Daubert standard

Definition#

The Daubert standard is the rule federal courts apply to decide whether an expert may testify. Under Daubert v. Merrell Dow Pharmaceuticals and Federal Rule of Evidence 702, the trial judge acts as gatekeeper: expert testimony is admitted only if it rests on reliable principles and methods, those methods are reliably applied to the facts, and the testimony will help the trier of fact. The court assesses the method, not the outcome — "the focus, of course, must be solely on principles and methodology, not on the conclusions that they generate" — so an expert can reach a conclusion the judge finds unpersuasive and still be admitted, because the correctness of the opinion is for the jury.

The five Daubert factors#

The Supreme Court identified the following considerations, in the Court's own terms:

1. Testing — whether the theory or technique "can be (and has been) tested."
2. Peer review and publication — whether it "has been subjected to peer review and publication."
3. Error rate — "the known or potential rate of error" of the technique.
4. Standards — "the existence and maintenance of standards controlling the technique's operation."
5. General acceptance — whether the technique has attracted general acceptance in the relevant community, which "can yet have a bearing on the inquiry."

The Court added that "the inquiry envisioned by Rule 702 is, we emphasize, a flexible one." The factors are guidance, not a checklist, and not every factor applies to every field.

Rule 702 after the 2023 amendment#

Rule 702 now provides that a qualified expert may testify "if the proponent demonstrates to the court that it is more likely than not that" (a) the expert's knowledge will help the trier of fact, (b) the testimony is based on sufficient facts or data, (c) it is the product of reliable principles and methods, and (d) "the expert's opinion reflects a reliable application of the principles and methods to the facts of the case."

Two things changed in 2023. The preponderance standard — "more likely than not" — was written into the rule's text, because, in the Advisory Committee's words, "many courts have held that the critical questions of the sufficiency of an expert's basis, and the application of the expert's methodology, are questions of weight and not admissibility. These rulings are an incorrect application of Rules 702 and 104(a)." And subsection (d) was amended "to emphasize that each expert opinion must stay within the bounds of what can be concluded from a reliable application of the expert's basis and methodology." A sound method applied carelessly, or stretched past what the data supports, is now squarely a gatekeeping question rather than a matter of weight.

Kumho Tire: gatekeeping reaches technical experts#

Daubert concerned scientific evidence. Kumho Tire v. Carmichael held that the gatekeeping obligation "applies not only to testimony based on 'scientific' knowledge, but also to testimony based on 'technical' and 'other specialized' knowledge," while confirming that the test is flexible and that the Daubert factors "neither necessarily nor exclusively" apply to every expert or every case. A digital forensics examiner's methods therefore face the same scrutiny as a toxicologist's, and a court may weigh the factors differently for each.

Daubert versus Frye#

Before Daubert, federal courts applied Frye v. United States (D.C. Cir. 1923), which asked one question: whether the method was generally accepted in the relevant field. Daubert held that the Federal Rules of Evidence superseded Frye and made general acceptance one factor among several. Every federal court applies Daubert; many states have adopted it or a close variant, and a minority of states still apply Frye or a Frye-derived test. In a Frye jurisdiction the fight is over whether the method is accepted; in a Daubert jurisdiction it is over whether this expert applied a reliable method reliably to these facts — a broader and more fact-specific attack.

How digital forensics testimony is attacked under each factor#

Digital forensics sits comfortably within Daubert when the work is done properly, because the discipline's core methods are testable and tested, published, validated and widely accepted. Successful challenges are therefore rarely attacks on the field; they are attacks on the engagement, and they map onto the factors:

• Testing. Was the acquisition verified? A hash value recorded at acquisition and confirmed before analysis, and a forensic image another examiner can re-examine, answer this in a sentence. Work done on the original device, or from screenshots, cannot be re-tested.
• Peer review and publication. The methods should be the documented ones — NIST's forensic guidance, SWGDE best practices, the published literature — not an examiner's own script. A novel technique needs its own foundation.
• Error rate. Forensic tools are validated: NIST's Computer Forensics Tool Testing programme publishes test reports on imaging, deleted-file recovery and mobile acquisition tools, and SWGDE's practice documents require tools to be tested and validated before use. An examiner who cannot say what the tool was validated for, or who treats deleted-data recovery or timestamp interpretation as error-free, is exposed here.
• Standards. Chain of custody, write-blocked acquisition, contemporaneous notes and a report that states the steps taken are the standards that control the technique's operation. Gaps in handling are the most common standards attack.
• General acceptance. Mainstream tools and methods clear this factor easily. The attack is usually that acceptance of the tool is not acceptance of the inference drawn from its output — which brings the challenge back to Rule 702(d).
• Fit and overreach under 702(d). The most common and most avoidable. An examiner who testifies that artifacts show a user copied files is on solid ground; one who testifies that the user intended to steal them has left their expertise and given the other side a clean target.

Building the report for the challenge#

The practical defence is written into the report before anyone objects: the tools and versions used, the acquisition and verification steps, the artifacts relied on, and the limits of what the analysis can establish. An expert who says plainly what the evidence cannot show is far harder to impeach than one who claims more than the artifacts support. For the challenger's side of the same problem, see how to challenge the other side's forensic expert and what makes digital evidence admissible.