So what is digital forensics exactly?

Digital forensics pertains to the forensic investigation of devices used for the storage of digital data, the objective of which is to locate and extract the digitally stored data from such devices in order to assist in the submission of relevant evidence in civil or criminal court cases. Some examples of common media storage devices involved in digital forensics are: 

• Computers/servers and their digital components
• Digital audio devices such as MP3 players, I-Pods, I-Pads, audio surveillance systems.
• Digital video devices such as digital cameras, digital video surveillance systems, scanners, facsimile machines, imaging systems.
• External media storage devices such as CDs, DVDs, flash memory cards, USB drives.
• Communication devices such as mobile phones, PDAs, Blackberries, I-Phones.

So why is CyberControls always making the distinction between a Requesting Party and a Producing Party?

Clearly, the needs and objectives of opposing parties in a litigation matter at first glance would lead most observers to assume that when considering digital forensics as a solution to resolve some discovery dispute, the plaintiff would be the more likely party to initiate this approach. This is no longer the case.

In fact, we contend that the rising costs of commercial litigation for both parties in a dispute demands that a strict adherence to the duty to preserve all relevant ESI is the best option or motions for spoliation sanctions are sure to follow. While a plaintiff might have a more extensive list of documents and things on their discovery requests than does the defendant in a case, that will not diminish the plaintiff's liabilities resulting from insufficient litigation-hold practices on their part.

Digital Forensics may be the only option available to a litigant to be assured that an exact duplicate of an original data device has been created at a given time. Byte-by-byte, bit-by-bit, the forensic bitstream image of a digital storage device will demonstrate to all concerned that maximum effort was expended to preserve the entire contents, both active and deleted data files that existed on the same original media device at the time the bitstream image was successfully completed.

So whether you represent a plaintiff or a defendant, the goal should be the preservation of any media device that has been identified as a likely source in which relevant ESI is stored that pertains to the lawsuit.  The list to the left represents the majority of digital media devices and objectives commonly focused on in e-Discovery disputes. Increasingly, defense attorneys are seeing the advantage of initiating pre-production forensic examinations of their client's digital devices in an effort to eliminate any element of surprise or possibly the recovery of exculpatory ESI that may have been previously deleted.

For plaintiff clients, the CyberControls' forensics services team will assist the attorney in formulating an e-Discovery strategy that may include examination protocols that accompany motions to inspect the computers of an adverse party. In labor disputes involving alleged misappropriation of confidential or trade secret information, major dividends come to those who perform a thorough forensic analysis of the work computers used by the recently departed employee. That is, before the client's IT manager performs any in-house computer examinations which potentially could destroy valuable ESI permanently!