Deleting may be easy, but your hard drive still tells all

It was only a single digit in a 20-page Microsoft Word contract between two partners, but Scott Cooper earned his fee several years ago when he found it.

Cooper, a computer forensics expert, learned that the numeral "1" had been scrubbed in some later versions of this digital document. This gave his client, a partner in a software firm that had recently been sold, just a 5 per cent rather than a 15 per cent share in the company. If the change had gone undetected, the partner would have received $32-million (U.S.) rather than his rightful $96-million payout.

What the partner did not realize was that digital data rarely goes away, even when erased. "It is extremely difficult to completely delete all evidence from a hard drive," said John Colbert, the chief executive of Guidance Software, which makes a widely used program that helps retrieve digital evidence.

Using various techniques, Cooper, the managing director of the Insync Consulting Group's electronic discovery and forensics practice, based in Los Angeles, figured out when the document had been changed and by whom. His client got his money.

To Continue Reading: Click Here
-----------------------------------------------
Source: theglobeandmail.com