I screwed up so you don’t have to

I recently posted on LinkedIn  (How to wreck your report, affidavit, and testimony with one word.) about how one word can wreck your report, affidavit, or testimony. The word was deleted.

That post got a lot of article views. Probably because we are all thinking the same thing about the word “DELETED.”

I remember my first federal grand jury testimony clearly, even though it’s been over 2 decades. I was mid-sentence in testimony, deep in my explanation, when a juror raised his hand and interrupted me. He asked,

“Wait. What are you talking about?”

It caught me off guard. I’d never had a juror interrupt before in trial, and this was my first grand jury, so I paused and explained what I was talking about in my report. He gave me a thumbs up and said, 

“Oh. I get it now. Thanks.”

That was it. A five-second exchange. But it stuck with me for over twenty years. First, because I learned jurors can ask questions in grand juries. Second, I learned that jurors probably don’t understand much if you don’t convey information well, because if a grand juror had to stop me to ask what I meant, how many jurors in a criminal or civil trial were sitting silently, not understanding a thing I was saying?

My screw up day in court

Fast forward a few years, and I was testifying in another case under cross-examination. Guess what word was the word of the day: The word was cache.

The attorney asked if I found specific files in cache, and I answered yes. Then we went down the road of cache being a ‘hidden stash of documents’ and possession and concealment, like a weapons cache or stashed contraband. Cache is pronounced like cache and cash and I didn’t know if the attorney was messing with me or truly didn’t know what cache was. And the jurors looked totally confused.

And I didn’t see it happening until I was already halfway in.

By the time I realized what was going on, I’d essentially agreed, under oath, to a version of events that implied deliberate evidence concealment, even though I didn’t say that.

That’s when the pit in my stomach showed up and I was trying to remember why I got into this job. It felt like getting into the front seat of a car in The Godfather and realizing there’s someone behind me that I didn’t expect.

{source}<iframe width=”400″ height=”315″ src=”https://www.youtube.com/embed/35fLKn2Tq3o?si=DnD_RE7gjqLxuIrI” title=”YouTube video player” frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share” referrerpolicy=”strict-origin-when-cross-origin” allowfullscreen></iframe>{/source}

It took a while, and a lot of careful clarification, to dig myself out of that cache hole. But the damage was done. The moment you have to explain your way out of something you should have prevented, you’ve already lost ground in credibility.

Side note: I went through a litany of cache explanations, like browser cache, system cache, temporary cache, and even weapons cache.

The Fix I Wish I’d Learned Sooner

From that day forward, I decided: I will define every critical term in every report, declaration, affidavit, and testimony before someone else does it for me.

If I use “deleted,” I specify how and why.

If I use “recovered,” I clarify what that means too.

And if my tools use inconsistent terminology, I fix it before it leaves my report. Merging tool reporting is not just cutting and pasting. It is deciding upon a common terminology that fits across all tools, even if you have to rename the terminology used by one tool to match another.

Because words are the only part of your work the jury ever sees, and they aren’t going to ask you for clarification. They might pass a note to the judge, but don’t rely on the judge clarifying something they also misunderstood from what you said.

Why It Matters

This isn’t about semantics or “wordsmithing.” It’s about survival in your job.

Our world is full of amorphous terms that make sense in a lab but fall apart in a courtroom, which affects your credibility.

A juror won’t stop a trial to ask what you meant. An opposing attorney will. And they’ll do it with a smile. And in minutes, when you think you are free and clear, you will be like the guy getting whacked after walking into an office and finding he’s standing on a sheet of plastic…

{source}<iframe width=”400″ height=”315″ src=”https://www.youtube.com/embed/veg0cHBspNY?si=LNy5r9FkjkupSXK5″ title=”YouTube video player” frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share” referrerpolicy=”strict-origin-when-cross-origin” allowfullscreen></iframe>{/source}

The Takeaway

Yes, it’s “day-one stuff.” But the longer you’ve been doing this, the easier it is to forget that the audience doesn’t live in your world. By the way, I was in a trial a few months ago, and I saw this same situation happen with an experienced, court-qualified expert witness. Day one for him? Probably not. But I bet it felt like it.

Learn from the Seat You’re In (or that I’ve been in)

If this kind of courtroom chaos sounds familiar, or like something you never want to experience, I break it down court roles one by one in how you, the DFIR witness, is affected in my free webinar, “Every Seat but the Judge’s.“

It’s a one-hour walk-through of how courtroom language, perception, and precision decide credibility , sometimes more than the evidence itself.

You’ll see what happens from nearly every seat in the courtroom, from the witness box to the defense table, and how to keep control of your words no matter which one you’re in. I did this webinar from my perspective as a DFIR practitioner in every role I served in court (roles listed below this post*).

Bottom line:

In court, the truth isn’t what you know. It’s what they understood you to say (ie: in the words of Alonzo Harris, aka Denzel Washington, “It’s not what you know, it’s what you can prove.“)

{source}<iframe width=”400″ height=”200″ src=”https://www.youtube.com/embed/1hUWPBvppvU?si=IPKbjFO5u0thVC24″ title=”YouTube video player” frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share” referrerpolicy=”strict-origin-when-cross-origin” allowfullscreen></iframe>{/source}

On top of that, the truth won’t save you if your words betray it.

A few references of “deleted” as examples

I found a few instances of “deleted” being used in definitions. Can you see that “deleted” can imply user intention, especially if your cross-examining attorney throws some of these at you?

Deleted file: A file that has been logically, but not necessarily physically, erased from the operating system, perhaps to eliminate potentially incriminating evidence. – NISTIR 7298 Revision 2 Glossary of Key Information Security Terms https://csrc.nist.gov/glossary/term/deleted_file

Deleted files: If a subject knows there are incriminating files on the computer, he or she may delete them in an effort to eliminate the evidence. – US Department of Justice, NIJ Special Report, Forensic Examination of Digital Evidence: A Guide for Law Enforcement. Apr. 04.

4.7.2 Anti-Forensics There are many active measures that can be taken by a computer user to mislead an examiner. The simplest method is to delete incriminating files.

“[ ] Stating that a file was “deleted” can also be misunderstood as the action of someone deleting a file, which might not be the root cause of the file being non-allocated; it is clear to describe such files as being in a deleted state.” -Standardization of file recovery classification and authentication, Digital Investigation, Volume 31,2019,100873,ISSN 1742-2876, https://doi.org/10.1016/j.diin.2019.06.004.

*I’ve done these things in various trials over a few decades:

Court bailiff, fact witness, expert witness, rebuttal witness, Special Master, court advisor, pro se plaintiff, defendant, victim, juror, spectator.

I’ve written and done these things for cases: forensic reports, police reports, litigation complaints, pleadings, probable cause certifications, declarations, affidavits (generally and for search warrants), expert reports, special master reports, privilege logs, interrogatories, discovery requests, evidence hearings, trial briefs, closing arguments, objections, appeal, petitions, motions, replies, responses, meet and confer, summary judgment, motion to compel, answers. All of which taught me that I didn’t really know the court system even though I was in it for more than three decades.

This is what the Every Seat but the Judge‘s is about, in that I have reflected for years on each role and each thing that I have done, what I have seen, and how each role affects the DFIR witness.

Mostly, I reflected on how I could have done so so so so much better as a witness. Spend an hour with me and I promise you won’t see the courtroom the same again, especially if you have not yet been to court.