Don't Mess With System Metadata

Why do people who know better than to traipse through crime scenes blithely muck about with digital smoking guns? With computers, it seems we must trip over the corpus delecti and grab the knife before we realize we're standing in a pool of blood!

Sometimes a computer holds evidence, and sometimes a computer is evidence. It's a distinction with a difference when deciding whether to act in ways that will stomp on data essential to computer forensic examination.

In most e-discovery efforts, computers are just digital file cabinets, and the evidence is the e-mail and files stored within. Just as paper records require a modicum of care to avoid ripping and staining, digital documents require preservation of basic metadata akin to date stamps and margin notes on paper documents. But, we needn't go to extraordinary lengths to protect this information. It's either embedded in the files and e-mail messages as application metadata, or stored by the operating system as accessible system metadata -- such as file names, folder locations and the dates files were created, modified and accessed. We use such stuff every day, so preserving it isn't rocket science and needn't be expensive or cumbersome.

But computers aren't always simply repositories of evidence. They may be the instrumentalities of a crime, tort or conduct under investigation, or carry clues to the origins and integrity of suspect electronic evidence. In these instances, the computers, too, are evidence -- virtual crime scenes where careless conduct compromises outcomes and diligence demands scrupulous protection and analysis of the revealing, complex and obscure data about data they hold. Now, we do have to go to extraordinary lengths to protect the information.

In civil litigation, computer forensic examiners often see the evidence only after some well-meaning soul has poked around and unwittingly changed last access dates and registry values. That's the trade-off: Without that first look, the misconduct might have been discovered too late or overlooked altogether.

To Continue Reading: Click Here
----------------------------------------------
Source: law.com
By: Craig Ball