An affidavit can be a vital tool in any type of investigation, whether the investigation be forensic, internal, criminal, regulatory, incident response or otherwise. As an investigator gathers facts, he will often interview witnesses, and obviously the investigator is wise to make records of the interviews (written notes or even audio/video records). But sometimes it is prudent to take an additional step in securing what a witness has to say.
I recently advised an investigation where numerous witnesses had much to say. But as I assessed all that was being said, a particular statement of one certain witness stood out as crucial to the outcome of the case. I recommended that witness record her statement in an affidavit.
An affidavit is a formal, written document that memorializes a declaration of facts by a witness. The preparation and execution of an affidavit can help to lock down a complete and careful statement of what the witness has to say. An affidavit takes time, so often an investigator reserves affidavits for only the most critical witness testimony.
There is no single or perfect way to draft an affidavit. Essentially, an affidavit identifies the witness, states that she attests to certain facts, concludes with her signature and shows that she affirmed her statement before a notary public. Here is a simple example:
==
State of Texas
County of Dallas
AFFIDAVIT OF JANE H. DOE
I am Jane H. Doe, Network Administrator at XYZ Corp. I attest that on September 30, 2010, at approximately 10:30pm, I witnessed Sarah Smith pick up the computer that had been on her desk and carry it out the door of the offices of XYZ Corp.
Date: December 3, 2010
Signed: /s/ Jane H. Doe
This instrument was acknowledged before me on December 3, 2010, by Jane H. Doe.
(Notary Public's Seal) (Notary Public's Signature)
==
Why is an affidavit more substantial (and possibly reliable) than notes or even audio/video of the witness's testimony? An affidavit is an official-looking document. When it is presented to the witness, the witness can see she needs to be careful and deliberate with her words. She senses she may suffer repercussions if the affidavit is false. She can read the words, think about them, edit them and correct any errors. She can consult a third party (possibly the investigator or an attorney) about the meaning and completeness of the words. The witness becomes emotionally attached to the words and is less likely to present a different memory of the facts some time in the future.
The affidavit stores the witness's testimony in case she becomes unavailable in the future. The notary confirms the witness's identity (checks identification card) and confirms that the witness appears to be of sound mind, acting voluntarily, as she signs the document.
When the affidavit is taken, the events are fresher on the witness's mind than they might be at, say, a trial two or three years later. The affidavit can be more accurate than the witness's future memory.
Is an affidavit admissible as evidence in a lawsuit? That depends. An affidavit is often considered hearsay. Rather than accept hearsay, a trial court normally prefers to have the witness appear on the witness stand, state her testimony live in court and be subject to cross examination. However, under any number of scenarios an affidavit might be used in court. When the witness gives testimony at trial, she can refer to the affidavit to refresh her memory. Or, if the witness's testimony contradicts the affidavit, the affidavit can be introduced to impeach (discredit) the witness. Thus the affidavit helps to prevent wandering or shifting testimony.
An affidavit can have other uses as well. It might be admitted as evidence in a hearing before a regulatory body, where the preference against hearsay evidence does not apply. It might also serve as evidence that the investigator and/or his employer conducted a thorough, competent investigation and then acted responsibly based on the outcome of the investigation.
Benjamin Wright, Attorney, teaches the law of data security and investigations at the SANS Institute.
.jpg "1245x705_FREE_DFIR-Summit_(1).jpg")
