U2 lab™ - smart tech solutions / IT & computer judicial expert
U2 lab™'s 'Computer Judicial Expert' service is intended for those clients who are in one of the following situations:
The client is part of a judicial case as plaintiff;
The client is part of a judicial case as defendant;
The client is part of a judicial case as a representative of a third party who is part of a judicial case as plaintiff/defendant (e.g. law firm, lawyer, legal representative, custodian, etc.);
The client is the Justice Administration (in need of a judicial expert for a judicial case);
The 'plaintiff' is the part that initiates the legal process by means of filing a complaint/report or lawsuit against the defendant.
The 'defendant' is the part accused by the plaintiff of having committed a misdemeanour, offence or felony, or in general, of having broken the law.
For general information, see "General Information".
For information on the types of judicial cases, see "Types of Cases".
For information about the phases of the computer expert service, see "Phases".
For information about the expert report (or expert opinion), see "Expert Report".
For information on ratification of the expert report/opinion, see "Ratification."
For information on computer expertise, see our "Guide On Computer Expertise".
For information on Spain and EU basic legislation, see "Laws".
For multimedia resources, see "Multimedia Resources".
For information on available CCAA and Provinces, see "Territorial Scope".
For information about our rates, see "Professional Fee".
For information on current news related to real cases, see "News" [Spanish].
Computer Expertise Video: Types of U2 lab™ Cases and Services
This illustrative video shows different types of real scenarios in which a Computer Expert Report or a Computer Expert Opinion can become essential in a judicial procedure.
In general, a Computer Expert Report or a Computer Expert Opinion prepared by a Computer Expert is necessary in all those judicial cases in which the provision of computer evidence (of a digital nature) is required, in order for its validity, authenticity, integrity, etc., to be accredited/certified, and said evidence is admitted as valid, even if it is challenged by the opposing party.
Likewise, the video details the different Computer Expertise Services offered by U2 lab™ to its clients (companies, private clients, lawyers, law firms, Administration of Justice, etc.).
At U2 lab™ we advise and accompany our clients throughout the entire judicial procedure, from the phase prior to filing a complaint or lawsuit, the filing, the response, the preliminary proceedings, the provision of evidence and testimonies, the preparation of the hearing or trial, ratification of the Expert Report or Expert Opinion in court, the sentence, and beyond (preparation of resources, execution of sentence, etc.).
Types of Cases
Social/Labor;
Civil;
Penal;
Administrative;
Commercial;
Violence against Women;
Minors;
Etc.
Types of Judicial Expert's Reports and Opinions
WhatsApp message certification;
Email certification;
Certification of posts on social networks (Facebook, Instagram, X, Tik Tok, etc.);
Certification of IM messages (messaging applications);
Certification of digital files (documents, files, archives, reports, DB, etc.);
Certification of multimedia content (audios, images, photos, videos, etc.);
Certification of AI (artificial intelligence) content;
Local certification (PCs, laptops, tablets, smartphones, cameras, IoT devices, etc.);
Remote certification (cloud, mail servers, online platforms, social networks, etc.);
Certification of operating systems;
Certification of computer and telecommunications networks and systems;
Certification of digital signature;
Assessment/appraisal of computer damage (equipment, devices, documents, etc.);
IT Consultant (computing, telecommunications, cybersecurity, AI, etc.)
IT Audit (computing, telecommunications, cybersecurity, AI, etc.)
Etc.;
U2 lab™'s 'Computer Expert' service covers an extensive array of situations and judicial cases according to the nature of the misdemeanour, offence, felony or breach, and the specific jurisdiction.
All legal cases are related to the provision of evidence of a digital nature, including, but not limited to, those related to 'cybercrime' (cybercrimes).
Cybercrime is criminal activity that either targets or uses a computer, a computer network or a networked device.
Most cybercrime is committed by cybercriminals or hackers who want to make money.
However, occasionally cybercrime aims to damage devices (PCs, laptops, tablets, smartphones, etc.) or networks for reasons other than profit.
Cybercrime may harm the victim's security, finances, reputation, etc.
Cybercrime can be carried out by individuals or organizations.
AT U2 lab™, we classifiy cybercrime activities in four main categories:
Fraud;
Theft;
Extortion & harassment;
Others;
One (or more) categories and/or sub-categories might be applicable to a particular judicial case.
