Expert Testimony

First responders are individuals who are the very first people on the scene of the crime. It
is important to identify the roles and responsibilities of first responders since this helps in solving
a crime (Rountree, 2011). In computer-based crimes, a first responder needs to have an IT
background. This helps ensure that the incidence can be verified and important details about the
incident are verified. Communication is key when engaging first responders. First responders
need to have an effective chain of communication with the investigators. It is important to ensure
that a first responder monitors the vulnerabilities that may exist in an IT system. This can only be
done through an evaluation of the nature of the threat. Firewalls need to be inspected to ensure
that data loss is stopped.
Another important step is the formulation of a response strategy. After the evaluation of
the nature of the crime, the first responder may come up with an initial response strategy. The
responder may mobilize resources as well as individuals who will aid in ensuring that the
situation is evaluated and a solution is found (Rountree, 2011). The initial response is made to
ensure that data loss is stopped before stakeholders are brought on board. The next step is a
conclusive investigation into the incidence. The investigation should seek to ensure that future
incidences similar to the present ones are stopped. The investigation should document all the
procedures and findings and include recommendations that are actionable.
Steps involved in Evidence Acquisition
Computer forensics is a field that is expanding rapidly. Law enforcers have realized the
importance of information technology. Tracking malicious crimes online has become an
important way of preventing cybercrime. A key component of stopping cybercrime is evidence

3
acquisition. Evidence acquisition in cyber crimes is complicated and involves several distinct
steps. The first step is identification. The identification phase involves obtaining preliminary
information relating to a crime (Freiling & Schwittay, 2017). It involves answering various
critical questions such as who was involved when did the incidence happen, and how it was
executed. The phase is important since answering these questions guides investigators on how to
proceed. During this phase, various traditional techniques may be employed. The analysis of
victim statements and the statements from witnesses are helpful.
The next step involves defining what evidence is required. The collection of digital
evidence involves the analysis of digital devices. These devices include computers, servers, and
external hard drives. It also involves the analysis of internet applications that store user data. It is
important to define the evidence being sought. Such a move will help save on time and ensure
that the collection of evidence is done in a structured manner. It will also ensure that important
evidence is not overlooked in the process (Freiling & Schwittay, 2017). The next step is the
collection of the evidence. Collection of the evidence is needed to ensure that a clear
understanding of the incident is achieved. Digital services that could hold important clues need
to be examined. The final step involves shutting down the system and ensuring that it is rebuilt
afresh.
Maintaining the Integrity of the Evidence
Every step must also involve documentation to ensure that the crime scene is well
documented. This will help guarantee the integrity of the evidence collected. The documentation
of the evidence will be of great help during the analysis process. It is important to ensure that
experts are relied upon during the process of evidence collection (Madigan, 2017). The experts
should have the ability to detect threats that may be present in the system. Without an expert, the

4
motive of the malicious activity may not be detected. Further, the process of evidence collection
may interfere with the integrity of the evidence. First responders, as well as investigators, must
be able to prove that the evidence was not modified at any step during the collection process.
This can only be done through having a chain of custody. In case the evidence is not preserved
well, the process of investigation may be compromised (Freiling & Schwittay, 2017). The
evidence gathered may be useless in a court of law and may be declared inadmissible. It may
also mean that investigators may fail to get to the root cause of the problem, and this may place
an organization at risk.
Importance of A Chain of Custody
A chain of custody includes the process used by investigators to obtain evidence as well
as important information on how the evidence was collected. Information on individuals who
took charge of the evidence as well as where the evidence was collected, is also contained in a
chain of custody (Prayudi & Sn, 2015). The names and contact information of individuals who
were involved in the evidence collection process are documented in a chain of custody. The
compliance with the chain of custody dictates whether expert evidence is admissible. The
evidence collected is subjected to various tests, including the date and time, as well as hash test
analysis. To this end, a chain of custody helps evaluate the authenticity of the evidence collected.

5

References

Freiling, F., & Schwittay, B. (2017). A common process model for incident response and digital
forensics. Proceedings of the IMF2007.
Madigan, M. L. (2017). First Responders Handbook: An Introduction. CRC Press.
Prayudi, Y., & Sn, A. (2015). Digital chain of custody: State of the art. International Journal of
Computer Applications, 114(5).
Rountree, D. (2011). Security for Microsoft Windows system administrators: introduction to key
information security concepts. Elsevier.