Computer Forensics vs. eDiscovery: What Does Your Case Need?

At a recent legal technology trade show I was overwhelmed at how many computer forensics and electronic discovery (aka eDiscovery or E-Discovery) companies are out there peddling services. I say peddling because many of them are brokers of the services and have never actually performed the service. Many of these brokers have mastered the basic lingo, so it is hard to tell they are not genuine providers. Upon asking the brokers I met — “what’s the difference between electronic discovery and computer forensics?” — I often drew blank stares, with several of them giving answers containing verbiage well outside their comfort zones. After being in this industry for over 18 years, and having spent 14 of those years at New Jersey Legal, the firm I founded, I feel the need to communicate some of the basic principles of forensics and electronic discovery with our clients. New Jersey Legal services over 500 law firms across the state annually, so I hope this reaches and helps some of you. I have diligently kept up with both computer forensics and electronic discovery by consulting with clients, attending classes, and sitting through countless “webinars” and seminars. From this variety of education, New Jersey Legal has developed educational manuals and offers courses on these services. My goal is to help you understand more about computer forensics and electronic discovery by presenting concepts as simply as possible. In subsequent blog posts I will gradually advance the concepts and the technical issues giving everyone a more advanced feel for both computer forensics and electronic discovery.

What are the general differences between computer forensics and electronic discovery services?

COMPUTER FORENSICS:

Computer forensics (technical definition) – is a branch of forensic science pertaining to legal evidence found in computers and digital storage mediums. Computer forensics is also known as digital forensics.

Not long ago, discovery consisted mainly of gathering paper documents, but today, it means not only collecting paper, but also collecting any related electronic data. If you think of the lifecycle of a legal case in 2009, most of the cases have to start with a forensically sound “Data Collection.” For this blog post we are going to keep it simple and limit the electronic data in this scenario to three main categories.

1. Loose electronic files (word docs, spreadsheets, PowerPoint files, etc… for example, what you might find in your “My Documents” folder)
2. Image files (Tiffs, jpegs, PDFs, etc… for example, photos or scanned documents you may have saved on your computer or attached to an email)
3. Email files (Mainly PSTs – these are electronic container files that may include emails, attachments, contacts, calendar items, etc… )

Performing a forensically sound and a court defensible data collection will require a Certified Computer Examiner (CCE). CCEs utilize computer forensics software and hardware to gather electronic data (data from computers, hard drives, disks, etc…). CCEs testify in court as to the collection methods used, they verify everything was collected, and they explain any issues or anomalies in the data if there were any. The process of identifying, gathering, and, in theory, cloning the data is called “forensic imaging”. When the CCE is “forensically imaging” a data storage device, they are basically taking a snapshot of the data in its entirety and in its current configuration. Part of this snapshot will include the unused space on your computer. This unused space may appear to be nothing of importance, but after analysis, a CCE may show that it houses deleted files that were never overwritten. In the normal course of computer use, you do not see any of this, but using computer forensic and restoration tools a CCE may reveal electronic files thought deleted and gone forever.

ELECTRONIC DISCOVERY:

Electronic Discovery, eDiscovery or E-Discovery is the discovery process as it applies to electronic records. These electronic records are referred to as ESI (Electronically Stored Information). Electronic Discovery is complex, but for simplicity, in this first post, we will define it as is “the actual processing of electronic data (ESI)”. For this E-Discovery example, let’s say our ESI (electronic data) was first collected or “imaged” by our CCE. Now we have to process the data in our eDiscovery platform. In this simplified example, the process will include the following:

1. Extracting all the text to allow key word searching.
2. Extracting out all of the metadata (metadata is “data about the data” – Medadata fields most commonly utilized in loose files are MAC times – modified, accessed, created. Metadata fields most commonly utilized for emails are – sent by, sent to, cc, bcc, dates, subject, etc…)
3. Identify any files where text extraction was not possible. Further processing will be needed for these files and this processing will be explained in a future blog post.
4. Cull down the data set by keyword, date range, and custodian searches.
5. At client’s request, export out all the relevant data and load files for Concordance, Summation, etc., or host the data on our web based platform, ImageDepot.
6. Once reviewed for privilege, we can export just the responsive data. This data is exported along with a specified “load file” that will allow the party receiving the data to load, into their system, all the records along with the associated metadata for each record.

