Since the Federal Rules of Civil Procedure were amended in 2006 to clarify that the discovery of electronically stored information (ESI) stands on equal footing with discovery of paper documents, the use of e-discovery and digital forensics has seen rapid growth and change. Both e-discovery and digital forensics involve the identification, preservation, collection, review, and production of ESI, but they differ in the collection process and the type of ESI that is collected. Before you can decide if your case warrants contacting a digital forensics company in Wilmington, you need to be aware of what digital forensics offers.
What Does Digital Forensics Include That E-Discovery Lacks?
Digital forensics essentially conducts an autopsy of a computer hard drive to identify the who, what, where, when, and why from a computer. Digital forensics produces an exact replica of the original storage device, allowing investigation without altering the original evidence. This forensic copy (often referred to as a mirror image) includes all readily accessible data as well as less accessible content. This includes:
- Automatically Stored Data – Computers store a great deal of data automatically, often through automatic backup features. Copies of files are periodically saved, typically to a different directory than the active file. On most networked systems, automatically stored files are saved to the user’s hard drive rather than the network server. As a result, a file that was removed from the server may still exist as a copy on the user’s hard drive.
- Deleted Files – Deleting a file does not destroy it, it simply tells the computer that the physical space once belonging to the deleted file is now available. The data can remain in the hard drive until it is overwritten or “wiped” by a utility software.
- “Ghost” or Residual Data – Residual data refers to information that can be recovered from the computer system but does not appear as accessible data when performing a file or directory command. This includes deleted files, file fragments, file slack, and unallocated space.
- System Data – System data is the electronic trail of activity that is generated on a computer or network, generally without the user’s knowledge. This includes a record of every time a user logs on or off, websites visited, passwords used, if and when a document was deleted, and whether a document was downloaded, copied, or printed, and to what external device.
- Wiping Software – Anti-forensic software (commonly called “wiping software”) is designed to remove all traces of data from a hard drive or other peripheral device. Whether it is a complete wipe of the entire hard drive, or limited to only the unallocated storage space, the software leaves behind a characteristic pattern, allowing it to be detected through the computer forensic process.
Precise: The Preeminent Digital Forensics Company in Wilmington
Digital forensics offers a detailed view of all the available data, but it can also seem overwhelming to wade through all this information. At Precise, our certified forensic experts work with you to identify, collect, analyze, cull, and retrieve all (and only) potentially relevant ESI. You can rely on our digital forensics (including expert reports and testimony) to guide you to the hard-to-find sources of critical information that could win your case.
Call Precise today to see how your litigation can benefit from the best digital forensics company in Wilmington.
Recent Comments