Home

	Submit Your Article
	Member Login
	Top Authors
	Recently Added Articles
	Most Popular Articles
	Submission Guidelines
	Categories
	RSS Feeds

For Everyone »

	Sitemap
	Add to Favorites
	Top Article Directories
	Top Web Directories

Directory »

	Link to us
	Directory

Computer Forensics vs. Electronic Discovery

© By: Michael Van Kets

The field of computer forensics was developed primarily by law enforcement personnel for investigating drug and financial crimes. Electronic discovery has its roots in the field of civil litigation support and deals with organizing electronic files...

Return to Article

You have permission to publish this article electronically or in print, free of charge, as long as you leave the article title, author name, body and resource box in tact (means No changes) with the links made active and you agree to our posted publisher terms of service.

Use the tools below to copy the article in plain text form, or you can copy it as HTML, ready to copy and paste directly into a web page.

Word Count Appx. : 423
Total Views : 216

HTML Version	<h1>Computer Forensics vs. Electronic Discovery</h1> © By: <a href='http://fileblogs.com/index.php?page=author&author_name=Michael+Van+Kets' target='_blank'>Michael Van Kets</a><br><br> Computer Forensics The field of computer forensics was developed primarily by law enforcement personnel for investigating drug and financial crimes. It employs strict protocols to gather information contained on a wide variety of electronic devices, using forensic procedures to locate deleted files and hidden information. Computer forensics tasks include capturing all the information contained on a specific electronic device by using either a forensic copy technique or by making an image of all or a portion of the device. A forensic copy provides an exact duplicate of the hard drive or storage device. None of the metadata, including the าlast accessed date,ำis changed from the original. However, the copy is a าliveำversion, so accessing the data on the copy,even only to าsee what is there,ำcan change this sensitive metadata. By contrast, making a forensic image of the required information puts a protective electronic wrapper around the entire collection. The collection can be viewed with special software, and the documents can be opened, extracted from the collection, and examined without changing the files or their metadata. Other forensic tasks include locating and accessing deleted files, finding partial files, tracking Internet history, cracking passwords, and detecting information located in the slack or unallocated space. Slack space is the area at the end of a specific cluster on a hard drive that contains no data; unallocated space contains the remnants of files that have been าdeletedำ but not erased from the device, as าdeletingำ simply removes the pointer to the location of a specific file on a hard drive, not the file itself. Electronic Discovery Electronic discovery has its roots in the field of civil litigation support and deals with organizing electronic files using their attached metadata. Because of the large volume encountered, these files are usually incorporated into a litigation retrieval system to allow review and production in an easy methodology. Legal data management principles are used, including redaction rules and production methodologies. Electronic discovery tasks usually begin after the files are captured. File metadata is used to organize and cull the collections. Documents can be examined in their native file format or converted to TIF or PDF images to allow for redaction and easy production. Common Capabilities, Different Philosophies Computer forensics and electronic discovery methodologies share some common capabilities. One is the ability to produce an inventory of the collection, allowing reviewers to quickly see what is present. Another is the ability to determine a common time zone to standardize date and time stamps across a collection. Without this standardization, an e-mail response may appear to have been created before the original e-mail.<br><br> About the Author:<br><br> American Document Management are specialized in <a href="http://amdoc.com/press_releases/2007.10_Critical_Decisions.shtml" title="Computer forensics">computer forensics</a> and <a href="http://amdoc.com/press_releases/2007.10_Critical_Decisions.shtml" title="Electronic discovery">Electronic discovery</a><br><br> Read more Articles on <a href='http://fileblogs.com/Customer-Service&category_19' target='_blank'>Customer Service</a> at <a href='http://fileblogs.com' target='_blank'>FileBlogs.com</a>
Plain Text Version	Computer Forensics vs. Electronic Discovery © By: Michael Van Kets Computer Forensics The field of computer forensics was developed primarily by law enforcement personnel for investigating drug and financial crimes. It employs strict protocols to gather information contained on a wide variety of electronic devices, using forensic procedures to locate deleted files and hidden information. Computer forensics tasks include capturing all the information contained on a specific electronic device by using either a forensic copy technique or by making an image of all or a portion of the device. A forensic copy provides an exact duplicate of the hard drive or storage device. None of the metadata, including the าlast accessed date,ำis changed from the original. However, the copy is a าliveำversion, so accessing the data on the copy,even only to าsee what is there,ำcan change this sensitive metadata. By contrast, making a forensic image of the required information puts a protective electronic wrapper around the entire collection. The collection can be viewed with special software, and the documents can be opened, extracted from the collection, and examined without changing the files or their metadata. Other forensic tasks include locating and accessing deleted files, finding partial files, tracking Internet history, cracking passwords, and detecting information located in the slack or unallocated space. Slack space is the area at the end of a specific cluster on a hard drive that contains no data; unallocated space contains the remnants of files that have been าdeletedำ but not erased from the device, as าdeletingำ simply removes the pointer to the location of a specific file on a hard drive, not the file itself. Electronic Discovery Electronic discovery has its roots in the field of civil litigation support and deals with organizing electronic files using their attached metadata. Because of the large volume encountered, these files are usually incorporated into a litigation retrieval system to allow review and production in an easy methodology. Legal data management principles are used, including redaction rules and production methodologies. Electronic discovery tasks usually begin after the files are captured. File metadata is used to organize and cull the collections. Documents can be examined in their native file format or converted to TIF or PDF images to allow for redaction and easy production. Common Capabilities, Different Philosophies Computer forensics and electronic discovery methodologies share some common capabilities. One is the ability to produce an inventory of the collection, allowing reviewers to quickly see what is present. Another is the ability to determine a common time zone to standardize date and time stamps across a collection. Without this standardization, an e-mail response may appear to have been created before the original e-mail. About the Author: American Document Management are specialized in computer forensics and Electronic discovery Read more Articles on Customer Service at FileBlogs.com
Article URL

See All articles From Author

For Authors »

For Everyone »

Free Newsletter »

Member Login »

Directory »

Computer Forensics vs. Electronic Discovery