Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
of the information, I was expected to personally handle all aspects of the task, including
monitoring the printing.
Estimates of how digital data convert to printed pages are notoriously misleading because of the
wide variance in how applications format the printed page: a tiny Word file can consume dozens
of printed pages while a large graphic file may result in a small image. However, a commonly
cited estimate suggests the following correlation:
Data
Printed Pages
One megabyte = 1,000-1,400
One gigabyte = 100,000-140,000
One terabyte =100,000,000-140,000,000
By this measure, the ten gigabytes of data on the hard drive would print out to something over a
million pages, and I could get the job done in under a year of forty-hour weeks, chained to the
printer. Problem was, even if I were willing to abandon my practice and baby-sit a laser printer,
the files were not formatted so as to efficiently fill the printed pages. Instead, I was probably
looking at several million printed pages, the vast majority of them containing meaningless
strings of gibberish. Did I mention I’d have to make three copy sets? The paper and toner
alone would cost $120,000, not to mention the printers and Prozac.
Clearly, a global order that the contents of a computer be printed out is a disaster. The solution
in this case was to revise the order to permit production of the data on CD-ROM in its native
electronic format and to eliminate the production of software applications and other data that did
not, in any manner, reflect activities by users of the computer. This is a much more time- and
cost-efficient technique, and it spared a couple of acres of forest to boot.
A Little Knowledge is a Wonderful Thing
Errors like the potentially costly one just described can be avoided in the first place if lawyers
gain a fundamental understanding of how a computer stores data and the many nooks and
crannies where data can hide despite efforts to make it disappear. This knowledge is valuable
whether you are combing an employee’s computer to find out if they have engaged in on-the-job
shenanigans with firm property or framing discovery requests; but be advised that it is no
substitute for the services of a qualified and experienced computer forensics expert. If you don’t
know what you are doing, your efforts to resurrect deleted data may end up permanently
deleting the smoking gun or, at the very least, imperiling its admissibility in court.
Reading this article isn’t going to make you a computer forensics expert. Many topics are
oversimplified or explained with metaphors that would make a computer engineer wince, but you
will get enough of the basics to impress opposing counsel and make yourself wholly unattractive
to members of the opposite sex. You might even find yourself casting admiring glances at short
sleeve shirts and vinyl pocket protectors.
This article will focus on the WinTel platform (geek speak for a computer with an Intel processor
running the Microsoft Windows operating system, though the material covered applies equally to
Windows computers running AMD chips). All of the concepts and many of the specifics apply to
other computing environments as well.
Page 7