Five on Forensics Page 1 - Craig Ball

More documents

Recommendations

Info

<strong>Five</strong> on Forensics © 2002-2008 Craig Ball All Rights Reserved providers, drafting production requests and explaining the cost and complexity of e- mail production to clients and the court. Published by the Federal Judicial Center Managing Discovery of Electronic Information: A Pocket Guide for Judges by Barbara J. Rothstein, Ronald J. Hedges, and Elizabeth C. Wiggins Available at http://www.fjc.gov/public/pdf.nsf/lookup/eldscpkt.pdf/$file/eldscpkt.pdf Published by the U.S. Department of Justice, National Institute of Justice Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition, available at http://www.ncjrs.gov/pdffiles1/nij/219941.pdf Page 104
<strong>Five</strong> on Forensics © 2002-2008 Craig Ball All Rights Reserved Appendix A: Problematic Protocols: Two Recent Decisions A well-crafted protocol is the key to a successful forensic examination—one that employs the most efficient and cost-effective tools and methods for analyzing the particular type and quantity of ESI presented. Two recent decisions exemplify the problems that flow from inadequate examination protocols. Consider this protocol from Ferron v. Search Cactus, L.L.C., 2008 WL 1902499 (S.D. Ohio Apr. 28, 2008): 1. Within seven days of the date of this Opinion and Order, Plaintiff's forensic computer expert shall mirror image both of Plaintiff's computer systems' hard drives and Plaintiff shall preserve this mirror image. 2. Plaintiff's forensic computer expert shall then remove only Plaintiff's confidential personal information from the mirror image of Plaintiff's computer systems' hard drives. Plaintiff's expert shall provide Defendants with the protocol he utilized to remove the confidential information. 3. Plaintiff shall then provide Defendants' computer forensic expert access to his computer systems' hard drives. 4. Defendants' forensic computer expert shall mirror image Plaintiff's computer systems' hard drives in approximately four to eight hours for each system. If the expert finds that this is not enough time, Plaintiff is expected to be reasonable in allowing some additional time. Defendant is expected to be considerate with regard to scheduling times that are less intrusive to Plaintiff and his business. 5. Defendants' expert shall review his findings in confidence with Plaintiff prior to making any findings available to Defendants. 6. Plaintiff shall identify for deletion any information that is irrelevant and create a specific privilege log of any relevant information for which he claims privilege. The computer forensic expert shall remove the information claimed as privileged and provide all other information to Defendants. 7. Defendants' expert shall provide Plaintiff with the protocol he utilized to remove the privileged information. 8. Forensic computer experts [omitted] shall act as officers of this Court. Defendants shall be responsible for remunerating [Defendant’s expert] and Plaintiff shall be responsible for remunerating [Plaintiff’s expert]. It’s unclear whether the plan is for plaintiff’s expert to sterilize drive images before making the images available to the other side’s examiner or whether the unsterilized source hard drives will be made available to the defendant’s expert for imaging and examination. A literal reading supports the latter conclusion, but then what’s the point of plaintiff’s sterilization effort? Moreover, the order ignores the Herculean challenge faced in thoroughly cleansing a drive of particular confidential information in anticipation of forensic examination. If, for example, the plaintiff’s e-mail included both confidential and discoverable messages, the examiner would be obliged to obliterate and reconstitute the plaintiff’s e-mail container file. Additionally, the unallocated clusters typically carry tens or hundreds of gigabytes of commingled, undifferentiated data. Finally, the order offers no guidance as to what the Page 105
Page 1 and 2:
Five on Forensics
Page 3 and 4:
Five on Forensics
Page 5 and 6:
Five on Forensics
Page 7 and 8:
Five on Forensics
Page 9 and 10:
Five on Forensics
Page 11 and 12:
Five on Forensics
Page 13 and 14:
Five on Forensics
Page 15 and 16:
Five on Forensics
Page 17 and 18:
Five on Forensics
Page 19 and 20:
Five on Forensics
Page 21 and 22:
Five on Forensics
Page 23 and 24:
Five on Forensics
Page 25 and 26:
Five on Forensics
Page 27 and 28:
Five on Forensics
Page 29 and 30:
Five on Forensics
Page 31 and 32:
Five on Forensics
Page 33 and 34:
Five on Forensics
Page 35 and 36:
Five on Forensics
Page 37 and 38:
Five on Forensics
Page 39 and 40:
Five on Forensics
Page 41 and 42:
Five on Forensics
Page 43 and 44:
Five on Forensics
Page 45 and 46:
Five on Forensics
Page 47 and 48:
Five on Forensics
Page 49 and 50:
Five on Forensics
Page 51 and 52:
Five on Forensics
Page 53 and 54: Five on Forensics
Page 103: Five on Forensics
Page 109: Five on Forensics
show all

Five on Forensics Page 1 - Craig Ball

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?