Archives

Facing litigation and having to produce company documents to third parties can be an unsettling experience. Some businesses react to this by attempting to do as much of the identification, preservation and collection work in-house, using either company staff or their trusted IT consultants. While this sounds like a good idea for keeping as much …

E-mail messages contain numerous metadata fields that are utilized by computer forensic examiners as well as legal teams. One key MAPI property that is frequently extracted by computer forensics and e-Discovery software, but yet usually overlooked or underutilized, is PR_CONVERSATION_INDEX. This property indicates the relative position of a message within a conversation thread and is …

File names are stored as strings in almost every operating system and database management system. While this works well in most cases, it causes files with names containing numerals to be sorted counter intuitively. For example, contents of a folder containing 7 files with numeric suffixes would ordinarily look as follows: Exhibit1.pdf Exhibit10.pdf Exhibit15.pdf Exhibit2.pdf …

Date/time information extracted from e-mails and electronic documents is a major aspect of electronic evidence. In order to interpret and display the extracted timestamps correctly, most digital forensics and e-Discovery software require the end user to specify a time zone. The selected time zone can have numerous effects such as the appearance of timestamps on …

Most legal professionals regularly handle electronic evidence in one form or another. Even if you are not an e-Discovery or computer forensics expert, there are steps you can take to make sure you are not spoiling electronic evidence. Most of us are aware of the fact that opening a file usually changes file metadata as …

Hard drives are used throughout the e-Discovery process both as a potential source of electronically stored information (ESI) and as a medium to transport data. Even a simple e-Discovery project may involve one or more hard drives changing custody a few times. Let’s assume that you received an external hard drive from a forensic examiner …