eDiscovery Software | eDiscovery Collection Software | Pinpoint Labs

  • Call Us 888-304-1096
Schedule Demo

The Pinpoint Blog

Practical perspectives on eDiscovery, legal tech, and smarter data collection.

What is a Forensic Image?

‘Imaging a hard drive’ is a phrase that is commonly used for preserving the contents of a custodian hard drive or server. It can also be used to describe when a custodian hard drive is cloned. It is worth taking some time to understand the differences and the advantages and disadvantages of each process. Forensic Imaging A forensic image or evidence file container (such as

Read More »
January 29, 2009

Recovering Deleted Email

It’s important to understand that deleted email is not recovered or indexed using common litigation support or electronic discovery software. These applications only process email that is still visible within the email software. Some email recovery software can also fall short when restoring deleted email records. Why is that? Because they are designed to undelete email records that still have an entry in the mail

Read More »
January 27, 2009

Secretly Copying Files To An External USB Drive

Copying corporate data and using it at a competing company (intellectual property/corporate asset theft) is a common and serious concern for companies and their legal counsel. When employees leave companies, there are often questions about the security of the information they previously accessed. Will they use the contacts, forms, or product details as a competitive advantage in their new job? I had previously written about

Read More »
November 21, 2008

Recovering Files From Unallocated Space

Recovering data from a hard drive is one of the most common tasks during a computer investigation. Here are a few of the artifacts which computer investigators may retrieve from unallocated (free) space to assist in a case: * MS Office documents * Acrobat files (.pdf) * Email messages and attachments * Images in various formats * Internet history (pages visited, searches) * Registry files

Read More »
November 19, 2008

Preserving Suspect Media (Write Blockers)

When examining or processing the files on a hard drive, it is extremely important to retain the original file contents and time stamps. Many people don’t realize that just connecting a hard drive to a PC will alter the contents of the hard drive.  In order to preserve the original contents of the hard drive, it is important to implement a write blocking mechanism. Law

Read More »
October 7, 2008

Searching for Buried Treasure

Searching and identifying relevant content is a common process for both electronic discovery and computer forensic investigations. But some people don’t realize the challenges associated with indexing hundreds, or even thousands, of different file types and data structures. Mapping the data landscape may not immediately indicate where the textual “treasure” is located.  Twenty years ago, full text searching was pretty simple. We usually had transcripts,

Read More »
September 25, 2008

Metadata Analysis – “Fabricated” Documents

One of the common requests we receive is to help a client determine when a document was created, or if it existed at a specific date and time, and when it was last modified. For example, an employment dispute may involve one of the following circumstances: A memo was handed to an employee during a meeting but the employee denies s/he received the document. The

Read More »
September 16, 2008

ESI (Electronically Stored Information) Winds of Change

Changes are underway in how electronically stored information (ESI) is processed and reviewed. These changes are due to the huge size of repositories – hundreds of gigabytes or multiple terabyte sizes – identified for collection and processing. Corporations and their legal counsel realize that it may not be feasible or affordable to collect and produce all the information identified in larger cases. Several new software

Read More »
September 12, 2008

What does ‘CCE’ Mean?

The CCE (Certified Computer Examiner) is a certification obtained through ‘The International Society of Forensic Computer Examiners’ (ISFCE). I’ve noticed that many CCE training facilities are geared towards criminal investigations so they don’t necessarily address civil litigation processes and ESI (Electronically Stored Information) requirements. This is because the CCE was originally designed for law enforcement and criminal cases involve child pornography, narcotics, stolen property, counterfeiting,

Read More »
August 28, 2008

Get the Latest from Pinpoint

Want to be the first to know when we publish new blog posts, case studies, or announce events? Subscribe to receive occasional updates straight to your inbox—no spam, just insights.

A smarter way to collect mobile data—fast, secure, and remote.

Discover CrossCopy Mobile

CrossCopy Mobile makes mobile data collection easy, fast, and secure—whether your custodians are across the hall or across the country. No apps to install. No tech headaches.

Learn More
See it in Action