Before we begin, let’s dispel a myth or two about digital forensics: digital forensics is not what you
see on CSI. For starters, you cannot power up a computer with potential evidence and begin pilfering through the information. Those actions will modify and destroy evidence potentially preventing admissibility into court (Attorneys: remind your clients of this). Secondly, digital forensic investigations can be very detailed and time-consuming: it isn’t going to happen in an hour. Lastly, we are not nearly as attractive as the people on television.
Digital forensics isthe ability to obtain great detail related to activities performed on computers. Digital forensics can also provide information typically not available from conventional eDiscovery requests; deleted information, Internet activities, social network usage, and detailed timeline activity of actions taken by a computer user.
Let’s walk through an example demonstrating the benefits from digital forensics.
Our client employed a valued engineer for years. This person was a model employee and contributed greatly to the success of the company. Unexpectedly, the employee resigned to work for a direct competitor. Our client indicated that they were very shocked at the resignation and were concerned that he may have taken their “widget” designs. We were asked to analyze the computer of the former employee.
The digital investigation uncovered many artifacts of value to the client and their counsel. Computers are very detailed when monitoring the activities that occur on them. This enables us to perform very detailed timeline analysis. In the analysis of the computer, we found that: Read More
Attorneys: Be Aware When Reviewing Emails in Outlook
Bill Dean, Director of Computer Forensics
I am well aware that the use of Microsoft Outlook to review email is a perceivably convenient and low cost method to review small volumes of email. However, this method is laced with potential issues that just aren’t worth the risks – and there are risks. This article will address some of these risks to hopefully encourage the use of better technology to review email, or at least educate you enough to understand the risks.
So your client produced his or her email for you to review in a PST format (Microsoft Outlook Email Database). You are already proficient in the use of Microsoft Outlook as it likely already dictates much of your day. Either you already know how to attach this file to Outlook or your “friendly” IT staff will do it for you. You have the email loaded and you are ready to begin, but before you start, let’s talk about keyword searching.
Google has been a great asset to our culture in many ways. For the litigation field, it has inadvertently educated you how to perform Boolean searches. When you search Google for “Trade secret theft” and “Case Law” in the same query, you have performed a powerful Boolean search. However, Boolean search features such as this are not as intuitive in Microsoft Outlook and require extensive effort to execute. Difficulty performing Boolean searches is the good news. The bad news is that Microsoft Outlook, by default, will not search the contents of attachments for the keywords. Your searches will only address the email fields and the contents of an email message, which could potentially omit responsive information. We will visit the danger of attachments later in this article.
The read receipt option on sent emails presents another concern. If an unread email you are reviewing has the read receipt option set, your review of that email could inadvertently send a message to the sender that the email has been read. Consider the implications for that for a moment. There is one instance in which the custodian was deceased and his widow received a read receipt “from beyond the grave”.
Read More »