Call: (888) 458-3222
If you ask litigators that are experienced with electronically stored information what keeps them up at night, most will say data preservation.
There are a number of risks to preservation, the least of which is that you give the opposing side a no-merit argument on the processes used to the worst case scenario of lost evidence. Ultimately the attorney is responsible for the data preservation. It frequently happens that internal IT personnel or IT consultants are asked to copy data and they do a good job of copying the data. However, there are risks that file metadata and system metadata will be changed and that can be a problem in court.
The proper process for preservation is to use hardware and software that preserve data in its original form and does not leave a footprint on the source media. Forensically sound methods utilize hardware and software specifically designed to forensically preserve data. A trained and experienced forensic technician can use the technology to preserve data in a timely manner. Above all, the preservation process has to be repeatable and defensible. Your forensics examiner creates comprehensive chains of custody for each individual piece of media or server and maintains this chain of custody throughout an engagement.
Following is a partial list of media that can be acquired and analyzed:
Windows based operating systems
Macintosh based operation systems
Cell phones / Smart phones / Personal Digital Assistants / IPhones
Tablets and IPads
This analysis is vital to the client in resolving the origin and determines the authentication of files located on the media, as well as to corroborate allegations and claims of litigants in the case.
Center for Computer Forensics
21800 Melrose Ave
Southfield, MI 48075
This website is not intended to provide legal or professional advice. The site is merely a starting point to learn about the topics listed. While we attempt to maintain current, complete and accurate information we accept no responsibility for errors or omissions.