Computer Forensics

Computer Forensics

Computer forensics is hardly a new science to the world of technology. The ability to recover data from hard drives and tapes in most any condition is even recognized in the court room. More recently attorneys and litigation support are faced with the question of when to use it and when to use it.

Unless the firm is willing to put their own technical staff on the stand, it may be worth the cost to use a computer forensics investigator to turn the "smoking gun" hard drive into a database.

The Operations Manual provides steps, strategies and guidance when possible. The choice of whether or not to use computer forensics investigators is one only the attorney can make. Whether the litigation support department can do anything beyond vendor relations and project management as regards computer forensics is a decision the firm should make.

Irrespective of the source or format of discovery, the Operations Manual shows what approaches to take for minimizing the quantity of discovery for review. When the vendor delivers their product, the technical specifications and organization of the resulting database will match the firm standard. The goal is to get all discovery into the same document review system as the rest of discovery. The Operations Manual shows litigation support how to incorporate all discovery for review. Computer Forensics is simply a collection method.

As example, an ex-employee of Smith Inc. formatted their hard drive. Smith Inc. believes there was important information the former employee only kept on their hard drive. A computer forensics investigator can retrieve files from the formatted hard drive. When it comes time to testify about how the firm and Smith Inc. was able to get the data, the investigator is key.

For the legal team to review the discovery the investigator recovered, the computer forensics investigator or a firm preferred vendor will convert the files into images and a database. If the database does not match firm standards, the product may not be usable without additional time and expense. The Operations Manual requires that litigation support have a chance to prequalify the vendor against a contingency just like this.

Should computer forensics be applied to all media in a given case? The Operations Manual provides strategies around what to collect and what to ignore. If the deponant's files reside on only one hard drive out of a group of five, then only use computer forensics on the one hard drive. The vendor may suggest the benefits of processing all five drives. Is the biggest benefit the additional revenue? The Operations Manual helps Litigation Support to provide strategies. A good litigation support department not only provides top quality products but also good advice.

The computer forensics investigator will take several careful steps to find and retrieve possible electronic evidence that may still exist on a pc, server, PDA, BlackBerry or other device. Today this is also starting to include voice mail, as each voice mail is a file on a hard drive.

Here is the basic outline for using an electronic discovery investigator:

The source of the data is not altered in any way when data is extracted.
Identifies all potentially interesting files whether deleted, hidden partially destroyed or password protected.
Saves all files to a separate storage medium, such as a hard drive.
Provides a list of all files, including the original storage state for the legal team to review.
Most computer forensics companies will also identify files that contain keywords and data restrictions. However, at this point, the resulting files can be processed, including culling and conversion to .TIF, like any other discovery.

...and finally...

Provides an affidavit with credentials and testifies on the stand as an expert witness.

Created on 08/27/2006 06:18 PM by admin99
Updated on 08/27/2006 06:30 PM by admin99