Time is of the Essence
Why Raw Data is Essential
“In a real investigation, a forensics expert would use another piece of software to make an exact replica of the hard drive to take back to the office to do a more intensive examination.”
Quote from Deborah H. Juhnke of Computer Forensics (“What Lies Beneath: Reducing Exposure in Litigation”)
Once Litigation Has Begun
So, the time has come when you are engaged in a lawsuit. Hopefully, all your careful planning has minimized your risk, but there are still a few hurdles to cross:
Spoliation
First rule: Don’t do anything that can’t be undone. Mishandled original data is lost forever. If you are the defendant, be sure to freeze all potentially responsive data immediately once notice of litigation is received. You can then work out with opposing counsel what must be preserved for the duration of the litigation and what may be placed back into regular circulation. If you are the plaintiff, send a preservation of evidence letter to the other side, requesting specifically what they should retain pending settlement of adjudication of the case.
Discovery
A useful tool in electronic discovery is a 30(b)(6) deposition of the custodian of records. If you use a comprehensive question outline ahead of the opposing counsel, you can often gain invaluable information on how and where records are maintained, as well as specifics on hardware and software platforms, media and other technical information that will help in your later discovery efforts. During the discovery period, you should also collect backup tapes and other media (yours and theirs), and create image copies of any hard drives that may be important to the litigation.
Note: Commercial backup software does not copy all the data on a hard drive. To get a true evidentiary copy, you will need to employ a forensics expert, who will use special procedures and software to maintain the chain of custody. Electronic data used as evidence must be authenticated.
Hiring Experts
Stay within the bounds of your expertise. Did you know, for instance, that simply turning on a computer might destroy valuable data? Well-meaning information systems staff (and even lawyers) have attempted to gather electronic data for litigation, only to find themselves as witnesses in their own case! Just as attorneys turn to experts for help in interpreting information in specialized fields such as accounting and medicine, so too should they look to forensics experts in gathering and interpreting electronic data.