If you ask litigators that are experienced with electronically stored information what keeps them up at night, most will say data preservation.

There are a number of risks to preservation, the least of which is that you give the opposing side a no-merit argument on the processes used to the worst case scenario of lost evidence.

Ultimately the attorney is responsible for the data preservation. It frequently happens that internal IT personnel or IT consultants are asked to copy data and they do a good job of copying the data. However, there are risks that file metadata and system metadata will be changed and that can be a problem in court.

The proper process for preservation is to use hardware and software that preserves data in its original form and does not leave a footprint on the source media. Forensically sound methods utilize hardware and software specifically designed to forensically preserve data. A trained and experienced forensic technician can use the technology to preserve data in a timely manner.

The Center for Computer Forensics has mobile kits to preserve the data in any location and we can preserve almost any kind of media. Many times in civil litigation, a preservation has to be executed without the user's knowledge so the Center for Computer Forensics is prepared for covert preservations as well.

Following is a partial list of media that can be acquired and analyzed:
 
Windows based operating systems

• Desktops
• Laptops
• Servers
• External drives
• USB flash drives
• CD-Rom’s
• DVD-Rom’s
• Blackberry devices, PDA's, cell phones

• Desktops
• Laptops
• Servers
• iPhones
• iPods
• USB flash drives
• CD-Rom’s
• DVD-Rom’s

• Tapes
• External drives
• CD-Rom’s
• DVD-Rom’s
• Iomega products (Zip, Rev)

• Blackberry devices
• PDA’s, Palm, Windows CE
• Cellular telephones
• iPhones

• MP3 players
• USB drives
• Digital voice recorders
• Removable media such as memory sticks

• Proprietary software for a company can be compared for it’s authenticity and used to read the proprietary data
• Proprietary data can often be exported to a more common data set such as Microsoft Access