Again, keeping it simple…

In short, computer forensic services are for collecting data, preserving data, and finding and restoring deleted data. E-Discovery services are for processing, culling, and delivering data. These simplified concepts should help get you started and serve as a guide when strategizing as your case begins.

Gary Overman
President
New Jersey Legal™

No related posts.

Cyber-Bullying: How Cell Phone and Computer Forensics Help (Part 2)

Last week we posted an update talking about the epidemic of cyber-bullying. Largely based upon psychological assault, cyber-bullying has been spreading through our school systems rapidly. The impact on some children has been so strong that, not only are they afraid to go to school, in some extreme cases treatment is required for a variety of mental disorders including anxiety and depression. In the most extreme cases children are even committing suicide as a result of the cyber-bullying. While our last post served as an introduction to the serious nature of this epidemic, this week we want to talk about the impact our services — in particular cell phone forensics and computer forensics — can have on these cases.

An article from the Star-Ledger was posted on NJ.com on Monday that discussed the need for strong protection against cyber-bullying for our children. For many of us, growing up we found bullying to be almost entirely face-to-face, regardless of whether you were on the receiving or giving end. While technology clearly brings many benefits and has provided an invaluable learning tool for many, it has also brought some negative and devastating repercussions:

Death threats are being made in text messages and e-mails and anonymous notes.

…

And now there is another complication: technology. In face-to-face bullying, victims know their tormentors. In the murky world of the internet, faceless bullies can do untold damage to reputations and psyches. And, unlike other abuse, cyber-bullying doesn’t stop when the school bell rings at the end of the day.

It’s no longer easy for these children to escape from this torture. It may not be a single bully they’re facing, but a mob of faceless, anonymous voices looking to be as ruthless as possible without any fear, and maybe knowledge, of the consequences. While education needs to be more strongly presented as a way to work towards prevention, there are ways of easily identifying abuses from these seemingly anonymous sources.

As we have noted in the past, not only does your computer store and track bits of information you’re unaware of, it also keeps your files and history even when you “delete” them by emptying the Recycle Bin on your desktop. Your emails, IMs, web browser history, cookies, passwords and more can be retrieved with ease. Some of the files we can retrieve will be years old, files you’ve probably forgotten you ever had. We’ve been able to retrieve partial and whole messages sent through MySpace, Facebook and other social networking sites and some of these messages contained incriminating evidence.

A very high percentage of children have cell phones now, most able to send text messages and many able to access email and the internet. Some phones like the iPhone and BlackBerry have applications and programs devoted to messaging and communication, allowing you to communicate with others 24/7, for better or worse. This also means that cell phones have become a goldmine for finding incriminating files for all sorts of crimes and wrongdoings.

For example, the iPhone takes a screenshot every time you press the ‘Home’ key and stores that screenshot on the phone. While this is done so that applications can startup faster and without seeming to delay, it also allows us to see many of the things you’ve seen on your phone. Emails, text messages, web sites, videos, calendar info, your contacts and just about anything else you’ll use your phone for can be found in these screenshots. From a cheating spouse’s secret affair to corporate fraud and theft to child pornography, cell phone forensics has allowed us to find incriminating evidence to a wide variety of offenses. With the increase in cyber-bullying this means many of the bully’s actions can be found through a fast cell phone analysis.

One of the hardware-based tools that we use for cell phone forensics allows us to image and analyze a cell phone within minutes. While the storage space on cell phones continues to grow, they still have only a small fraction of what the average personal computer does in hard drive capacity. The smaller size allows for faster imaging which means, when called into a law firm, corporation or school, we can have call logs, text messages, picture messages, videos, web browsing history and more within minutes.

Ultimately both cell phone forensics and computer forensics allows us to frequently find evidence of cyber-bullying. Whether it’s found in text messages, instant messages, emails, photos, videos or fake profiles, we have the tools to defensibly locate and present the facts in any cyber-bullying case, from middle schools to large corporations.

Related posts:

1. Cyber-Bullying: How Cell Phone and Computer Forensics Help (Part 1)
   Sally feels humiliated at lunch after tripping over an unfortunately placed backpack belonging to another student named Jenny. The more students in the lunchroom laugh at Sally, the more......
2. Captain Forensics Fights Cyber-Bullying
   Last week we put up a post on cyber-bullying. This is a terrible trend impacting children around the world in very serious, and even deadly, ways. While our blog......
3. What’s inside your child’s cell phone? (Part 2)
   A follow up to ‘Cell Phones for Children – A “Catch 22”?‘ Some of you may remember “Joe” from our last blog post and his experience with cell phone......
4. Computer Forensics vs. eDiscovery: What Does Your Case Need?
   At a recent legal technology trade show I was overwhelmed at how many computer forensics and electronic discovery (aka eDiscovery or E-Discovery) companies are out there peddling services. I......