Fraud
Theft
Extortion & harassment
Others
Fraud
Device fraud: PCs, laptops, tablets, smartphones, email, IoT, cameras, internet, etc.;
Identity fraud: theft and illicit use of personal information;
Advertising fraud: false, misleading advertising, etc.;
Illegal online sales: sale of counterfeit, illegal, prohibited products, etc.;
Theft
Interfere with systems: servers, networks, etc., in a way that causes damage and/or harm to a network;
Malware attacks: viruses, trojans, worms, spyware, etc.;
Phishing: 'social engineering';
Theft of financial information: banking information, cards (debit/credit), etc.;
Theft and/or sale of business information: documents, projects, reports, patents, etc.;
Cyberespionage: illicit access by cybercriminals to business information;
Intellectual property: copyright infringement;
Extortion & harassment
Cyberbullying: online harassment, calls, messages, posts on social networks, etc.;
Device as a tool: use of someone else's device to carry out a cyber attack;
Cyberextortion: the cybercriminal demands money in order to stop an attack;
Ransomware: data hijacking; the cybercriminal demands a ransom to free the data;
Others
Cyberterrorism: cyberattacks on critical infrastructure, etc.;
Cryptojacking: the cybercriminal mines cryptocurrencies using other people's resources;
Illegal betting: prohibited online betting, without a license, etc.;
Cybersex trafficking: illegal online sexual services;
Obscene or offensive content: comments, images, photos, videos, etc.;
Child pornography: request, create, possess and/or distribute;
U2 lab™'s ' Computer Judicial Expert' service includes:
Study of the case: preliminary study, including topic or issue, intervening parties, jurisdiction, current status (what phase it is in), evidence, testimonies, feasibility, etc.;
Search for a lawyer: for the client, expert in the specific type of judicial case, in case the client has not yet contracted the services of one;
Meeting/s: face-to-face and/or virtual, with the client and the lawyer, in order to assess legal aspects relevant to the Judicial Expert's Report, in particular the 'defence strategy', legal arguments in favour (and possibly, counterarguments) of the client, etc.;
Guidance & assistance: permanent communication and information-sharing with all parties involved in the judicial case (client, lawyer, paralegal, Justice Administration, etc.), keeping the client informed at all times on the status of the case, procedures, relevant dates, etc. (all related to the judicial expert's intervention in the judicial case and in close cooperation with the lawyer);
Judicial Expert's Report (elaboration): elaboration of 'U2 lab™'s Judicial Expert's Report', based on all the evidence made available to U2 lab™ by the client and/or the lawyer. The Judicial Expert's Report is frequently granted heavy weight by Judges and/or Courts and might play a key role in the judicial case;
Judicial Expert's Report (ratification): ratification of 'U2 lab™'s Judicial Expert's Report' before the Judge or Court, answering all the questions posed by all parties (judge's, prosecutor, client's lawyer, other party's lawyer, etc.);
Post-trial follow-up: permanent communication with the client and the lawyer after the trial, up until the issuance of the sentence, and beyond (if needed);
Study of the case
Search for a lawyer
Meeting/s
Guidance & assistance
Judicial Expert's Report (elaboration)
Judicial Expert's Report (ratification)
Post-trial follow-up
✅ Tell us your case or project! At U2-LAB™ we help you with everything you need!
✅ Free, no-obligation quote!
GUIDE ON COMPUTER EXPERTISE
INDEX
COMPUTER EXPERTISE
OBJECTIVE OF THE COMPUTER EXPERTISE
COMPUTER EXPERT
BASIC QUESTIONS THAT A COMPUTER EXPERT SHOULD BE ABLE TO ANSWER
FUNCTIONS OF THE COMPUTER EXPERT
NEED FOR A COMPUTER EXPERT
NEED FOR COMPUTER EXPERTISE SERVICES
FUNDAMENTAL DUTIES OF A COMPUTER EXPERT
COMPUTER EXPERT PROFILE
COMPUTER EXPERT TRAINING
REQUIREMENTS OF A COMPUTER EXPERT
TASKS OF A COMPUTER EXPERT
TYPES OF ACTIONS OF A COMPUTER EXPERT
COMPUTER EXPERIENCE
CHAIN OF CUSTODY
TYPES OF PROCESSES IN WHICH A COMPUTER EXPERT INTERVENES
AREAS OF FORENSIC COMPUTING
AREAS OF PERFORMANCE OF A COMPUTER EXPERT
TYPES OF CASES OF A COMPUTER EXPERT
COMPUTER CRIMES INVESTIGATED BY COMPUTER EXPERTS
METHODOLOGY OF COMPUTER EXPERTISE
PHASES OF COMPUTER EXPERTISE
COMPUTER FORENSIC ANALYSIS
COMPUTER EXPERT EVIDENCE
TYPES OF EXPERT REPORT AND EXPERT OPINION
DIFFERENCES BETWEEN A COMPUTER EXPERT REPORT AND A COMPUTER EXPERT OPINION
EXPERT REPORT
EXPERT OPINION
CHARACTERISTICS OF AN EXPERT OPINION
STRUCTURE OF THE EXPERT OPINION
EFFECTS OF THE EXPERT OPINION
PRICE OF A COMPUTER EXPERT REPORT. PRICE OF A COMPUTER EXPERT OPINION
What is computer expertise?
