Expert Witness & Digital Forensic Services

Single Joint Expert instructions in situations where there are significant amounts of digital evidence offer the prospect of greatly lowered cost and much more rapid resolution of disputes.   There can also a more specialised use when dealing with whole disks or databases part of which are disclosable but for part of which one party claims protection - the “inextricably linked” problem.

Regular SJE instructions
When a computer expert is asked to provide analysis and opinion which is likely to be challenged in adversarial litigation, costs can mount up  rapidly.  The problem is this:  modern computer systems, even apparently small ones, are very complex and the amount of data involved is often extensive.   In preparing a report the expert has to anticipate the possibility of hostile cross-examination,  typically along the line of why particular forms of investigation were not carried out.   The expert’s notion of “common-sense relevance to the circumstances” may not be enough.
The advantage of the SJE under CPR 35.7 is that both sides agree, or are ordered to agree,  with the expert’s decisions about relevance of enquiry within the scope of his instructions.  The practices implied in CPR 35.9-11 and developed in the associated Practice Direction and Civil Justice Council Protocol  ensure fairness.

“Inextricably linked”  computer forensics issues
Current recommended practice for the seizing of personal computers, disk media,  cellphones etc is that they should be “forensically imaged”.  A complete all sector copy is made which maximises the opportunities for the discovery and recovery of hidden and deleted data and the analysis of configuration and log files.   Examinations take place on the copy, not the original and moreover copies can be provided to “the other side”.   If done properly, subsequent tampering is difficult because even apparent small changes will show up as anomalies in the whole.
Problems occur, however when only part of a computer’s total storage is disclosable under CPR 31 and where there may be other material subject to legal professional privilege, 3rd party confidentiality obligations and data protection issues.   This problem can also arise on a smaller scale with email archives and other databases.  Most email is stored on computer not as individual messages but within a database (the method makes searching for old messages easier).   Some emails may be disclosable, others may require protection.
The solution is often for the parties to appoint a computer expert to take control of the disputed computers, databases, etc, and to provide extracts which meet necessary agreed criteria.  These “extracts” can include deleted but recovered material together with their context and some explanations.   If appropriate the expert can be instructed to work with a 3rd party independent lawyer, analogous to the supervising solicitor used in the execution of Civil Search Order.

Instructions by stages
Most SJEs proceed by stages.   Potential candidates for appointment will expect that instructing lawyers will want to assess their suitability, take up references and perhaps consider several competitively.  However experts will also be wary of being asked to provide too much free advice prior to formal instruction - or that the advice they give then prompts the parties to settle early without payment of any fee.   As a result, most instructions proceed via a preliminary assessment stage in which some detail is collected about what is likely to be required from a full instruction.   This stage produces an estimate and a basis for  court order.
There may be further stages by agreement in order to maximise opportunities to restrict the scope of the dispute.
Hourly rates charged by SJEs tend to reflect the additional burdens of having to “run” the instruction,  chase up the less enthusiastic party to the dispute, and if necessary, have to make direct approach to the court.