 |
Litigation Support
Active Archive of Industry Mailing Lists
|
| View previous topic :: View next topic |
| Author |
Message |
Guest
Guest
|
 Posted: Thu Oct 22, 2009 10:04 pm Post subject: Forensic copy of HDD vs. lower-cost alternatives |
 |
|
I'm attempting to develop a repeatable process with the flexibility to accommodate a variety of discovery and regulatory requests. At issue here is the data contained on the HDDs of leased computers of in-house lawyers. The leases are about to expire and the data will be permanently wiped by the leasing company. Assume for the sake of this discussion there is a need to preserve data in anticipation of litigation. What are law firms doing to preserve the data from these leased HDDs. EnCase or FTK forensic image? Lower-level file copy using something like Altiris? Why?
Lacelle D. Porter
[Non-text portions of this message have been removed]
__._,_.___
Messages in this topic (1) Reply (via web post) | Start a new topic
Messages | Files | Photos | Links
Copyright 2008. The Litigation Support Mailing List
Post message: litsupport
List owner: litsupport-owner
To subscribe, unsubscribe or change delivery options, please go to:
http://groups.yahoo.com/group/litsupport
[/url]
[url=http://groups.yahoo.com/group/litsupport/join;_ylc=X3oDMTJkb3BqMzZvBF9TAzk3MzU5NzE0BGdycElkAzYwNTk2BGdycHNwSWQDMTcwNTAwMTM4MARzZWMDZnRyBHNsawNzdG5ncwRzdGltZQMxMjU2MjQ5MDY0]Change settings via the Web (Yahoo! ID required)
Change settings via email: Switch delivery to Daily Digest ([email]litsupport-digest?subject=Email Delivery: Digest[/email]) | Switch format to Traditional
Unsubscribe ([email]litsupport-unsubscribe?subject=[/email])
Recent Activity
Visit Your Group
Give Back
[url=http://us.lrd.yahoo.com/_ylc=X3oDMTJraGZrOWltBF9TAzk3MzU5NzE0BF9wAzEEZ3JwSWQDNjA1OTYEZ3Jwc3BJZAMxNzA1MDAxMzgwBHNlYwNuY21vZARzbGsDYnJhbmQEc3RpbWUDMTI1NjI0OTA2NA--;_ylg=1/SIG=11314uv3k/**http%3A//brand.yahoo.com/forgood]Yahoo! for Good[/url]
Get inspired
by a good cause.
Y! Toolbar
[url=http://us.lrd.yahoo.com/_ylc=X3oDMTJtaW1qYTVhBF9TAzk3MzU5NzE0BF9wAzIEZ3JwSWQDNjA1OTYEZ3Jwc3BJZAMxNzA1MDAxMzgwBHNlYwNuY21vZARzbGsDdG9vbGJhcgRzdGltZQMxMjU2MjQ5MDY0;_ylg=1/SIG=11c6dvmk9/**http%3A//toolbar.yahoo.com/%3F.cpdl=ygrps]Get it Free![/url]
easy 1-click access
to your groups.
Yahoo! Groups
Start a group
in 3 easy steps.
Connect with others.
.
[img]http://geo.yahoo.com/serv?s=97359714/grpId=60596/grpspId=1705001380/msgId=42598/stime=1256249064/nc1=1/nc2=2/nc3=3[/img]
__,_._,___ |
|
| Back to top |
|
 |
|
|
Guest
Guest
|
| Posted: Fri Oct 23, 2009 1:12 am Post subject: Forensic copy of HDD vs. lower-cost alternatives |
|
|
Without treading on any forensic toes, this is really an attorney call about
the nature of the potential preservation scope. Could they need deleted and
partial files? Or is the reasonable expectation that they need a full copy
of the actual OS level files with intact system metadata?
That will determine whether a physical image (Encase/FTK) or a logical image
(Ghost or other backup/collection style software) is required.
If counsel can make a judgment call, then you can price it.
Greg Buckles
Greg@Reason-eD.com ([email]Greg%40Reason-eD.com[/email])
(713) 530-3416
Fax (713) 589-7958
Practical process and technology consulting for corporate discovery
challenges
Check out the new E-Discovery Application
<http://www.reason-ed.com/reason-ed/matrix/> Matrix!
