach that result, or only that it produced it?
• Outdated standards. Which version of the standard did you cite, and is it the current one?

7. Preparing the cross

Deposition answers become the cross-examination outline. Before the deposition, decide what you are looking for.

• The three findings the expert will be least able to defend from the record alone.
• Any tool feature the expert relies on but cannot explain technically.
• The gap between what the CV qualifies the expert to say and the specific claim in the report.
• Any prior testimony where the expert took a different position on the same technique.

Frequently asked questions

Do these questions apply in state court?

Yes. States follow Rule 702, a Daubert variant, or Frye, and every one of those standards asks whether the method is reliable and reliably applied. The wording of your motion changes; the deposition questions do not.

Should I depose the expert before or after an independent review?

After. The review produces the question list and tells you which findings are worth the time. Deposing first means asking general questions and hoping something lands.

What does an independent review cost, and how long does it take?

The Opposing Expert Report Review is a $2,750 flat fee: a written memo on methodology, overreach, and the questions to ask under oath, typically in five to seven business days. If the scope is unusual it can be quoted hourly instead. See the fee schedule.