The Death of Imaging

Lawyers and electronic discovery pundits have argued for years over the merits of forensic media imaging, or imaging for short, as a means of capturing electronically stored information (ESI).

Imaging captures the greatest volume of raw data, but it also dramatically increases the financial burden on the producing party. The debate focuses on whether and when imaging should be used for forensic work due to its inherent high price tag.

As I see it, the entire argument is without purpose. Imaging has its uses, but storage technologies will soon make it obsolete. Live file extraction will become the de facto method of gathering ESI. The death of imaging is upon us and its passing will have a profound effect on the e-discovery industry. In essence, the death of imaging means potentially relevant electronic evidence will be missed, making it harder for the courts to get to the truth of matters before them.

Industry Confusion

Before delving into why I see the era of imaging coming to a close, I’d like to define what the term means. Lawyers, computer forensic investigators and others misuse the term often, sowing confusion throughout the industry.

Here’s what imaging means, as most IT workers understand it: The electronic, bit-for-bit duplication of an entire targeted storage medium. For example, if the medium is a hard disk drive, imaging means the electronic duplication of all storage areas of the drive, both used and unused. That includes active or live files, deleted files, slack space, unallocated space and drive free space. Everything.

To Continue Reading: Click Here
----------------------------------------------------
Source: eddupdate.com
By: Eric P. Blank