From: litsupport ([email]litsupport%40yahoogroups.com[/email]) [mailto:litsupport ([email]litsupport%40yahoogroups.com[/email])] On
Behalf Of ldporter@AOL.COM ([email]ldporter%40AOL.COM[/email])
Sent: Thursday, October 22, 2009 1:21 PM
To: litsupport ([email]litsupport%40yahoogroups.com[/email])
Subject: [litsupport] Forensic copy of HDD vs. lower-cost alternatives
I'm attempting to develop a repeatable process with the flexibility to
accommodate a variety of discovery and regulatory requests. At issue here is
the data contained on the HDDs of leased computers of in-house lawyers. The
leases are about to expire and the data will be permanently wiped by the
leasing company. Assume for the sake of this discussion there is a need to
preserve data in anticipation of litigation. What are law firms doing to
preserve the data from these leased HDDs. EnCase or FTK forensic image?
Lower-level file copy using something like Altiris? Why?
Lacelle D. Porter
[Non-text portions of this message have been removed]
[Non-text portions of this message have been removed]
__._,_.___
Messages in this topic (2) Reply (via web post) | Start a new topic
Messages | Files | Photos | Links
Copyright 2008. The Litigation Support Mailing List
Post message: litsupport
List owner: litsupport-owner
To subscribe, unsubscribe or change delivery options, please go to:
http://groups.yahoo.com/group/litsupport
[/url]
[url=http://groups.yahoo.com/group/litsupport/join;_ylc=X3oDMTJkNTE1b2V1BF9TAzk3MzU5NzE0BGdycElkAzYwNTk2BGdycHNwSWQDMTcwNTAwMTM4MARzZWMDZnRyBHNsawNzdG5ncwRzdGltZQMxMjU2MjYwMzM3]Change settings via the Web (Yahoo! ID required)
Change settings via email: Switch delivery to Daily Digest ([email]litsupport-digest?subject=Email Delivery: Digest[/email]) | Switch format to Traditional
Unsubscribe ([email]litsupport-unsubscribe?subject=[/email])
Recent Activity
Visit Your Group
Give Back
[url=http://us.lrd.yahoo.com/_ylc=X3oDMTJrb2pobTBmBF9TAzk3MzU5NzE0BF9wAzEEZ3JwSWQDNjA1OTYEZ3Jwc3BJZAMxNzA1MDAxMzgwBHNlYwNuY21vZARzbGsDYnJhbmQEc3RpbWUDMTI1NjI2MDMzNg--;_ylg=1/SIG=11314uv3k/**http%3A//brand.yahoo.com/forgood]Yahoo! for Good[/url]
Get inspired
by a good cause.
Y! Toolbar
[url=http://us.lrd.yahoo.com/_ylc=X3oDMTJtcjVzMWR0BF9TAzk3MzU5NzE0BF9wAzIEZ3JwSWQDNjA1OTYEZ3Jwc3BJZAMxNzA1MDAxMzgwBHNlYwNuY21vZARzbGsDdG9vbGJhcgRzdGltZQMxMjU2MjYwMzM2;_ylg=1/SIG=11c6dvmk9/**http%3A//toolbar.yahoo.com/%3F.cpdl=ygrps]Get it Free![/url]
easy 1-click access
to your groups.
Yahoo! Groups
Start a group
in 3 easy steps.
Connect with others.
.
[img]http://geo.yahoo.com/serv?s=97359714/grpId=60596/grpspId=1705001380/msgId=42599/stime=1256260337/nc1=1/nc2=2/nc3=3[/img]
__,_._,___ |
|
| Back to top |
|
|
|
|
Guest
Guest
|
| Posted: Fri Oct 23, 2009 1:14 am Post subject: Forensic copy of HDD vs. lower-cost alternatives |
|
|
Lacelle,
Is there any reason why the HDD's couldn't be removed and replaced with new HDD's?
In my opinion you would meet the preservation requirement and save the expense of the Forensic Imaging plus the cost of Forensically Wiping the drives before return of the laptops to the leasing agent.
