Choose Your Vendor Print

The most common source of problems and no-merit arguments with electronically stored information is the initial handling of data.  Until you are absolutely sure of what elements of the data is to be preserved, make sure you engage a professional computer forensic professional to preserve the data in its original format. 

A common mistake in the field is to contact an internal IT person or a consultant to preserve the data.  However, as with any IT issue, preserving data can mean different things to different people.  For the attorney, preserving data means never changing the original form of the data, capturing metadata, including unallocated space.  Furthermore, you want the person doing the job to have experience in court. 

Everything is important on proper data preservation.  The hardware used, the software used, the procedures used and the documentation of the process can all be questioned by the opposing side.

When you contract with a vendor ask them about their processes.  What kind of write-block device do they use?  What imaging (copying) software are they using?  Does the imaging software preserve unallocated space?  Does the imaging software protect the metadata?  Can you guarantee that the process does not write to the evidence drive?  Are they certified for data preservation?  Ask for credentials.  Ask for an example of their chain-of-custody documentation.     

In addition to protecting your legal position, using an experienced and credentialed examiner will save you time and money.

 

Case Studies

National Bank – Employees leave for a competitor

Read more...
 

Quick Contact