Captain Forensics Fights Cyber-Bullying

Last week we put up a post on cyber-bullying. This is a terrible trend impacting children around the world in very serious, and even deadly, ways. While our blog posts here will focus more on the serious sides of these issues, we also have an outlet that lets people learn about these issues through a quick, easy to understand and fun method: comics. We’ve started a comic series titled “Captain Forensics” that deals mostly with computer forensics, cell phone forensics and eDiscovery topics and lets people of all ages learn while having some fun. Our most recent comic on Captain Forensics is beginning to deal with cyber-bullying and how cell phone forensics and computer forensics can help.

Captain Forensics is setup in a manner similar to our blog, where you can sign up to receive updates through your email. On both this site and Captain Forensics, the email updates box is on the lower right side of the page. By signing up to receive updates by email you’ll always have the most up-to-date postings in a very convenient location. You can read Captain Forensics by either clicking on this sentence or the image below.

For those of you who are local to us in the New Jersey area, these topics are often hitting close to home. A recent article in the Courier Post titled “Teens Caught ‘Sexting’ Face Porn Charges“states:

“This week in Spotsylvania, Va., two boys, ages 15 and 18, were charged with solicitation and possession of child porn with intent to distribute after an investigation found they sought nude pictures from three juveniles — one in elementary school.”

Clearly this is a much more serious problem than most people believe. The legal consequences these children face will stay with them for much of their lives. Cyber-bullying, ’sexting’ and other topics involving children and cell phones or the internet are showing a strong need for education and communication between authority figures and children as, the Courier Post article ends with:

“He required each to do community service and to ask peers if they knew sexting was a crime. They told O’Malley they surveyed 225 teens; 31 knew.”

Related posts:

1. Cyber-Bullying: How Cell Phone and Computer Forensics Help (Part 2)
   Last week we posted an update talking about the epidemic of cyber-bullying. Largely based upon psychological assault, cyber-bullying has been spreading through our school systems rapidly. The impact on......
2. Cyber-Bullying: How Cell Phone and Computer Forensics Help (Part 1)
   Sally feels humiliated at lunch after tripping over an unfortunately placed backpack belonging to another student named Jenny. The more students in the lunchroom laugh at Sally, the more......
3. Then & Now: New Jersey Legal celebrates 15 years in the industry
   I came across an old service list several months ago from the early days of New Jersey Legal. There was no date on the list, but I knew it......
4. What’s inside your child’s cell phone? (Part 2)
   A follow up to ‘Cell Phones for Children – A “Catch 22”?‘ Some of you may remember “Joe” from our last blog post and his experience with cell phone......

Cyber-Bullying: How Cell Phone and Computer Forensics Help (Part 1)

Sally feels humiliated at lunch after tripping over an unfortunately placed backpack belonging to another student named Jenny. The more students in the lunchroom laugh at Sally, the more her humiliation turns into anger. She harbors that anger until the end of the school day and then goes home.  Once in her room, she sits down in front of a computer and begins her retaliatory “payback.”

Sally sets up an anonymous Yahoo email account and sends Jenny an email that starts as something like:

“Dear Jenny: We watched you eat lunch today and you’re really disgusting…”

While writing the email, Sally grows more and more upset as she thinks back to the classmates laughing at her in the lunchroom and sends an extended email to Jenny that is full of derogatory comments. The next day, Sally goes to school and tells one of her friends about the clever “payback” email. They both think it was funny and decide they’re not done.  That weekend, the two of them go to work building a new MySpace site devoted to torturing Jenny.

They call the new MySpace profile “Jenny is a worthless #&$%!” and pretty soon, a half-dozen of their classmates are joining in on the fun — all anonymously, of course.

“Jenny’s a fat, ugly…[many harsh expletives]. Even her friends don’t like her. Somebody should tell her just how much we hate her and the world would be a better place without her.”

When Jenny finds out about the MySpace site, she is shocked. She had no idea somebody – anybody — hated her.

