To minimize exposure to risk, many companies have employed a data retention process to aid in electronic discovery and computer forensics. Although both areas encompass the preservation and use of digital data, there are key differences between electronic discovery and digital forensics.
The Data Collection Process
Ediscovery is summarized as the process of collecting, preparing, reviewing, interpreting and producing electronic documents from hard disks and other forms of storage. During litigation, eDiscovery firms may be subpoenaed to give testimony on the methods a company used to collect the data. On the other hand, computer forensics involves the use of a forensic expert to protect data integrity and to bring forth the data stored on a hard disk. During discovery, forensic experts use particular software applications and may call forth analysts to provide their testimony as expert witnesses.
Reviewing and Interpreting Data
Another significant difference between both disciplines is the method used to analyze the data. Ediscovery firms typically do not analyze the data they collect. Additionally, they usually do not clarify the intent of a computer user and they generally don’t provide clients with legal advice. Ediscovery is the process of gathering all of the data and supplying the client’s legal counsel with the data and relevant tools, then allowing the client’s legal counsel to perform their own thorough review.
Forensic experts assist legal teams with producing evidence for their case. Forensic experts can also partner with attorneys to pinpoint keywords related to the case, and then cross-reference those keywords against the collected data. Forensic experts can discover encrypted information such as passwords, and they can access email messages and reassemble an Internet user’s history. An analyst will not only search for intact records, but will scan for deleted records and file fragments to attempt full recovery of the files needed to support or defend the claim.
The Roles Served by Both Disciplines
Unlike digital forensics, eDiscovery is not used to analyze or investigate data and its uses. It serves to gather and organize information that everyone can view, access and duplicate. If that data has been deleted or is unseen by the computer’s operating system, that information could possibly be retrieved with digital forensics, but not electronic discovery.
In the eDiscovery process, a computer forensic expert will need to be called upon at some point or another. An example of such a matter would be a company receiving a set of files on a hard drive. Once received, it is realized that the size of the data on the drive is less than what was anticipated and recorded. After further review, an employee is suspected of intentionally destroying information on the hard drive. A forensic specialist will be needed to determine if the claim of intentional destruction is true, and if so, how the data was destroyed by the user.
Although eDiscovery and digital forensics are very similar in nature, the key differences revolve around how the data is collected and presented, how it is reviewed and interpreted, how much data is involved, and whether professionals are needed to provide forensic data recovery. Forensics gather, preserve and restore data, and Ediscovery processes and delivers the data to the appropriate parties. Choosing a litigation support company with experience in both disciplines is crucial—technology leaders such as Teris.