Six Articles on Electronic - Craig Ball

Craig Ball © 2007
Don't Try This at Home
By Craig Ball
[Originally published in Law Technology News, August 2005]
The legal assistant on the phone asked, "Can you send us copies of their hard drives?"
As court-appointed Special Master, I'd imaged the contents of the defendant's computers and
served as custodian of the data for several months. The plaintiff's lawyer had been wise to lock
down the data before it disappeared, but like the dog that caught the car, he didn't know what to
do next. Now, with trial a month away, it was time to start looking at the evidence.
"Not unless the judge orders me to give them to you," I replied.
The court had me act as custodian because the discoverable evidence on a hard drive lives
cheek by jowl with all manner of sensitive stuff, such as attorney-client communications,
financial records and pictures of naked folks engaged in recreational activity. In suits between
competitors, intellectual property and trade secrets such as pricing and customer contact lists
need protection from disclosure when not evidence. As does all that full-of-surprises deleted
data accessible by forensic examination.
"Even if the court directs me to turn over the drive images, you probably won't be able to access
the data without expert assistance."
I explained that, like most computer forensic specialists, I store the contents of hard drives as a
series of compressed image files, not as bootable hardware that can be attached to a computer
and examined. Doing so is advantageous because the data is easier to access, store and
authenticate, as well as far less prone to corruption by the operating system or through
examination. Specialized software enables me to assemble the image files as a single virtual
hard drive, identical in every way to the original. On those rare occasions when a physical
duplicate is needed, I reconstitute those image files to a forensically sterile hard drive and use
cryptographic algorithms to demonstrate that the restored drive is a faithful counterpart of the
original. Of course, putting the digital toothpaste back in the tube that way takes time and costs
money.
"Do we ask the court for a restored drive?"
"You could," I said, "and you might get it if the other side doesn't object."
Incredibly, lawyers who'd never permit the opposition to fish about in their client's home or office
blithely give the green light when it comes to trolling client hard drives. No matter how much
you want to demonstrate good faith or that your client has "nothing to hide," be wary of allowing
the other side to look at the drives.
Even when you've checked the contents, you can't see all that a forensic exam can turn up, and
your client may not tell you about all those files she deleted last night.
75