Jenny tells herself to just ignore it and hopes that it will go away, but down deep, she’s devastated. She doesn’t say anything about it to her parents or her friends. It’s too embarrassing. Every day, she sinks a little lower until, finally, her parents ask her if something’s wrong!  They begin to worry about the changes in her behavior…

It’s called cyber-bullying!  It’s becoming more common than ever and can be found in middle schools, high schools, colleges and even work places across the country. It’s spreading like a virus, which is why school districts all over the country are starting to – and those which haven’t, need to — institute programs and policies to deal with it.

Thousands, if not millions, of children across the country have been affected to the point where they have dropped out of school, required treatment for depression or even killed themselves as a result of this new and, unfortunately, very effective form of psychological assault.

According to a two-year-old study by the National Council on Crime Prevention, 43 percent of teens surveyed have been victims of cyber-bullying. A full three out of four children (yes, 75%!) have visited a Web site bashing another child and some 81 percent of teens say their peers engage in this sort of thing because “they think it’s funny.”

Studies like this have become quite common. Here are some stats:

• When teens were asked why they think others cyberbully, 81 percent  said that cyberbullies think it’s funny.
• Of 350 college students surveyed in Virginia and Illinois, she said, about 60 percent said they had experienced cyber-bullying.
• Forty-four percent of the boys say that they’ve seen sexual images of girls in their school, and about 15 percent of them are disseminating those images when they break up with the girls.
• Nichols said that 42 percent of children with access to the Internet report seeing online inappropriate, abusive or untrue information regarding someone they know, but only 10 percent ever tell a parent.
• According to a recent study, 20 percent of 13- to 19-year-olds have electronically posted or sent naked or semi-naked photos of themselves.
• Bullying is widespread, with nearly one-third of all students are involved in an incident each year, experts say. The effect on victims can be severe, ranging from academic failure and physical injuries to depression and even suicide. As for bullies, 60 percent of them have a criminal conviction by age 24, national statistics show.

The most famous involved a girl named Megan Meier, a Missouri girl who killed herself after being told, “The world would be a better place without you,” by a boy Megan fell in love with named Josh Evans.

It turned out though, that Josh Evans never existed. Josh was invented by a woman named Lori Drew, the mother of a former friend of Megan’s. Drew reportedly created Josh to gain Megan’s trust and affection with the ultimate goal of crushing her emotionally.  Clearly, Lori Drew got what she wanted.

Schools can only do so much, it’s really up to parents to know whether their children are involved in cyber-bullying. Statistics show only one child in 10 tells an adult when they are being targeted. That means 90 percent of our children are either suffering in silence or trying to deal with the harassment themselves.

As parents, we know that growing up is full of obstacles and is challenging enough with out having to also deal with cyber jerks! Parents are trying to keep track of what their children are being exposed to, but it is very difficult as peers can attack 24/7.  Unfortunately there is no manual for managing technology for your children, just as there is no manual for perfect parenting.

Talk to your child and find out if they, or someone they know, have ever been involved in cyber-bullying. Together, discuss cyber-bullying and give your children a better way of handling these difficulties, rather than leaving them to rely on coping through text messages, emails, IMs or social networks. Simply letting them know you are aware of cyber-bullying is the first step to keeping an open line of communication if there is an incident.

If you need help getting started, please feel free to give New Jersey Legal a call.  We are called on frequently to analyze and download information from hand held devices, like cell phones, iPhones, and BlackBerry phones, as well as computers in order to help parents and/or counselors begin the process of dealing with issues like cyber-bullying. We can be reached by phone at (856) 910-0202 or by email at info@njlc.net.

We’re working with parents and counselors to help them make educated and informed decisions in handling cases of cyber-bullying. Check back soon for part two to see how we’re doing that.

Related posts:

1. Cyber-Bullying: How Cell Phone and Computer Forensics Help (Part 2)
   Last week we posted an update talking about the epidemic of cyber-bullying. Largely based upon psychological assault, cyber-bullying has been spreading through our school systems rapidly. The impact on......
2. Captain Forensics Fights Cyber-Bullying
   Last week we put up a post on cyber-bullying. This is a terrible trend impacting children around the world in very serious, and even deadly, ways. While our blog......
3. What’s inside your child’s cell phone? (Part 2)
   A follow up to ‘Cell Phones for Children – A “Catch 22”?‘ Some of you may remember “Joe” from our last blog post and his experience with cell phone......