Expert Witness Report Review Checklist

A structured checklist to surface methodology gaps, Daubert vulnerabilities, and unsupported conclusions in an opposing expert's report, or your own expert's draft before disclosure.

What's in this checklist

A structured checklist to surface methodology gaps, Daubert vulnerabilities, and unsupported conclusions before they reach the bench.

Preview · Section 1

Qualifications and disclosures

Does the report identify the expert's full CV, prior testimony, and any disqualifications?
Are the expert's certifications current and from recognized bodies (Cellebrite, Magnet, GIAC, ISC2, EnCase)?
Has the expert testified previously on substantially similar issues? In which jurisdictions?

▣ 32 more items, 6 more sections

Enter your email to unlock the full checklist and download the branded PDF.

Section 1

Section 1: Qualifications and disclosures

Does the report identify the expert's full CV, prior testimony, and any disqualifications?
Are the expert's certifications current and from recognized bodies (Cellebrite, Magnet, GIAC, ISC2, EnCase)?
Has the expert testified previously on substantially similar issues? In which jurisdictions?
Is the expert's compensation disclosed?
Is there a list of materials reviewed and materials considered but rejected?

Section 2

Section 2: Methodology and tools

Does the report name every tool used, with version numbers?
Are the methodologies referenced peer-reviewed or industry-standard (NIST, SWGDE, ISO 27037)?
Were the tools used in their validated, supported configurations? Beta or unsupported features should be flagged.
Does the report distinguish between tool output, expert interpretation, and expert opinion?
Is the analysis reproducible? Could another qualified examiner repeat the steps and reach the same conclusions?

Section 3

Section 3: Evidence handling

Is the chain of custody documented from collection through analysis?
Were hash values calculated at acquisition and verified at every subsequent transfer or analysis step?
Was the analysis performed on a working copy, not the original?
Were write-blockers used during acquisition? Is this documented?
Is the storage and access history of the evidence documented?

Section 4

Section 4: Findings and conclusions

Is every conclusion supported by a specific artifact, exhibit, or log entry?
Are alternative explanations addressed? A strong report says why competing hypotheses were rejected.
Are the conclusions stated with appropriate certainty (e.g. "consistent with" vs "proves") and tied to a stated confidence level?
Are the limitations of the analysis explicitly stated?
Does the report distinguish between events on the device and inferences about who caused them?

Section 5

Section 5: Daubert / Frye stress test

Has the methodology been tested? By whom, when, and with what results?
Has the methodology been peer-reviewed and published?
Is there a known or potential error rate? Is it disclosed?
Are there standards controlling the technique's operation?
Is the methodology generally accepted in the relevant scientific community?

Section 6

Section 6: Common red flags

Screenshots in lieu of forensic artifacts (metadata is lost).
"Deleted" labels without explanation of how the artifact was carved and whether it was overwritten.
Time stamps without a stated time zone or device clock validation.
Opinions on user identity ("the defendant did X") without supporting authentication evidence.
References to proprietary tools without disclosure of the tool's underlying methodology.
Citations to outdated case law or superseded standards (SWGDE 2010 is not the same as current SWGDE).

Section 7

Section 7: Cross-examination preparation

Identify three findings the expert will be least able to defend.
Identify any tool feature the expert cannot explain technically.
Identify gaps between the expert's CV and the specific claim being made.
Identify any prior testimony where the expert took a contrary position.