The Pinpoint Blog

Practical perspectives on eDiscovery, legal tech, and smarter data collection.

ESI (Electronically Stored Information) Software Challenges

A couple weeks ago, I outlined what computer forensics and electronic discovery have in common and how they differ. I’d like to expand on this topic by identifying some common obstacles encountered when using popular computer forensic software for typical electronic discovery projects. A typical computer forensic case may involve: A small quantity of email and/or attachments Recovered files, internet history, and user activity Registry

November 24, 2010

Electronically Stored Information (ESI) Collection Software

Each day, corporate IT managers, computer forensic examiners, and litigation support professionals are tasked with performing ESI collections for relevant files which reside in file shares, on client systems, and other popular data sources. The content may include Microsoft Exchange mailboxes, departmental data, individual custodian files, internet logs, telephone logs, or other critical corporate content. Over 4 years ago, Pinpoint Labs released SafeCopy version 2.0 (SafeCopy 2)

November 24, 2010

LegalTech New York 2009

We will be attending LegalTech New York and I wanted to invite you to come by and visit our booth. We will be in booth #429 on the 1st floor of the exhibit hall. There are several updates to our software applications that we will be demonstrating, and if you attend, I would appreciate the opportunity to meet with you. I’ve been participating in LegalTech

January 30, 2009

What is a Forensic Image?

‘Imaging a hard drive’ is a phrase that is commonly used for preserving the contents of a custodian hard drive or server. It can also be used to describe when a custodian hard drive is cloned. It is worth taking some time to understand the differences and the advantages and disadvantages of each process. Forensic Imaging A forensic image or evidence file container (such as

January 29, 2009

Recovering Deleted Email

It’s important to understand that deleted email is not recovered or indexed using common litigation support or electronic discovery software. These applications only process email that is still visible within the email software. Some email recovery software can also fall short when restoring deleted email records. Why is that? Because they are designed to undelete email records that still have an entry in the mail

January 27, 2009

Secretly Copying Files To An External USB Drive

Copying corporate data and using it at a competing company (intellectual property/corporate asset theft) is a common and serious concern for companies and their legal counsel. When employees leave companies, there are often questions about the security of the information they previously accessed. Will they use the contacts, forms, or product details as a competitive advantage in their new job? I had previously written about

November 21, 2008

Recovering Files From Unallocated Space

Recovering data from a hard drive is one of the most common tasks during a computer investigation. Here are a few of the artifacts which computer investigators may retrieve from unallocated (free) space to assist in a case: * MS Office documents * Acrobat files (.pdf) * Email messages and attachments * Images in various formats * Internet history (pages visited, searches) * Registry files

November 19, 2008

Preserving Suspect Media (Write Blockers)

When examining or processing the files on a hard drive, it is extremely important to retain the original file contents and time stamps. Many people don’t realize that just connecting a hard drive to a PC will alter the contents of the hard drive. In order to preserve the original contents of the hard drive, it is important to implement a write blocking mechanism. Law

October 7, 2008

Searching for Buried Treasure

Searching and identifying relevant content is a common process for both electronic discovery and computer forensic investigations. But some people don’t realize the challenges associated with indexing hundreds, or even thousands, of different file types and data structures. Mapping the data landscape may not immediately indicate where the textual “treasure” is located. Twenty years ago, full text searching was pretty simple. We usually had transcripts,

September 25, 2008