by admin-jon | Nov 24, 2010 | Blog, Computer Investigations, Electronic Discovery, ESI Collection, Tips & Tricks
A couple weeks ago, I outlined what computer forensics and electronic discovery have in common and how they differ. I’d like to expand on this topic by identifying some common obstacles encountered when using popular computer forensic software for typical electronic...
by admin-jon | Jan 29, 2009 | Blog, Collection, Computer Investigations, Definition, Electronic Discovery, ESI Collection, ESI Software
‘Imaging a hard drive’ is a phrase that is commonly used for preserving the contents of a custodian hard drive or server. It can also be used to describe when a custodian hard drive is cloned. It is worth taking some time to understand the differences and the...
by admin-jon | Nov 21, 2008 | Blog, Collection, Computer Investigations, Data Recovery, File Recovery, Metadata, Software, Tips & Tricks
Copying corporate data and using it at a competing company (intellectual property/corporate asset theft) is a common and serious concern for companies and their legal counsel. When employees leave companies, there are often questions about the security of the...
by admin-jon | Nov 19, 2008 | Blog, Computer Investigations, Data Recovery, Electronic Discovery
Recovering data from a hard drive is one of the most common tasks during a computer investigation. Here are a few of the artifacts which computer investigators may retrieve from unallocated (free) space to assist in a case: * MS Office documents * Acrobat files (.pdf)...
by admin-jon | Sep 25, 2008 | Blog, Computer Investigations, Electronic Discovery
Searching and identifying relevant content is a common process for both electronic discovery and computer forensic investigations. But some people don’t realize the challenges associated with indexing hundreds, or even thousands, of different file types and data...
by admin-jon | Sep 16, 2008 | Blog, Computer Investigations, Metadata
One of the common requests we receive is to help a client determine when a document was created, or if it existed at a specific date and time, and when it was last modified. For example, an employment dispute may involve one of the following circumstances: A memo was...
