Certifications That Mean Something
Look for examiner-level certifications from bodies that test practical competence — IACIS’s CFCE (computer forensics) and ICMDE (mobile devices) are the widely recognised benchmarks, requiring supervised practical examination and ongoing recertification, not just course attendance. Tool-vendor certificates show training on a product; they are not equivalent to independent certification.
Courtroom Experience, Not Just Lab Experience
Many competent examiners have never testified. Ask directly: in which jurisdictions and matter types has the expert given written and oral evidence? Have their reports survived challenge? An expert who has been cross-examined understands what a report must contain — and what loose language costs — in a way no lab-only CV demonstrates.
Independence You Can Point To
The expert’s duty is to the court. That is easier to establish when the expert is genuinely independent — not the client’s IT provider, not a firm with a stake in the outcome, and willing to tell you early when the evidence does not support your theory. Ask how often they have reported findings adverse to the instructing party; the honest answer is "regularly".
Methodology and Tooling
The expert should work with court-accepted tools, follow documented and repeatable procedures aligned to recognised standards (ISO/IEC 27037, ACPO principles), and be able to explain — in plain English — how every finding could be independently verified. If the methodology cannot be explained simply, it will not survive the witness box.
Who Does the Actual Work
In larger practices, the name on the report and the hands on the evidence can be different people. Confirm the certified expert personally conducts or directly supervises the examination and writes the report they will defend. At Foren6ix every engagement is led personally by our principal examiner — the person in the witness box is the person who did the work.