Call:   (888) 458-3222

 

Data Preservation

 

If you ask litigators that are experienced with electronically stored information what keeps them up at night, most will say data preservation.

 

There are a number of risks to preservation, the least of which is that you give the opposing side a no-merit argument on the processes used to the worst case scenario of lost evidence. Ultimately the attorney is responsible for the data preservation. It frequently happens that internal IT personnel or IT consultants are asked to copy data and they do a good job of copying the data. However, there are risks that file metadata and system metadata will be changed and that can be a problem in court.

 

The proper process for preservation is to use hardware and software that preserve data in its original form and does not leave a footprint on the source media. Forensically sound methods utilize hardware and software specifically designed to forensically preserve data. A trained and experienced forensic technician can use the technology to preserve data in a timely manner. Above all, the preservation process has to be repeatable and defensible. Your forensics examiner creates comprehensive chains of custody for each individual piece of media or server and maintains this chain of custody throughout an engagement.

 

Following is a partial list of media that can be acquired and analyzed:

 

Windows based operating systems

 

  • Desktops
  • Laptops
  • Servers
  • External drives
  • USB flash drives
  • CD-Rom’s
  • DVD-Rom’s
  • Cloud storage (Box, Dropbox, etc)

 

Macintosh based operation systems

 

  • Desktops
  • Laptops
  • Servers
  • Extrenal drives
  • iPhones
  • iPods
  • USB flash drives
  • CD-Rom’s
  • DVD-Rom’s
  • ICloud

 

Backup media

 

  • Tapes
  • External drives
  • CD-Rom’s
  • DVD-Rom’s
  • Iomega products (Zip, Rev)
  • Cloud storage
  • Cloud backup (Carbonite, backblaze, IDrive, etc)

 

Cell phones / Smart phones / Personal Digital Assistants / IPhones

 

Tablets and IPads

 

 

Software

 

  • Proprietary software for a company can be compared for it’s authenticity and used to read the proprietary data
  • Proprietary data can often be exported to a more common data set such as Microsoft Access

 

This analysis is vital to the client in resolving the origin and determines the authentication of files located on the media, as well as to corroborate allegations and claims of litigants in the case.

 

 

Center for Computer Forensics

21800 Melrose Ave

Suite 1

Southfield, MI 48075

 

info@computer-forensics.net

This website is not intended to provide legal or professional advice. The site is merely a starting point to learn about the topics listed. While we attempt to maintain current, complete and accurate information we accept no responsibility for errors or omissions.