COMPUTER EXPERTISE
Computer expertise is a branch of computer engineering that deals with affirming or refuting a certain fact or event, by carrying out a technical study and using computer techniques and methods. The tasks of the computer expert are based on collecting information and analyzing it in order to prepare an expert report/opinion that serves to construct the opinion of the judge or court.
Computer expertise can also be considered as the specialty of law that is responsible for judicial investigations based on the presentation of evidence extracted from digital media through computer analysis. It is from the study obtained by a judicial expert that the innocence or guilt of one (or several) of the parties on trial will be determined.
Computer expertise is a discipline that was created with the aim of offering support to companies, individuals, courts and tribunals when resolving legal cases in which the analysis of computer evidence is required.
According to article 335.1 of the Civil Procedure Law, “when scientific, artistic, technical or practical knowledge is necessary to assess relevant facts or circumstances in the matter or acquire certainty about them, the parties may contribute to the process the opinion of experts they have, the corresponding knowledge or request, in the cases provided for in this law, that an opinion be issued by an expert appointed by the court."
In these cases, computer expertise is responsible for extracting information from electronic devices with the aim of carrying out forensic analysis, analyzing evidence, drawing conclusions and preparing the relevant reports based on said investigation, for subsequent presentation before a court.
This type of computer expertise is really necessary when misuse of technology has been made and even a computer crime has been committed to extract evidence.
What is the objective of computer expertise?
OBJECTIVE OF THE COMPUTER EXPERTISE
The objective of computer expertise is to analyze a technological event that may have led to a crime in order to, in this way, provide information on what, who, when, how, and why it was carried out.
What is a computer expert?
COMPUTER EXPERT
Most judges do not have the specialized training in computer technology that allows them to know whether evidence provided by a witness is reliable.
So, how can you know if a technological evidence is valid in a judicial procedure? How do lawyers obtain this evidence when presenting it in a trial? Through a judicial computer expert. What they do is ask for evidence accredited by a computer expert.
The computer expert is a judicial expert, whose primary task as a judicial assistant is to advise the judge on issues related to computing.
The computer expert is the person who has carried out studies and research aimed at obtaining computer evidence applicable to a judicial matter so that it can help a judge or court decide on the issue raised.
The function of the computer expert consists of the analysis of computer elements, searching for those data that may constitute useful evidence or clues for the legal dispute to which they have been assigned.
The primary task of the computer expert is to convey to the judge or court his or her knowledge and maxims of experience regarding topics related to computing.
The computer expert is a professional whose aim is to offer complete support to all types of people who require it with the purpose of clarifying a due process or case before the judiciary in which it is necessary to test and analyze computer evidence using an appropriate methodology.
What basic questions should a computer expert be able to answer?
BASIC QUESTIONS THAT A COMPUTER EXPERT SHOULD BE ABLE TO ANSWER
A computer expert must be able to answer the following questions:
What happened?
Who did it?
When did it happen?
How did it happen?
Why did it happen?
What are the functions of a computer expert?
FUNCTIONS OF THE COMPUTER EXPERT
Computer experts are those professionals who offer their services to companies, organizations and individuals, giving them legal support when presenting technological evidence before a court. They are responsible for analyzing the veracity of said evidence and presenting it in a clear and simple way so that it can be understood by a judge.
Computer experts, in addition to judicial channels, can also participate extrajudicially, and act in the different phases of negotiation, and intervene in mediation.
In any case, his main function will be to analyze a technological fact, to elaborate an expert opinion on it, determining whether or not the fact or act that has taken place complies with the rules by which it must be governed.
