United States: Computer Forensics
Electronic Evidence Collection Myths

Most legal professionals today know that electronic business communications tools create an enormous volume of data. With such large quantities, lawyers are quite right to argue the inclusion of electronic evidence could jeopardise the proportionate approach to litigation. What an increasing number of practitioners are realising though, is that the initial data collection is simply a starting point - focused evidence retrieval is feasible, useful for case preparation, and makes for a more accurate review.

There are numerous myths surrounding the electronic evidence:

Forensic Copying is Unnecessary

The failure to preserve data can result in the loss of critical evidence and as a result, can lead to doubt being placed on the credibility of data collections. This can lead to evidence being rendered unreliable or inadmissible in a court of law. In addition, to maintain the integrity of electronic evidence, it is wise to obtain a mirror image as it provides an exact bit-by-bit copy of the media, including any associated and potentially relevant metadata. This snap-shot can be used to prove any movement, alteration or deletion of data in support of investigations into claims related to computer-related conduct. This copying also limits the interruption on clients’ staff computer use and, should the original media be intentionally or accidentally altered, can ensure the legal teams have a perfect copy of the data.

Electronic evidence collections do not need to entail looking at every single byte of data on every media source. Legal teams and their technical experts are now using more advanced selection methods when it comes to the collection of evidence from the initial stages of an investigation. Using their knowledge about the matter at hand and the law, lawyers are working with forensic experts to better define what they need to examine using fairly specific criteria. Those more cautious about their collection are utilising forensic expertise to scan media sources and then supply a high level overview of the data. This initial stage can greatly assist lawyers in identifying what data is there, what needs to be done and how to progress.

An increasing number of legal professionals are less wary of including large media storage devices such as PCs, back-up tapes and servers. These media sources can be of significantly more value to support an investigation due to the extent of the data contained within them. As a result, forensic experts are increasingly helping clients’ investigations using backup tapes as the primary data source then drilling down to relevant evidence. Backup tapes are particularly useful as live systems may not contain critical data which users have tried to delete, alter or move. This more focused approach benefits lawyers as it provides a faster, more accurate data collection thereby giving them a cost effective means through which to gather evidence. In all likelihood, this assists the team in conducting a proportionate response.

Large multi-national organisations tend to be able to conduct their own data collections primarily due to in-house forensic expertise. While these companies have specific staff dedicated to this requirement, smaller organisations should be extremely wary about trying to collect data for three significant reasons. Firstly there is a question of resource – can your internal IT department cope with time away from their usual responsibilities and activities? As with most departments, IT teams tend to be busy working on day-to-day activities as well as larger projects to support their organisation. With a data collection exercise, they will need to add to their existing workload activities which will not simply require copying data, but working with the in-house and external legal teams to identify relevant data sources and the accessibility of these. This tends to extend timescales as additional resources need to be allocated to the project.

Secondly, there is the issue of technical expertise. In-house IT teams will undoubtedly have significant experience and skills related to managing the existing types of media used by staff. With turnover of staff and development of new technologies, however, forensic experts are increasingly requested to support evidence retrievals and collections of older media, applications and data types. As technology-savvy lawyers know, there is a vast range of electronic communications tools, most of which evolve on a regular basis. While there are IT experts with a vast range of experience, there is increased demand for external forensic expertise due to the enormity of the range of data that can exist.

The final reason is one of sensitivity. Forensic experts are frequently called upon to assist in internal investigations and covert operations to identify who did what, where, why, how and when. Inclusion of members of client staff is typically restricted due to the sensitivity of such cases and the possible implications these can have for the corporation. The use of forensic experts helps lawyers undertake precise, process driven investigations without the disruption of staff. This can also ensure any potential culprit is unaware of evidence being collected.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.