The Difference Between Computer Forensics and eDiscovery

GUEST BLOGGER

Phillip Rodokanakis, CFE, EnCE, ACE, DFCP
U.S. Data Forensics, LLC
Herndon, Va.

In my previous posts, “Computer Forensics: Following the Digital Bread Crumbs” and “eDiscovery: Digital Data Gives Birth to New Industry”, I covered computer/digital forensics and the emergence of eDiscovery as distinct and separate professions dealing with the handling of digital evidence. Although both these disciplines deal with digital data, there is some confusion as to how they differ. Digital forensics encompasses the entire universe of data stored on a hard disk drive (HDD), whereas eDiscovery usually only focuses on a smaller grouping of data stored on the drive.

Computer users are familiar with the meaning of used and free space on a HDD. In Microsoft Windows, a drive’s properties are depicted on a pie chart that shows the total disk storage capacity, as well as the used and free space. (See figure.)

In technical lingo, the free space is referred to as “unallocated clusters” while the used space is referred to as “allocated clusters.” In computer file systems, a cluster or allocation unit is the unit of disk space allotted for files and directories.

A simple way to understand the difference between eDiscovery and computer forensics is to think of the HDD allocation model. EDiscovery focuses on data stored in allocated clusters, while computer forensics deals with both allocated and unallocated clusters (i.e., the entire physical drive).

EDiscovery filters out program, temporary and system files, and processes only active user accessible files. This usually involves Microsoft or other Office Suite files (e.g., documents, spreadsheets, presentations, databases, PDFs, etc.) and emails. These types of files are then processed in an eDiscovery engine, where they are indexed and catalogued, and then usually loaded into a Litigation Support Platform (software designed to aid law firms in the process of document reviews in litigations; for more information see the American Bar Association website).

On the other hand, computer forensics investigates everything, including deleted files or remnants from former files that have been partially overwritten. A forensic examiner must pay particular attention to certain operating system and log files, temporary files and the file remnants found in unallocated clusters.

For example, data remnants (file artifacts) from web-surfing sessions, including accessing webmail accounts (e.g., Gmail, Hotmail, etc.) and chats, are usually found in temporary Internet files or unallocated clusters. Certain system files log information pertaining to external devices, accessed files, executable software, deleted files, etc.

Certified Fraud Examiners readily recognize the critical value of digital evidence in a fraud examination. They also need to fully understand the differences in eDiscovery and digital forensics in order to be able to seek appropriate technical advice and consulting services.  

eDiscovery: Digital Data Gives Birth to New Industry

GUEST BLOGGER

Phillip Rodokanakis, CFE, EnCE, ACE, DFCP
U.S. Data Forensics, LLC
Herndon, Va.

In the old days, sometime before 1975 B.C. (before computers), a company’s data production was usually produced in paper format only. That all changed when we began storing our data digitally. Some studies suggest that more than 90 percent of all new data is created digitally and perhaps more than 70 percent of that never migrates to paper.

In my last blog post, "Computer Forensics: Following the Digital Bread Crumbs," I addressed why CFEs must familiarize themselves with the type of data that can be obtained from digital forensic examinations. Although digital forensics got its start in the early 1990s, a newer discipline, Electronic Discovery or eDiscovery, has made major inroads in the 2000s.

Discovery is the process whereby civil litigants seek to obtain information from other parties based on the notion that the parties should not be subject to surprises at trial. Litigators employ a number of tools during the discovery phase, such as document requests, interrogatories, requests for admissions and depositions.

As the importance of Electronically Stored Information (ESI) has increased over the last decade, responding to discovery requests has become a significant management function and cost center for larger organizations. In response, a new industry was born to address eDiscovery. Surveys indicate that more than half of the firms surveyed use an outside company to collect, identify, verify, recover and produce ESI.

The creation of this new industry has brought to the scene a number of new players, not only in the companies that perform eDiscovery services, but in software vendors that have developed new applications capable of processing ESI data and provide for management review database platforms.

The plethora of new eDiscovery vendors means that many different and incompatible formats exist, as each vendor introduces new features and capabilities. Accordingly, it will take years for a few vendors to gain predominance.

ESI can also be produced in TIFF or PDF files, which are like a photograph of an electronic document. Alternatively, it can be produced in “native file format,” that is the format in which the information was created and used in the normal course of operations. Native format production is usually preferred, because it preserves the file metadata (i.e., data about the file, such as file creation date, last saved date, etc.). 

Tune in for my next post that will address the differences between eDiscovery and Digital Forensics.