In addition to these functions, computer experts may also perform other functions of a different type, such as giving an account of their knowledge and the maxims of experience of their profession to lawyers, so that they can advise the client whether to formulate the corresponding claim or not, and in that case, properly substantiate it; elaborate computer experts and ratify them before the judge, if this is necessary; prepare counter-expertise, in the event that an expert report has been presented by the other party that is imprecise or incorrect, etc.
Thus, computer experts:
They advise lawyers, both in the prosecution and defense strategy in which digital evidence is involved.
They intervene, preserve, document and study digital evidence to prepare detailed expert reports.
They provide well-founded opinions to the courts of justice on disputed points.
They go to the courts of justice to clarify their work and subject them to contradictions by the parties.
Why is a computer expert necessary?
NEED FOR A COMPUTER EXPERT
Digital evidence can be modified and leave no trace of its modification. For this reason, the impartial assessment of the computer expert is necessary. Otherwise the evidence may be challenged and even invalidated.
Having the testimony of a computer expert can be of great help, since in most cases and processes, given their great variety in terms of scopes and areas of action, the judge does not always have the necessary knowledge of the maximum experience to be able to solve.
In any case in which technology plays a key factor in a trial, we will probably have to resort to computer expertise.
When are computer expert services needed?
NEED FOR COMPUTER EXPERTISE SERVICES
Computer expertise should be used in all cases in which it is suspected or certain that the digital evidence provided has been modified in favor of one of the two parties in a trial.
It is very useful in the event that there has been inappropriate use of technology, a security breach has occurred in a computer system, or the computer media has been the vehicle for the commitment of a crime.
What are the duties of a computer expert?
FUNDAMENTAL DUTIES OF A COMPUTER EXPERT
Accept the assigment (in the case of a judicial assignment), collaborate with the rest of the experts or technical consultants and testify before the judge if the judge requires it.
Substantiate his technical conclusions, clearly expressing the elements analyzed and the techniques used to reach them.
Respect the code of ethics imposed by his profession.
What profile should a computer expert have?
COMPUTER EXPERT PROFILE
The computer expert must have a definitively technical profile, and it is vitally important that the expert is familiar with data analysis and recovery techniques. It is important to highlight that the computer expert is a technology expert who handles the entire computer area.
As an additional element, the computer expert must have extensive legal knowledge (especially in the area of civil and criminal law) that allows him to carry out his task without it being disqualified or challenged during his judicial presentation.
Computer experts must not only analyze the case from a computer perspective (identifying sources, recovering documents, analyzing traces of activity, constructing chronologies, etc.), but, as experts, they must also do so from a legal perspective, when the assignment requires relating what is the object of one's knowledge with the norms that regulate it.
Given the complexity of some issues, computer experts must not only be able to resolve and analyze the facts, but also be able to explain them and make them clear.
The computer expert also has the ability to offer advice and support, both to individuals, SMEs and large organizations, when it is necessary to collect evidence in the field of computing, telecommunications, etc.
What training should a computer expert have?
COMPUTER EXPERT TRAINING
A computer expert needs training both in the technical aspect (electronic communications, cybersecurity incidents, etc.) and in a more technical-legal aspect, to face an oral trial or the evaluation of evidence by a court.
But that is not enough, since, given that technology is constantly changing and evolving, computer experts must remain in continuous training to adapt to any change.
Examples of novel and/or rapidly changing areas of knowledge are cybersecurity, AI (artificial intelligence), the metaverse or quantum computing.
What are the requirements of a computer expert?
REQUIREMENTS OF A COMPUTER EXPERT
Have a degree or certification that validates it in computer engineering, telecommunications, etc.
Have specific, specialized and updated training according to his field of action.
Master forensic analysis.
Possess legal knowledge.
Know how to prepare expert reports.
Possess planning skills, communication skills, etc.
What are the tasks of a computer expert?
TASKS OF A COMPUTER EXPERT
The tasks to be carried out by the computer expert are not different from those of other judicial experts.
The computer expert must compile the information that is made available to him, analyze it in search of the data that the judge, the Public Prosecutor's Office or the defense or accusation lawyer have requested, and issue a report or opinion in which he reflects the conclusions of the research carried out.
Inspect, safeguard, document and/or analyze digital evidence.
Conclude whether a fact or event has undoubtedly occurred or not based on the evidence intervened and the knowledge of the expert.
Prepare, write and present the computer expert report, as well as explain it in oral proceedings.
