Cost Control: Digital Forensics – Part 2

To understand when and where to spend money on digital forensics, it is important to understand first what you are buying, then understand when it should be used. Stage 1 Acquisition (collection) is covered in Digital Forensics – Part 1.

Stages 2 and 3

Stages 2 and 3 are treated together because analysis without reporting is not particularly helpful.  Analysis is the process by which forensic experts utilize a variety of techniques and technologies to recover data and interpret the results.  This goes beyond your typical ediscovery processing of known and obvious data and is a specialized service only done by very skilled professionals—ideally.

“The evidence recovered is analyzed to reconstruct events or actions and to reach conclusions, work that can often be performed by less specialised staff. When an investigation is complete the data is presented, usually in the form of a written report, in lay persons’ terms.”  M Reith, C Carr, G Gunsch, “An examination of digital forensic models”. International Journal of Digital Evidence.

Recommendation:  This is an expensive service.  Before purchasing, be sure that you cannot gain the same results through “standard” ediscovery processing and review.  If you find that you do need this service, carefully consider your provider for proper qualifications and certifications.  An important heuristic if you move forward with analysis is to narrow the scope as much as possible.  Carefully consider which custodians and devices should be analyzed.  While you do not want to miss anything important, irrelevant or repetitive information can cause costs to soar to astronomical levels.

Look for additional information in Digital Forensics – Part 1 and 3. If you would like more information about eDiscovery or how TERIS solutions can assist you, please contact us!