Electronic Evidence Joe Kashi Todays Program Types of - - PowerPoint PPT Presentation

Electronic Evidence

Joe Kashi

Today’s Program

 Types of Electronically stored information  Accessibility and effect upon discovery  Where and how to find ESI  ESI forensics and indicators of tampering  Revised FRCP regarding ESI  Some thoughts on authenticating photos  Demonstration of ESI forensic software  Electronic Brief demonstration

Electronically Stored Information (“ESI”)

 Used by revised FRCP as the “official” term of

art for electronic evidence FRCP 26,30,33,34,37

 ESI is pervasive

 recent studies conclude that ESI accounts for 93% -

to 98% of all original “documents”

 arguably, ESI is now the “best evidence”  Paper prints, though often easier to use in the

courtroom, are usually secondary copies

General Types of ESI

 Few original paper documents, mostly

signed or hand-written items

 Locally generated documents  Networks – local, enterprise, Internet  Personal Digital Assistants, i.e., Palm,

Blackberry, smart cell phones

Internet uploads and downloads

 Text, audio, video, photo, music  Personal web pages number in the tens of

millions; example “MySpace”

 Internet collaborative documents

 Usually free services  Example Google Docs

Third Party ESI

 Voice mail, typically stored on hard disks  Email, web hosting, Google Docs, usually

stored in about 4 locations

 Cell phones

 voice messaging  wireless video/photo/Email  GPS or cell tower locating

Non-computer ESI

 Fax and copier memory  Digital cameras and camcorders  Blackberry and iPod type devices  VHS, CD and DVD  Audio recorders

ESI - Is It Accessible?

 Critical distinction under new FRCP  If accessible, existence and location must be

disclosed as a matter of course during initial disclosures

 If not readily accessible, then other factors

become prominent, including whether to

• rder discovery, sampling of records, and

cost-shifting

Accessibility depends upon media type

 Active data

 Easily accessed dynamic data that can change

• r be lost due to ordinary use

 “Near line”

 Not everyday storage but can be mounted

and searched without too much difficulty.

 Examples: CD or DVD disks and backups,

portable hard disks, small USB “thumb” drives, digital camera memory cards

“Not Readily Accessible” ESI

 These may require significant effort to be

usable and searchable

 Examples:

 Backup tapes; each needs to be restored,

mounted and searched individually; often requires new hardware

 Old data or file formats not readable by

current software

Practical Guides for Trial Judges

 Guidelines for State Trial Courts Regarding

Discovery of Electronically Stored Evidence – Conference of Chief Justices, August 2006

 US District Court for the District of Kansas

pretrial order

 Zubulake and Coleman decisions  December 2006 revisions to FRCP  Sedona Principles

Preliminary Information

 Types of computer systems  How networked  IT personnel  How backed up and how often  Disaster Recovery Plans  Logging of activities – very useful  What programs are used?  File formats and data formats  What data is maintained and where

“Delete” does not mean deleted

 Persistence  Broad storage  Duplicative storage  Actually harder to discard than paper files  Automatic logging and System Registry  File fragments