Digital White Papers

LITIGATION AND PRACTICE SUPPORT 31 WWW.ILTANET.ORG | ILTA WHITE PAPER Data Collection: Embracing New Technology and Abandoning Old Paradigms JASON BERGERSON Jason Bergerson is the Director of Consulting Operations for Kroll Ontrack. He is a technological professional with over 20 years of experience performing data recoveries, collections, forensic analyses, expert reports and testimony in hundreds of cases and on thousands of pieces of media. Contact Jason at jbergerson@krollontrack.com. Leveraging New Tools Leveraging new tools –– or contemporary versions of older tools –– to capture data from these modern sources is a must. For instance, a useful method for bypassing encryption on a personal computer is live preservation, where an expert boots into an administrative account to collect a decrypted version of the drive. An even newer method to bypass encryption is remote login, which allows an individual to access and collect a decrypted version of the drive just as one would during live preservation. Experts can also access an active space, allowing them to apply filtering for dates, keywords and image files. These new tools are helpful, but they must be used carefully, even in the hands of experts. Live preservation, whether done in person or remotely, leaves a digital footprint that could raise questions of defensibility. Documentation of the process, tools and methods used is especially important in the live preservation model since the results will not be repeatable. Revising Workflows The established principles in data collection include reliability, repeatability and documentation. Rethinking these and adapting revised workflows can help legal teams and forensic analysts make beer use of old and new tools in working with new data sources. Validating the tools used through reliability testing on test data sets can help ensure the evidence collected is admissible in court. Documentation of the collection process is more important than ever as non-repeatable operations and live analysis become routine parts of the investigation process. Addressing Data Storage and Transport Legal teams also must address how they store and transport data. Some data sources or collection processes such as live preservation do not lend themselves to repeated collection efforts, so be sure not to overlook this part of the collection process. All digital evidence collected must be properly documented, labeled and inventoried. Thinking through how data must be transported is a factor in protecting the data's integrity. Keeping Collection in Mind "Water, water everywhere, nor any drop to drink." This line from Samuel Coleridge's 1798 poem "The Rime of the Ancient Mariner" was wrien long before modern technology and data collection, but it impeccably describes the struggles legal teams and investigators face during data collection. Data may be everywhere, but good luck accessing it. Collecting data from seemingly endless possible sources remains a fairly new frontier, one that requires legal teams and IT professionals to adopt new paradigms and adapt to new devices and data sources. Remember, though, that documenting the tools and methods used to protect the admissibility of evidence in court is not the pinnacle of data collection. Forward-thinking organizations will take every opportunity to embrace new paradigms long before they are required to do so by an investigation or litigation. As organizations learn how to manage data spread across a wide variety of places, companies will move past determining how to preserve or collect data on the backend and design their IT systems with easy and stress-free data collection in mind. ILTA BRIAN CALLA Brian Calla, Member at Eckert Seamans Cherin & Mellott, LLC, concentrates his practice on the area of general civil litigation with an emphasis on electronic discovery, mass tort litigation and product liability. Brian serves as an Electronic Discovery Special Masters panel member for the U.S. District Court for the Western District of Pennsylvania. Contact him at bcalla@eckertseamans.com.

• Cover