Additionally, one of the main functions of the computer expert is the preservation of the chain of custody of computer evidence.
What type of actions does a computer expert perform?
TYPES OF ACTIONS OF A COMPUTER EXPERT
Provide technical and legal advice in relation to cybercrime.
Collect evidence regarding computing and telecommunications.
Monitor possible conversations on WhatsApp and other social networks and IM applications.
Detect possible electronic counterfeits.
Audit the security programs and elements that a company or individual has.
Perform penetration tests on a system.
Know how to recover all types of information deleted intentionally or accidentally.
Recover damaged data, files, documents, reports, etc.
Detect how some information was stolen, such as passwords, confidential data, etc.
Participate in arbitration and mediation of disputes within the framework of computing and telecommunications.
Assess and appraise computer damage that may have occurred.
Prepare expert reports, both judicial and extrajudicial.
What is a computer counter-examination?
COMPUTER COUNTER-EXAMINATION
Sometimes it may happen that the computer expert must carry out a computer counter-examination, that is, an exhaustive examination of his work in order to analyze errors in the methodology used by the other party's expert: failures to preserve digital evidence, breaking the chain of custody, or errors of assessment or interpretation when reaching conclusions. In these cases, the other party's expert report would lose its value and the expert could face civil and criminal liability for incompetence.
What is chain of custody?
CHAIN OF CUSTODY
One of the keys that a computer expert must fulfill is to guarantee the chain of custody, integrity and its validity as evidence in court, if required.
The chain of custody ensures that computer evidence remains unaltered from the moment the evidence is identified and acquired until it is analyzed in the laboratory.
What types of processes does a computer expert intervene in?
TYPES OF PROCESSES IN WHICH A COMPUTER EXPERT INTERVENES
A computer expert has the training to be able to intervene in any type of process, whether in a labor, civil, criminal, commercial, fiscal, family, violence against women, minors trial, etc.. That is, a computer expert must know all the different branches of law.
In general, in any process in which you want (or must) provide evidence of a computer nature, you must have a computer expert to carry out a computer expert report and for this evidence to be valid.
What are the areas of computer forensics?
AREAS OF FORENSIC COMPUTING
The areas of action of computer forensics are the following:
Computer forensics. Tools and procedures are used, electronic media and devices are analyzed to extract any type of information that may be useful for the case.
Expert report. Based on the forensic analysis and evidence, the evidence is formalized into an opinion that will be used in the judicial process.
Electronic evidence. Guarantee the chain of custody with all technical and legal guarantees. Retrieve and store electronic documents that can be used in the judicial process.
Computer audit. The analysis and diagnosis of organizational security systems is carried out, seeking to identify vulnerabilities in information systems. Software and hardware functionalities are also analyzed to verify compliance with specifications.
Data Protection. Comply with the rights related to personal data and privacy, in addition to explaining the various security measures applicable to the data.
Telecommunications. Cases related to the internet, social networks and mobile phones: cyberbullying, fraud, identity theft, security, privacy, etc.
What are the areas of action of a computer expert?
AREAS OF ACTION OF A COMPUTER EXPERT
Industrial/intellectual property.
Espionage.
Revelation of secrets.
Access or copy of company files, plans, formulas, costs, etc.
Information leaks through digital media.
Unfair competition from an employee.
Violation of privacy.
Telecommunications interception.
Illegal reading of emails, social networks, etc.
Illegal wiretapping of telephone conversations.
Dismissal for technological reasons.
Valuations and appraisals of computer assets (equipment, devices, software, etc.).
Protection of personal data and reserved data of legal entities.
Empowerment and distribution of private data.
Manipulation of data or programs.
Hardware, networks and components (all systems).
Turnkey installations and developments.
Infringement of contractual good faith.
False advertising, unfair competition.
Economic, monetary and corporate crimes.
Crimes against the market or against consumers.
Crimes against intellectual property.
Use of unlicensed software.
Piracy.
Unauthorized copying and distribution of computer programs.
Sabotage: damage through the destruction or alteration of data.
Scams, fraud, conspiracy to alter the price of things, etc.
Improper use of computer equipment: damage or abusive use.
Artificial intelligence (AI) crimes: generation of images, audios, videos, identity theft, etc.
Cyberbullying.
Violence against women (workplace harassment, sexual harassment, etc.).
Child pornography: creation, editing, access, possession, dissemination, etc.
What types of cases does a computer expert handle?