Just my $0.02
Aubrey L. Owens, Jr.
inspire. innovate. implement.
direct: 804.244.0173
email: aubrey@oci-mgmt.com ([email]aubrey%40oci-mgmt.com[/email])
twitter: OCIMGMT
-----Original Message-----
From: ldporter@AOL.COM ([email]ldporter%40AOL.COM[/email])
Sent: Thursday, October 22, 2009 2:21 PM
To: litsupport ([email]litsupport%40yahoogroups.com[/email])
Subject: [litsupport] Forensic copy of HDD vs. lower-cost alternatives
I'm attempting to develop a repeatable process with the flexibility to accommodate a variety of discovery and regulatory requests. At issue here is the data contained on the HDDs of leased computers of in-house lawyers. The leases are about to expire and the data will be permanently wiped by the leasing company. Assume for the sake of this discussion there is a need to preserve data in anticipation of litigation. What are law firms doing to preserve the data from these leased HDDs. EnCase or FTK forensic image? Lower-level file copy using something like Altiris? Why?
Lacelle D. Porter
[Non-text portions of this message have been removed]
Messages in this topic (1) Reply (via web post) | Start a new topic
Messages | Files | Photos | Links
Copyright 2008. The Litigation Support Mailing List
Post message: litsupport ([email]litsupport%40yahoogroups.com[/email])
List owner: litsupport-owner ([email]litsupport-owner%40yahoogroups.com[/email])
To subscribe, unsubscribe or change delivery options, please go to:
http://groups.yahoo.com/group/litsupport
Change settings via the Web (Yahoo! ID required)
Chang
[The entire original message is not included]=
[Non-text portions of this message have been removed]
__._,_.___
Messages in this topic (3) Reply (via web post) | Start a new topic
Messages | Files | Photos | Links
Copyright 2008. The Litigation Support Mailing List
Post message: litsupport
List owner: litsupport-owner
To subscribe, unsubscribe or change delivery options, please go to:
http://groups.yahoo.com/group/litsupport
[/url]
[url=http://groups.yahoo.com/group/litsupport/join;_ylc=X3oDMTJkMmFiMnBmBF9TAzk3MzU5NzE0BGdycElkAzYwNTk2BGdycHNwSWQDMTcwNTAwMTM4MARzZWMDZnRyBHNsawNzdG5ncwRzdGltZQMxMjU2MjYwNDgz]Change settings via the Web (Yahoo! ID required)
Change settings via email: Switch delivery to Daily Digest ([email]litsupport-digest?subject=Email Delivery: Digest[/email]) | Switch format to Traditional
Unsubscribe ([email]litsupport-unsubscribe?subject=[/email])
Recent Activity
Visit Your Group
Give Back
[url=http://us.lrd.yahoo.com/_ylc=X3oDMTJrbGRjNzNnBF9TAzk3MzU5NzE0BF9wAzEEZ3JwSWQDNjA1OTYEZ3Jwc3BJZAMxNzA1MDAxMzgwBHNlYwNuY21vZARzbGsDYnJhbmQEc3RpbWUDMTI1NjI2MDQ4Mw--;_ylg=1/SIG=11314uv3k/**http%3A//brand.yahoo.com/forgood]Yahoo! for Good[/url]
Get inspired
by a good cause.
Y! Toolbar
[url=http://us.lrd.yahoo.com/_ylc=X3oDMTJtcHRsaGtzBF9TAzk3MzU5NzE0BF9wAzIEZ3JwSWQDNjA1OTYEZ3Jwc3BJZAMxNzA1MDAxMzgwBHNlYwNuY21vZARzbGsDdG9vbGJhcgRzdGltZQMxMjU2MjYwNDgz;_ylg=1/SIG=11c6dvmk9/**http%3A//toolbar.yahoo.com/%3F.cpdl=ygrps]Get it Free![/url]
easy 1-click access
to your groups.
Yahoo! Groups
Start a group
in 3 easy steps.
Connect with others.
.
[img]http://geo.yahoo.com/serv?s=97359714/grpId=60596/grpspId=1705001380/msgId=42600/stime=1256260483/nc1=1/nc2=2/nc3=3[/img]
__,_._,___ |
|
| Back to top |
|
|
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
Powered by phpBB © 2001, 2005 phpBB Group
|
Forum Subscriptions
FAQ
Search
Usergroups
Register
Profile
Log in to check your private messages
Log in
