Discovery And Backups

The stored data which might be discoverable is called Electronically Stored Information (ESI). The ability to totally destroy or delete ESI is reduced if data is backed up either on or off-site. Totally deleting data isn't a trivial task, because the most common way to delete a file is to remove its beginning file number/letter character and make that disk area available for another file. Until that specific file location has been overwritten, the deleted file is still accessible and recoverable.

Today's operating systems will offer to "securely" remove files, however this isn't fail-safe. Commercially available scrubbing programs do more than merely remove files, they write over the data file locations several times with random characters, so that the removed data file gets "scrubbed clean".

However, the only "failsafe" way of destroying stored information is to destroy physically all hard drives or other storage devices or systems, that the data file has ever been stored. Physical destruction of a computer or device data can include at least one action to destroy the media the data file resides on; including shredding the media, burning or melting the media, generous application of a big hammer, degaussing, etc. If a file has ever been sent through the internet, it may never be completely removed.

Electronic discovery of electronically stored info (ESI) can be accomplished onsite, off-site, online or offline. In civil matters, most information available off-site and off-line is obtained with the use of Subpoena Duces Tecums (SDTs).

The data which may be asked for with SDTs is usually within the scope of Federal Rules of Civil Procedure (FRCP) 34(a). When SDTs demand document(s) and thing(s) that aren't stored on paper, one must still take care to insure the data is accessible, usable, and admissible at court. The defendant or witness is most often compelled to disclose the formats of the ESI, and all needed passwords, to allow that data to be examined by an agent of the court when the court specifies.

Whether criminal or civil, either in matters of trade secrets or with malware, or when all other data-related evidence is required; the electronically stored information (ESI) must be captured. The handling of ESI, once captured, is subject to the same chains of custody challenges as all other evidence types are. Yet, in ESI situations, as there's not any paper documents, the storage and handling of ESI must be carefully handled by people specially trained for these kind of matters. Analysis and evidence gathering by cyber-forensic technicians is done with a digital copy of the original drive or media that is subject to examination. Their goal is to avoid any chance of harm getting done to the original evidence.

In some instances, particularly when law enforcement is involved, the court might order computers to be seized for forensic analysis, or can order a clandestine incursion under a disguise of a search warrant, or another type of subpoena.

When critical evidence is needed, and there's a risk that the evidence might get deleted, modified, or destroyed; the means of electronic discovery might be expedited by hacking into a network system or computer. Most occurrences of hacking into a network or computer under those conditions is conducted by government agencies with search warrants. The type of data that is usually examined is suspected of storing evidence of theft of trade secrets, financial crimes, or other internet-related potential crimes.

http://www.JudgmentBuy.com - Judgment Recovery. The free, easiest, best and fastest way to recover your judgment money in all 50 states for 33% or less, worldwide for 50%. Mark D. Shapiro - Why assign your judgment?

Related Articles - electronic discovery, discovery of electronic data, ESI, SDTs and data, data and SDTs, discovering electronic data,

Email this Article to a Friend! Receive Articles like this one direct to your email box! Subscribe for free today!