TYPES OF CASES OF A COMPUTER EXPERT
Cases of espionage, revelation of secrets or violation of industrial property.
Crimes against intellectual property.
Illegal intrusions into a person's privacy.
Illegal access to company documents or files.
Unfair competition by an employee.
Dismissals due to inappropriate use of technology.
Interception of communications.
Valuation and appraisal of goods or technological products.
Protection of sensitive personal data or legal data.
Dissemination of private or reserved data.
Illegitimate access or manipulation of software.
Illegitimate use of servers, hardware, networks or computer systems.
Damage to computer equipment caused by abusive use.
Economic crimes carried out through computer means.
Crimes against consumers or the market carried out through computer means.
Use, copying and distribution of unlicensed programs (piracy).
Scams and fraud through digital media.
Creation, editing, access, possession and/or dissemination of child pornography.
What type of crimes does a computer expert investigate?
COMPUTER CRIMES INVESTIGATED BY COMPUTER EXPERTS
Phishing: This technique deceives us, above all, through fraudulent emails, but also through false web pages or even phone calls that request personal data that cybercriminals will copy and use to steal from us. This type of scam is based on the so-called “social engineering”, based on which cybercriminals try to gain our trust, as a prior step to the attack. It is a widely used technique since it is easier to carry out than other malicious techniques. Human failures (overconfidence, naivety, lack of training, etc.) are the weakest “link” in the cybersecurity chain.
Malware: Malware (malicious programs) aims to infect and/or damage electronic devices. The consequences of a malware infection range from the theft of private information, espionage or complete blocking of access to our infected device. Malware can come in various forms, such as viruses, trojans, spyware or worms.
Viruses: Viruses usually come in formats that we would not usually suspect: pdf files, image files, video files, programs, links, etc., which once we open, infect the device and render it useless.
Worms: The danger of worms is that from the same network, they can move to other devices and infect them. Unlike viruses, worms are autonomous, so they do not need human intervention to operate.
Trojans: This type of malware is used by cybercriminals to access devices. Normally they will come camouflaged in the form of applications or programs that we would not suspect but that when executed would release the malware and allow access to hackers, who would have free rein to review all our files, use the resources of our computer or device, etc. .
Obstruction of access or denial of service (DoS): The denial of service (Denial of Service - DoS) attack aims to block systems, equipment, devices, websites, e-commerce sites, online platforms, online tools, applications, etc., with the purpose of blocking the activity or service for which it is intended. What happens with this type of cyber attack is that, with the simultaneous connection of several users, the server collapses, slows down and even crashes, ceasing to respond or disconnecting from the network.
Spyware: By sending spyware, cybercriminals seek to gain access to confidential information, whether banking details, passwords, confidential files, etc. The characteristic of this malware is that while it is secretly recording information, our devices do not detect it and it remains hidden. Meanwhile, the cybercriminal can be found recording everything we write, he can take screenshots of our screen, record audio or videos, control our device remotely, etc.
Cyberbullying: Cyberbullying seeks intimidation, humiliation, and the feeling of constant threat in its victims. This type of cybercrime psychologically harasses the people who suffer from it. The most common types of cyberbullying suffered by victims of this type of cybercrime are the spread of lies and hoaxes about themselves, the spread of compromised photographs or videos online, the continued receiving of threats or hurtful messages through social networks. or instant messaging applications.
Ransomware (cyberextortion): In this type of extortion, the victim receives malware that infects their computer, leaving it unusable. Subsequently, the cybercriminal will ask the victim for a ransom (sum of money) so that they can recover all their files. We can also call cyberextortion the blackmail that victims receive by threatening to use their private information, compromised photos or videos if a sum of money is not paid.
What does the methodology of computer expertise consist of?
METHODOLOGY OF COMPUTER EXPERTISE
In order to carry out a computer expert adequately, computer experts will need to use the tools and methods that are applicable to each case.
Identification: individualization of each of the computer evidence in the scenario.
Acquisition: compilation of all the information of each of the evidence, without using intrusive means, that is, without altering the original evidence.
Preservation: maintenance of the custody of the evidence, calculating the summary function, unique signature or “hash”, for each of the files that make up the evidence, or for the set of files that make up the evidence.
Analysis: carrying out the study and forensic investigation of each of the evidence acquisitions.
Presentation and defense: writing of the computer expert report that will contain the complete computer forensic analysis and the conclusions obtained.
What are the phases of computer expertise?
