Electronic Discovery Navigator

Cloud computing crime poses unique forensics challenges

Cloud computing crime poses unique forensics challenges

"As cloud computing becomes more widespread, its use in criminal activity will likely grow. Authorities will need better forensic tools if they're going to extract evidence from cloud-based environments.

Cloud services are relatively new, insofar as use by the general public for storage is concerned, said Martin Novak, physical scientist at the National Institute of Justice (NIJ). Over time, it's expected that clouds will contain more and more evidence of criminal activity. To help extract that evidence, the Department of Justice's research arm, the NIJ, recently revealed plans to fund research into improved electronic forensics in several areas, including the cloud."

Forensic Innovations' Detects TrueCrypt and Other Encrypted Files Intentionally Hidden From Computer Forensics Tools

Forensic Innovations' Detects TrueCrypt and Other Encrypted Files Intentionally Hidden From Computer Forensics Tools

"Raising the bar in the Electronic Discovery industry, Fishers based Forensic Innovations, Inc. is now able to detect TrueCrypt, and other encryption data hiding techniques. The newly released File Investigator version 2.23 continues in their plan of supporting more file types (currently supporting 3,312) than any other product in the industry. Along with the 141 added file types, the accuracy of 78 existing file types was improved. Add to that the ability to identify more encryption file formats (including the elusive TrueCrypt) , and this version is truly a leap forward in advancing the state of the art in the analysis and filtering of Electronically Stored Information (ESI). http://www.forensicinnovations.com.

TrueCrypt has earned a reputation for simplifying the process of encrypting your data, as well as hiding it. On their web site, www.TrueCrypt.org, they claim that "no TrueCrypt volume can be identified (volumes cannot be distinguished from random data)." That was true, until now. "

The Smoking Gun in Your Adversary's Hard Drive

The Smoking Gun in Your Adversary's Hard Drive

"If we value the pursuit of knowledge, we must be free to follow wherever that search may lead us." -- Adlai E. Stevenson Jr. (American politician, 1900-1965).

Since the e-discovery related amendments to the Federal Rules of Civil Procedure in December 2006, it has become increasingly common for litigants to seek complete copies, or images, of computer hard drives from their adversaries. Not all appreciate, however, that such requests are not likely to be supported by the court in the absence of special circumstances that justify such an invasive and often overreaching demand.

This article will discuss how the rules and court decisions have addressed the propriety and parameters of hard drive image requests.

Pursuant to Federal Rule of Civil Procedure 34, a party may certainly request copies of electronically stored information maintained by an adversary. In particular, Rule 34 permits a party "to inspect, copy, test, or sample any designated documents or electronically stored information." While there is no doubt as to a party's right to request duplication of relevant electronic data, requests calling for complete copies of a party's computer hard drives for searching and production of select ESI are often met with resistance."

An introduction to computer forensics

An introduction to computer forensics

"However, this is a very old technique but now it has been changed a lot because of technological advances, modern tools and software’s which makes Computer Forensics much easier for Computer Forensic Experts to find & restore more evidence/data faster and with more accuracy.

Computer forensics has change the way digital evidence is gathered & used as evidence of a crime & it is done using advanced techniques and professional carpet cleaners A computer forensic expert uses these techniques to discover evidence from an electronic storage device for a possible crime. The data can be from any kind of electronic device like Pen drives, discs, tapes, handhelds, PDAs, memory stick, Emails, logs, hidden or deleted files etc.

Most of us think that deleting a file or history will remove it completely from the hard disk drive. In realty, it only removes the file from the location but the actual file still remains on your computer. It is easier to track what has been done on your computer upholstery cleaning berkeley difficult to say by whom though it is possible to alter or delete the data completely from your storage device. It depends on computer forensic expert’s skills how well he can find and restore the data without any loss or change."

Texas law turns companies with eDiscovery data into private eyes

Texas law turns companies with eDiscovery data into private eyes

"Businesses in Texas that work in the eDiscovery area and amass and store and search digital data could need a private investigator's license as a result of a ridiculous new law in Texas."

Special Masters And Court-Appointed Experts Save Electronic Discovery Costs

Special Masters And Court-Appointed Experts Save Electronic Discovery Costs

"In litigation between competitors, protective orders alone are an insufficient means of solving confidentiality issues. This is particularly true when large databases and other collections of electronic information are at issue. For example, theft of trade secret lawsuits between employers and their former employees continue to increase. The proliferation of electronic data, and the ease of personal storage devices that allow such data to be copied and removed (see Personal Storage Devices Create Workplace Challenges) contribute to the frequency of these allegations.

