Six Articles on Electronic - Craig Ball

Craig Ball © 2007
"But," I warned, "as soon as you attach the drive to your computer and start poking around,
you'll alter the evidence."
Microsoft Windows acts like a dog marking territory. As soon as you connect a hard drive to
Windows, the operating system writes changes to the drive. Forensic examiners either employ
devices called "write blockers" to intercept these alterations or perform their examination using
operating systems less inclined to leave their mark all over the evidence. Without similar
precautions, opening files, reading e-mail or copying data irretrievably alters file metadata, the
data-about-data revealing, inter alia, when a file was last modified, accessed or created. You
may find the smoking gun, but good luck getting it into evidence when it emerges you unwittingly
altered the data! This is why smart lawyers never "sneak a peek" at digital evidence.
"It'd be a violation of the software licensing to use the programs on the duplicate so you'll need
to have the right software to read the e-mail and other documents and to crack any passwords
you run into. However, you can't load your software on the duplicate drive because that will
overwrite recoverable deleted files. Don't forget to take steps to isolate the system you'll use for
examination from your office network and the internet as well as to…."
She stopped me. "We shouldn't be doing this ourselves, should we?"
"Not unless you know what you're doing. Anyway, I doubt the court will allow it without a
showing of good cause and some provision to protect privileged and non-discoverable
confidential data."
Now I got the question I was waiting for: "What should we do?"
"As the court's neutral," I answered, "I'm not in a position to answer that question, but before I'd
burn a lot of time and money pursuing electronic discovery of particular media, I'd work out the
answers to, 'What's this case about, and what am I really looking for?'"
What I wanted to add is that electronic discovery is no more about hard drives than traditional
discovery was "about" paper. The hard drive is just a gigantic file cabinet, locked up like some
Houdini vanishing act and packed with contents penned in Sanskrit. We don't gear discovery to
metal boxes, big or small.
Sure, it's smart to focus on specific media and systems when you seek preservation, but when
your goal is discovery, media ceases to be an end in itself. Then, the objectives are the e-mail,
documents and other digital evidence relating to the issues in the case, narrowly targeted by
time, topic, and custodian. Sorry Marshall McLuhan, it's not the medium. It's the message.
76