PHASES OF COMPUTER EXPERTISE
Analysis of the expert context and situation.
Analysis of technical documentation.
Understanding and evaluation of the assignment.
Technical advice to clients and lawyers.
Determination of feasibility and possibilities of success.
Preparation (elaboration and writing) of the expert report, expert opinion or counter-expertise.
Valuation and/or appraisal of computer intangibles.
Presentation of the expert opinion in a simple, understandable and solid way.
Ratification of the expert report, expert opinion or counter-expertise in court in a clear and concise manner before the court or judicial authority.
What is computer forensics? What types of computer forensics exist?
COMPUTER FORENSIC ANALYSIS
Forensic analysis of physical devices (hard drives, USB sticks, etc.)
Recovery of deleted data from any physical device (hard drives, USB sticks, etc.)
Email recovery.
Recovery of messages and content from mobile devices.
Recovery of messages and content from social networks and IM applications (WhatsApp, Facebook, etc.).
Internet trace analysis.
Elimination of traces on the internet.
Secure erasure of information.
Analysis of computer files to determine their integrity or manipulation (documents, photographs, audios, videos, etc.).
Forensic analysis of emails to determine their integrity or manipulation.
Forensic analysis of messages on social networks, platforms, online tools, etc., to determine their integrity or manipulation.
Forensic analysis of printed documents.
Forensic analysis of digital signature.
What is computer expert evidence?
COMPUTER EXPERT EVIDENCE
Computer expert evidence consists of the preparation of an expert report (scientific and technological) that, through forensic analysis, shows evidence to blame or prove the innocence of one of the parties involved in a judicial procedure.
Its veracity will allow the case being investigated to be brought to an expert (or final) opinion.
In other words, computer expert evidence reveals data obtained through computer forensic techniques, issued by an expert engineer.
The computer expert evidence serves to support the evidence of the expert witness, who will be questioned during the hearing or trial, in case of ratification.
What types of expert report exist? What types of expert opinion exist?
TYPES OF EXPERT REPORT AND EXPERT OPINION
The Civil Procedure Law (LEC) contemplates 2 types of computer report/expert opinion from computer experts:
The computer report/expert opinion issued at the request of a party by experts appointed by the court or tribunal;
The computer report/expert opinion prepared by experts appointed by the parties extrajudicially;
What is the difference between an expert report and an expert opinion?
DIFFERENCES BETWEEN A COMPUTER EXPERT REPORT AND A COMPUTER EXPERT OPINION
While the computer expert report focuses on the detailed and exhaustive description of the results of an investigation, the computer expert opinion focuses on issuing a specialized technical opinion on specific aspects of the case.
When you have the services of an expert, the first thing you must decide is whether you need an expert report or an expert opinion.
The differences between an expert report and an expert opinion are not many, but they are significant enough to affect the resolution of the process.
In fact, the computer expert himself can advise you if, in your specific case, one document or another is better.
In general, the more complex the issue to be discussed, the more interesting it will be to request an opinion and not a report, because it will help the judicial authority to better understand the matter by having the opinion of an expert on the subject.
What is an Expert Report?
EXPERT REPORT
An expert report consists of a written and reasoned presentation in which a professional expert in a subject (computer expert) details in a concise manner the observations on the subject that has been the object of his or her study.
The purpose of the expert report is to help the judicial authority get an idea about matters in which it does not have to be an expert, always using language that is clear and simple, so that it can be understood by those who are not knowledgeable on the subject matter.
The report is a means of proof that requires the intervention of a third party (the expert) who is unrelated to the process and totally independent and objective.
The expert report is as neutral and objective as the expert opinion, but the difference is that the expert exposes or argues a series of facts without issuing his assessment as a professional, which does occur in the opinion.
That is, in the expert report there is no professional assessment by the computer expert.
What is an Expert Opinion?
EXPERT OPINION
An expert opinion consists of a written and reasoned presentation in which a professional expert in a subject (computer expert) details in a concise manner the observations and assessments on the subject that has been the object of his or her study.
The purpose of the expert opinion is to help the judicial authority get an idea about matters in which it does not have to be an expert, always using language that is clear and simple, so that it can be understood by those who are not knowledgeable on the subject matter.
The expert opinion is a means of proof that requires the intervention of a third party (the expert) who is unrelated to the process and totally independent and objective.
The expert examines the object or person, performs a series of tests or analyzes and, based on them, issues his expert opinion.
