E-Discovery or Digital Forensics – Ford or Ferrari

USB-drive-copy

When it comes to retrieving electronically stored information (ESI), there’s more than one way to have the data you want produced.  Often in compliance or legal matters, production is performed by an e-discovery company.  Most e-discovery firms are very competent at taking an image or batch of data from a custodian(s) and processing it in order to preserve or produce certain documents of interest for review, such as spreadsheets, pictures, Word documents, or PDF’s (which are actually images).  They are also well-suited for large volume engagements, which is typically expressed in their pricing models.  You give them access to the data and they can efficiently spit out the aforementioned documents based on your criteria, including whether the documents are responsive to specific keywords or date ranges.  However, what is typically missing?  Fragments of data that are responsive or perhaps critical to your position are overlooked.  Examples of these fragments would be things culled from a swapfile, memory, or bits of information from Shell Bags, or Jump Lists.  Sometimes it’s information someone thought they deleted.  Admittedly, these types of data and/or data sources are not run of the mill for e-discovery or even general IT staff.  

If you’re litigation counsel or corporate general counsel, you know certain circumstances require you to know exactly what data is retrievable in any form.  In these crucial instances you need to evaluate the right vehicle to deliver the evidence you need.  Are you looking for a Ford (e-discovery), or does your situation require a Ferrari and a highly skilled driver.  Having the right forensic investigator and the best tools can be the difference between winning and losing a case.  What’s your need? 

Share this: