Informative Articles About Digital Forensics Litigation Support

Effective Preservation Letters for Electronic Evidence

By admin | March 6, 2007

Since 90% of the world’s information is stored as computer generated data, electronic discovery has become an imperative part of litigation. Billions of e-mails are being sent each day and more information is primarily (and sometimes only) stored electronically. When litigation occurs, evidence is most likely found hidden between the bits and bytes of electronic information. But the flexibility in today’s computerized information era can just as easily work against you; data can easily be overwritten and purged. Time is of the essence when it comes to protecting short-lived log files that may be overwritten on a daily basis. You should send a preservation letter to the opposing party as soon as you expect litigation so that you can maximize the available information to help you prove your case. If a company’s document retention policy involves routine destruction of electronic documents, or continued use of pertinent electronic devices, then you need to act as soon as possible. Sending a preservation letter can, and often should, occur even before you file your case. When prompt action is taken, the opposing party will more likely be able to manage the electronic evidence better and make necessary preparations in response to the request for e-discovery. Rule 26(a)(1)(B) of the Federal Rules of Civil Procedure requires “a copy of, or a description by category and location of, all documents, data compilations, and tangible things that are in…

Ways to Have a Handy Backup of Your Files

By admin | February 7, 2007

Do you always want to carry a handy backup copy of your website, photos or music collection? Let’s face it, some users want to have the ability to have a backup copy of their files so that they can show their friends their latest photos wherever they maybe. Whether it’s at an internet cafe or the local library, a lot of people wishing they had their files don’t because carrying around a large CD-R just isn’t very handy. Luckily, the recent years have lead to an explosion in handy little ways to allow you to always be able to carry a backup of your files. First off are the little flash memory sticks that are being produced by literally every computer company on the face of the earth. Most are smaller than a pack of Wrigley’s chewing gum, but have the ability to store tons of data. Talk about handy! Handy flash memory based keychains starting at around fifteen dollars are perfect storage mediums for backup files. Starting at around fifteen dollars, a user can go out and buy a 128 megabyte memory keychain. Plug it into your computer’s USB port and boom; easy access to your files. Since the memory keychains utilize the USB port for their power, users do not need to worry about carrying a power pack, or replacing batteries. The small flash memory units are extremely handy because you…

Computer Forensics Guidelines

By admin | February 7, 2007

Contributed by Andrew Whitehead Computer Forensic Examination and Analysis A thorough Computer forensic examination and its subsequent analysis is not something that can be done by anyone, a specialist in the field will be required to examine any suspect computer system that has been seized for this purpose. He will be able examine it as a detective rather than as an IT expert, he will not chase after isolated piece of information; instead he will let the clues and the digital data as a whole tell the story. To do this, and ensure that the evidence is acceptable to a court, he needs a foot in both camps – IT expert and detective. Protecting Media during Computer Forensic Analysis A computer forensic examination will follow several guidelines, starting with switching the computer on – he won’t do it. When a computer runs through the start up sequence access times of certain files is altered, and this information may be critical to the investigation. To avoid this the original media needs to be made safe, either by disconnecting the hard drive and booting from a floppy disk, or installing the hard drive as a slave drive in another machine.

Computer Forensic: Seizing the Evidence

By admin | February 7, 2007

The computer forensic experts have to conform with many rules and regulations if the evidence they uncover is to be acceptable to the courts. The first step in obtaining computer forensic evidence is obtaining a search warrant to seize the suspect system. This warrant must include wording allowing the investigators to seize not only the computer, but also any peripherals thought to be connected with the crime. A suspected counterfeiter, for instance, may have used his computer, a scanner, and a printer to produce his counterfeit documents, in which case all three items would need to be seized to provide evidence. If it is thought that evidence is contained in emails, this also should specifically mentioned in the search warrant. Email is a sensitive area as it can be considered personal, so solid justification is needed before a suspects email is allowed to be searched. A warrant also needs to be clear about the searching of network and file servers, whether backup media is included, and if hardware, software, and peripherals can be removed to another location to conduct the search. In all circumstances, data not connected to the crime must not be touched. Doctors, lawyers, and clergy store documents on their PCs and much of this information is confidential. While the computer forensic expert needs to uncover evidence, care must be exercised to protect the personal information of any innocent third parties.…

Top Ten Disaster Recovery Tips

By admin | February 7, 2007

Disaster Recovery is ‘make or Break’ Research shows that most firms hit by a catastrophic event, without no disaster recovery plan, go out of business within two years. Even a basic disaster recovery plan will increase the chances of recovery. Disaster Recovery Tips 1. Store your system passwords in at least two separate secure locations. only one of which is in the same building as your IT equipment. At least two staff have should have access to them. 2. Document, document, document! Make sure that the whole recovery process to get you up and running again is documented, and includes the locations of system recovery and other critical discs. Make sure that key staff are familiar with these.

Amendments to the federal rules of civil procedure

By admin | February 2, 2007

Rule 16. Pretrial Conferences; Scheduling; Management (b) Scheduling and Planning. Except in categories of actions exempted by district court rule as inappropriate, the district judge, or a magistrate judge when authorized by district court rule, shall, after receiving the report from the parties under Rule 26(f) or after consulting with the attorneys for the parties and any unrepresented parties by a scheduling conference, telephone, mail, or other suitable means, enter a scheduling order that limits the time To join other parties and to amend the pleadings; To file motions; and To complete discovery. The scheduling order also may include modifications of the times for disclosures underRules 26(a) and 26(e)(1) and of the extent of discovery to be permitted; provisions for disclosure or discovery of electronically stored information; any agreements the parties reach for assertingclaims of privilege or of protection as trial preparation material after production; the date or dates for conferences before trial, afinal pretrial conference, and trial; and any other matters appropriate in the circumstances of the case. The order shall issue as soon as practicable but in any event within 90 days after the appearance of a defendant and within 120 days after the complaint has been served on a defendant. A schedule shall not be modified except upon a showing of good cause and by leave of the district judge or, when authorized by local rule, by a magistrate judge.…