What are the characteristics of an Expert Opinion?
CHARACTERISTICS OF AN EXPERT OPINION
It must be objective.
It has to be precise and concise.
It avoids absolute and categorical statements, but also avoids inaccuracies or ambiguities, because it tries to be as clear and concise as possible.
It sticks to what the professional has been asked about.
The explanation is structured in a logical and easily understandable order.
It may incorporate complementary material, which can be added if necessary in the form of annexes (documents, audios, images, graphs, photographs, videos, databases, etc.).
What are the parts of the expert opinion? What does an expert opinion contain? What is the content of an expert opinion? What is the structure of an expert opinion?
STRUCTURE OF THE EXPERT OPINION
Cover: includes the title (subject discussed in the document), petitioner, date of issue, reference number (of the expert opinion) and author of the expert opinion.
Author: name, surname, qualification(s), professional association(s), specific training, lists of judicial experts, contact information and seals.
Official powers and legitimacy: legal capacity of the expert to carry out the expert opinion, based on his qualifications, training, etc.
Declaration of blemishes: absence of conflict of interest between the judicial expert and the parties (both: accusation and defense), no personal interest in the matter (or similar matters), etc.
Oath or promise: to tell the truth.
Index: index of contents, including sections and subsections.
Object: that is, the topic on which the opinion deals.
Scope: that is, the scope or extension covered by the opinion.
Background: facts prior to the examination and the current state of the object or person examined, all presented in a schematic way.
Preliminary considerations: issues for prior consideration.
Methodology: description of the methodology used (methods, techniques, tests, tools, etc.).
Bibliography: list of all useful publications (books, e-books, specialized magazines, websites, blogs, reports, etc.).
Terminology and abbreviations: glossary, including a definition (and explanation where appropriate) of all specialized terms (scientific, technological, etc.), as well as acronyms.
Technical analysis: describing the techniques, analysis procedures followed, methods, tools used and tests performed.
Conclusions: they try to establish a causal relationship between what was observed and the matter that is the object of the process; they must be numbered; each conclusion must be identifiable by a unique identifier (e.g. a number).
Final conclusion: global conclusion, summary of previous conclusions.
Opinion: assessment and professional opinion of the expert.
Final notes: final clarifications.
Annex/es: all documentation that may be important: documents, images, photographs, audios, videos, reports, etc. This is information that supports the conclusion reached by the expert.
Place: of issue.
Date: of issue.
Signature: of the computer expert (preferably, electronic signature); it is highly recommended that the date of the electronic signature coincides with the date of issue.
These are the parts that must be included in the expert opinion, but what is not required in our legal system is a specific requirement on the form that this document must have.
What are the effects of the expert opinion?
EFFECTS OF THE EXPERT OPINION
If the expert opinion meets all legal requirements regarding the characteristics and parts that are required, it will be considered completely valid evidence.
However, it must be taken into account that the expert's opinion is not binding on the judge.
The judicial authority will examine the expert opinion and decide to what extent the information contained therein is relevant when making its decision.
How much does a computer expert report cost? How much does a computer expert opinion cost?
What is the price of a computer expert report? What is the price of a computer expert opinion?
What is the cost of a computer expert report? What is the cost of a computer expert opinion?
How much does a computer expert earn? What is the fee for a computer expert?
PRICE OF A COMPUTER EXPERT REPORT. PRICE OF A COMPUTER EXPERT OPINION.
The fees of a computer expert depend (or should depend) on several factors:
Degree of complexity of the case;
Complexity in obtaining the evidence to be analyzed;
Number of pieces of evidence to be analyzed;
Volume of evidence to be analyzed;
Complexity of the evidence to be analyzed;
Number of parties involved in the case/judicial procedure;
Number of meetings necessary (with clients/lawyers, etc.);
Number of trips to attend face-to-face meetings;
Number of trips to court;
Time dedicated to the case/judicial procedure;
Request (or not) for ratification of the expert report/expert opinion in court;
If the ratification of the expert report/expert opinion is carried out electronically (videoconference/WEBEX) or in person at the court;
If the client requires (or not) extensions of a previously issued expert report/expert opinion;
Etc.
Each case, like each client, is different and unique.
At U2 LAB - Smart Tech Solutions™ we always offer our clients a free no-obligation quote and very competitive prices.
✅ Tell us your case or project! At U2-LAB™ we help you with everything you need!
✅ Free, no-obligation quote!