Home | Business News | Browse by Publication | T | Trial

Success in electronic discovery: you can't limit your discovery to paper in this high-tech world. Dig deep in computer systems, Web pages, and other electronic treasure troves to uncover your opponent's digital secrets.

Article Excerpt
With the trend toward the paperless office, there is more to discover in a corporation's computer network than there is in its filing cabinets. Today, most corporate information is created, edited, accessed, communicated, stored, and deleted electronically.

The digital format has changed the way we move, store, and track information. Understanding and discovering electronic data is an important skill for trial lawyers, particularly those who battle corporations.

Discovering information electronically has many advantages. There is more information in the electronic medium than on paper, including databases, server logs, storage records, and other data that are never duplicated on paper. Lawyers who limit their discovery to paper-document production will miss a plethora of electronic evidence.

Computer systems

Many servers, network-operating systems, and software packages automatically log activity, noting useful tracking information such as who contacted whom at what date and time and who worked on what file. A desktop computer may contain its user's Web-browsing history, even if the browser's cache was emptied. Also, a seemingly simple electronic document may contain hidden digital notes, called metadata, showing any alterations and revisions, unprinted text, and whether the document was pre- or post-dated.

For example, Microsoft Word users should be careful when they use the "track changes" feature. You must check the "warn" box to ensure that the program removes tracking information before you send files to clients or attorneys, so that recipients cannot see your possibly confidential changes even after you remove them. (Microsoft specifically added this option to WordXP due to several complaints from angry attorneys.) Corel Word Perfect also lets you insert text (called "comments") that does not print to a hard copy but is visible on screen.

A "deleted" document can reside on a computer's hard drive for many years--the data may not be permanently erased. The typical hard drive stores information in many areas, some of which are hidden from the common user. Allocated areas are those currently in use by the operating system and contain both active files and deleted files that remain in the computer's recycle bin. The unallocated area of the hard drive contains files that were previously used, such as swap files and deleted files. You may find incriminating files in this area that your opponent thought were long gone.

Another area of the hard drive--slack space--is the unused space left at the end of a file. This area could be explored for useful evidence as well. Investigating unallocated space often requires assistance from a computer forensic expert.

Generally, data are not truly deleted from a computer until new data overwrite them. But with the ever-expanding size of today's hard drives, a computer may never need to overwrite. Even when part of a deleted file is overwritten, substantial "fragments" often remain; they may contain enough text to prove the nature...

View this article FREE - Now for a Limited Time, try Goliath Business News
Free for 3 Days!