The IT technical consultant

The IT technical consultant establishes the digital facts a dispute turns on: securing them, analysing them by a verifiable method, and setting them out in a form that holds up under challenge.

What the role involves in practice

The work runs on three levels, which in practice overlap.

Before proceedings, or at the outset. Reading the technical facts and saying whether they hold. This is the most valuable stage and the most often skipped: knowing in advance that a log is kept for only thirty days, that a record has been overwritten, or that a given examination would produce an ambiguous answer changes the strategy — and sometimes counsels against bringing the claim at all.

During the expert operations. Where the judge orders a technical examination, the consultant attends the operations, observes how data is collected and handled, raises objections at the moment they matter — on the record, at the time, not afterwards — and files written observations on the draft report. A great many of the criticisms that fail on appeal are criticisms nobody made when they could have.

In drafting. Translating the technical fact into a form a non-technical judge can work with, and putting counsel in a position to ask precise questions at the hearing. A report the judge cannot follow is a report that does not help, however correct it may be.

In civil proceedings

The Italian Code of Civil Procedure provides for technical consultancy wherever a question calls for specialist competence: the judge may order a technical examination, and each party may be assisted by its own technician in the process (arts. 61, 191 and 201 of the Code of Civil Procedure).

Technical input is also useful before and independently of all that: to assess whether an examination is feasible at all, to draft the questions to be put to the court, to weigh a settlement proposal against what could technically be proved. In proceedings where the evidence is digital, poorly drafted questions are a recurring problem: a question asking «whether the messages are authentic» yields a far weaker answer than one asking which technical features are consistent, or inconsistent, with a stated origin.

In criminal proceedings

The Italian Code of Criminal Procedure distinguishes two situations. Where the judge orders an expert report, technical consultants attend the giving of the instruction and the operations (art. 225 c.p.p.). Outside those cases, independent technical examinations may still be carried out, within the statutory limits (art. 233 c.p.p.).

In criminal matters timing weighs more heavily than anywhere else. Non-repeatable technical operations and acquisitions carried out in the immediate aftermath can be observed only once: if no technician is present at that moment, whatever was not recorded does not come back. Law 48 of 2008, which ratified the Budapest Convention, also requires that the acquisition of computer data adopt technical measures ensuring the preservation of the original data and preventing its alteration. It is the point on which technical input tells to greatest effect — but the objection has to be made while the acquisition is happening.

When to bring one in (and when it is too late)

• As soon as a dispute is foreseeable. That is when the data still exists and can be secured. Server logs, cloud access records and device histories have retention windows measured in weeks.
• Before filing digital documents. A document filed badly is hard to rescue: if the screenshot is challenged, redoing it properly months later is often no longer possible.
• Before the hearing at which the expert instruction is settled. That is where the questions are framed, and where technical input pays best.
• Late, but not pointless: after a technical report has been filed. Critical observations remain available, but one is working on material already shaped by someone else.

How the instruction is given

In practice: counsel — or the client directly — writes to me with a short account of the matter and of what has to be proved. I reply with a first assessment: whether the technical route exists, what data is needed, how long it would take. That stage is not charged. If the matter proceeds, the quotation is in writing and states scope, activities, timing and fees.

On confidential matters we move to certified email or an agreed channel before going into the substance: the website form is a first point of contact, not a secure one.

To get oriented on the method and the costs: how a forensic examination runs → · how much a digital forensics report costs →