Computer forensics is a tool of choice in these cases, particularly when concerns about data erasure exist. However, the strength of forensics as a discovery tool also creates privacy and relevancy concerns that limit computer forensics’ uncontrolled use. Once a mirror image of a disk has been made, the party in receipt of the copy has ALL information on the disk – include other proprietary information and private data that has nothing to do with the allegations at issue."

From RSA: Forensics tools, techniques aid e-discovery investigations

From RSA: Forensics tools, techniques aid e-discovery investigations

"Forensics tools and techniques can help drive so-called “e-discovery” investigations, Dennis (Jaime) Seibert, a lead forensics investigator in the information security incidence response team at Fifth Third Bank, a regional financial institution in Cincinnati, Ohio, told RSA attendees on Wednesday.

E-discovery investigations can look into the alleged wrong-doings of a terminated employee and/or provide electronic records for use in corporate litigation, Seibert noted in his presentation, titled “Electronic Discovery and Forensics in the Corporate Environment.” Forensics tools and techniques, he noted, are increasingly being used to provide relevant evidence related to e-discovery projects, such as those that investigate fraud or employee misuse of corporate IT resources, Seibert noted."

US judge orders Biovail founder to turn over laptop

US judge orders Biovail founder to turn over laptop 

"A former Bank of America Corp stock analyst who is suing drug maker Biovail Corp for defamation can conduct a forensic search of company founder Eugene Melnyk's laptop computer for deleted e-mails, a judge has ruled.

The ruling permits Jerry Treppel, the plaintiff, to search for additional electronic evidence that could be relevant to his case. Treppel sued the Canadian company and Melnyk in 2003, claiming they launched a smear campaign against him after he urged investors to sell the stock.

The defendants deny the allegations.

The lawsuit in U.S. District Court in Manhattan is one of many legal headaches for Biovail, a specialty pharmaceutical company based outside Toronto."

Servient Forms New Computer Forensics Division -- Leading Computer Forensic Professionals to Head New Division

Servient Forms New Computer Forensics Division -- Leading Computer Forensic Professionals to Head New Division

"Servient Inc. announced today the formation of a computer forensics division to be known as Servient Forensics. Servient also announced the appointment of two seasoned computer forensics professionals to lead the new division's strategies and operations. Erica Garrison, CFE, EnCe, will serve as Senior Director of Electronic Discovery and Computer Forensics Services and Brian Larsen, EnCe, will serve as Director of Computer Forensics. The convergence of electronic discovery and computer forensics in the market lead Servient to this strategic decision.

"Electronic discovery and computer forensic disciplines are quickly consolidating," commented Servient's CEO, Ian Wilson. "In many recent engagements we have seen increasing requests for forensic collection and analysis in matters that were once considered straight electronic discovery projects, and cases that start with forensic analysis requests often evolve into high-volume electronic discovery matters. The increasing sophistication of litigators in the discovery of electronic evidence has resulted in an escalating demand for advanced, reliable solutions," Wilson continued, "and Servient Forensics rounds out Servient's market-leading offering."

Garrison brings significant computer forensics experience to Servient having directed numerous computer forensics and large electronic discovery projects, as well as fraud investigations. Garrison is a graduate of Texas A&M University and is a Certified Fraud Examiner and holds a computer forensics certification. She is a past president and current board member of the Houston, Texas chapter of the High Technology Investigation Association. "I have worked with Servient on many cases in the past and I am thrilled to join Servient. The Discovery Compass, Servient's online review system, is clearly the leading offering in the market and presents a powerful platform for us to deliver computer forensic projects in a market-changing way," Garrison noted."

NATO Deploys Guidance Software EnCase(R) Information Assurance for Forensic Approach to Computer Security Incident Response and Classified Spillage Auditing

NATO Deploys Guidance Software EnCase(R) Information Assurance for Forensic Approach to Computer Security Incident Response and Classified Spillage Auditing

"Guidance Software Inc. (NASDAQ: GUID), The World Leader in Digital Investigations(TM), today announced that the NATO Computer Incident Response Capability (NCIRC) has deployed Guidance Software's EnCase(R) Information Assurance technology to deliver comprehensive, forensic-level analysis across the network and automate crucial Information Assurance processes, such as incident response and remediation and classified spillage auditing. The software provides NATO's Communication and Information Systems Agency with an immediate and accurate view of what has happened on any one of its thousands of systems within seconds of an incident occurring, even if that system may be located thousands of miles away. It can now also proactively search for and audit classified sensitive information and instantly locate it on its networks."