Peer to Peer Magazine

40 Abide by the Basics of Forensics in an Increasingly Complex Digital World B Y H O P E S W A N C Y- H A S L A M I n the early days of ediscovery, digital forensics was a relatively simple business. For civil matters, back-up tapes of historical business dealings and email conversations posed the biggest challenge for most organizations due to the unknown data volume (and costs) concerns they posed. Mobile phones were still just that – mere mobile telephonic devices--and business use of the internet was in its infancy with limited instant messaging (IM) and texting functionality. Today, new forms of business communications and cloud applications are fast becoming a foundational component of running a business--along with employees armed with mobile devices including text, chat, and often a full array of personal productivity and business apps. And social media applications such as LinkedIn, Facebook and Twitter are all a part of that fabric. Hence, the list of potentially relevant evidence types that could be identified for preservation and collection has become a more complicated and challenging one to tackle. Fortunately, the fundamentals of digital forensics and the process of collecting potentially relevant digital evidence still apply – use reasonable care and best practices steps when collecting data to protect its evidentiary value, guard against altering it, document everything, and make forensic copies of all digital evidence as quickly as possible while only reviewing the evidence via these forensic copies. Not every organization has the financial wherewithal to take all these steps alongside a third-party forensic expert, but best practices steps—including a key understanding of data sources--should be taken to minimize the risk of a spoliation claim. Best Practices Steps 1 . C H A I N O F C U S T O D Y When the need for forensic imaging arises, whether working with a third-party examiner or internal IT team, it is imperative that a

• Cover