Cutting Corners Could Cost You the Case

Most experienced IT personnel know their organization's data systems, networks, servers, and historical knowledge of the IT infrastructure. They can lend tremendous support in mapping relevant data systems before data collection; however, there is often more to data collection than simply downloading it.

You might ask, "Why does it matter how it is collected - if the document, email, database, or folder can be read, then what is the difference?"

The major difference separating forensic data collection from simple data collection performed by in-house IT is that forensic data collection, or digital forensics, provides the ability to deliver legally defensible proof that the collection methods did not alter or needlessly modify the metadata gathered. 

Essentially, data collection using forensically sound methods serves to convince opposing counsel and the court that nothing has been deleted or altered. When data is not collected in a forensically sound manner, metadata is inherently changed - no matter the intention. Once opposing counsel objects because of spoiled metadata, it is out. Sanctions and summary judgment on your case could follow, costing you more.

Being informed and prepared for a data collection can greatly reduce costs. The three most common mistakes in data collection include:

1. Copying and pasting your documents onto a thumb drive – you are ignoring the data about the documents (metadata).
2. You or your IT department perform the collection – it could be argued that the collection was done with prejudice.
3. Just grabbing the documents or emails you think you need – experts can help uncover a treasure trove of additional data that you might not know exists.

You can mitigate many of these common errors through an expert consultation at the beginning of your collection. Collaborating with a specialized digital forensics team at the outset of a project will ensure an efficient service. A digital forensics expert with years of collection experience will know what questions to ask you and your custodians to confirm all data sources that could contain relevant data are correctly identified and documented. Potential issues that can delay progress and cost a lot of money can be quickly and efficiently flagged early in an engagement, saving you in the end. 

A forensic collection reaches files that reside within deleted space and other locations inaccessible by the user, providing a more thorough investigation. This vital data includes archives, temporary folders, and caches. Intelligent forensic parsing brings this data to light.

Digital forensics experts will then determine the general types of data sources in your environment that contain data subject to discovery. Collaboration with a digital forensics partner also makes data collection technologies, which may be more advanced or specialized than your IT department's resources, available to gather exact, relevant, and correct data from nearly any device, account, or server. Typical sources for collection include: 

• Desktops
• Laptops
• Mobile Devices (tablets and smartphones)
• Servers
• External Storage Media (CD/DVDs, portable hard drives, thumb drives, etc.)
• Cloud Services (Dropbox, Google Drive, iCloud, etc.)
• Social Media (Facebook, Twitter, Instagram, LinkedIn, etc.)
• Structured Data (SharePoint, CRM, ERP, accounting, DMS, etc.)

Additionally, in matters involving collected data without using forensically sound methods, judges will frequently find it necessary to appoint neutral, third-party experts to assist in handling and interpreting digital data. If you find yourself in this situation, it is paramount that you use a digital forensics expert who has testified before, as they are much more likely to be able to convince a court of law that the spoliation of electronically stored information did or did not take place. Further, if your expert is not diligent in documenting their work and scientifically supporting their conclusions, legal attacks against their work may preclude you from using crucial electronic evidence. Lastly, they must also be able to explain complicated technical issues in a way that a jury or judge would understand. 

With nearly twenty years of collective experience working on the most cutting-edge technologies, IST's Forensic Collections team has a uniquely advanced set of skills to tackle collections, preservations, analysis, and consulting on any matter involving digital data. IST is your single source for superior collections, processing, and review services. We understand the needs of our clients and consistently deliver legally admissible forensic data collections that go hand in hand with our expert data processing and review services.