Computer forensics for e-disclosure

Computer forensics
The field has been developed computer forensic primarily by those responsible for law enforcement in investigating drug and financial crimes. Work and strict protocols for the collection of information on a wide variety of electronic devices, using litigation to locate deleted files and hidden information.

Computer functions include forensic capture all the information on a particular electronic device using technical legal or copy by making a copy of all or part of the unit. Forensic provides an exact copy of a hard disk or other storage device. One of metadata, including date of last า accessible ำ are modified from the original. However, the copy is a copy า ำ alive even access data on a copy just to see what is า there ำ can modify this definition sensible.

However, what makes the image forensic information required is complex electronic protection across the entire group. Collection can be seen with a special program, and can open documents from the collection and examination of unmodified files or their own metadata.

Other tasks include legal locate and access files deleted and partial files find and trace the history of the Internet, and cracking passwords, and disclosure of information in the unallocated space or recession. The recession is an area of ​​the region at the end of a block on the hard disk containing data, unallocated space containing the remains of files that have been deleted but not erased า ำ the unit and remove า ำ just removes the file cursor to specific site on the hard drive, not the file itself.

Electronic discovery

Electronic discovery has its roots in the field of civil litigation support, and discusses the organization of electronic files using metadata. Due to large faces, and these files are generally included in the system to allow recovery litigation review and production methodology easy. Legal principles used to manage data, including the revision of the rules and methods of production.

Electronic discovery tasks usually begins after the capture files. Metadata are used to organize and classify groups of execution. Can scan documents in their original form or transformed into TIF or PDF images to allow easy review and production.

Joint capabilities, different philosophies

Computer forensics and e-discovery methodologies share some common capabilities. The first is the possibility of preparing an inventory of the group, which allows reviewers to quickly know what is. Another is the ability to identify a common time zone for the unification of the dates and times throughout the group. Without this consolidation, you can send a letter of response and seems to have been created before the original e-mail.