Co-authored by David Rostov
There is a fair amount of confusion regarding collections of client data. To help guide your approach to collections, we have provided an overview of the top five questions and their answers.
How should collections be performed?
· All data collections should be performed in a forensically sound manner. This means that the collection should done using sound, defensible manner using industry accepted tools and procedures. The collection should produce an accurate representation of the source evidence.
Targeted Collection versus Full Forensic Collection?
· A targeted collection includes only active files deemed relevant to the case (e.g. emails and Microsoft office documents).
- Reduces cost and time due to faster collection time and less data.
- It does not preserve deleted data.
- Some additional spoliation risk.
- The methodology may be easier to challenge in court.
· A forensic collection is a bit-for-bit copy of the entire hard drive including all active files, deleted files, file fragments and blank space.
- Preserves all data reducing the risk of spoliation.
- Has greater legal defensibility.
- However, it is more expensive.
If files are deleted, what can be recovered?
· When the content of the file remains on the drive AND
o Files are in the Windows Recycle Bin;
o Files have not been overwritten by a new file;
o Files are partially overwritten.
· When the content is in a PST AND
o The damaged/corrupted files, “Deleted Items” files and partially overwritten files are identified and recovered into a new PST file.
If files are deleted, what cannot be recovered?
· Files that were completely overwritten with new files.
· Drives that were “wiped” using wiping software.
· Drives that were physically damaged and cannot be repaired
(even in a lab environment).
What are the leading industry software tools for collection?
· EnCase and FTK Imager for forensic collections.
o This is the “gold” standard used by law enforcement as well.
· Paraben’s Device Seizure for cell phone collections.
· Microsoft ExMerge for Exchange server collection.
· Microsoft Robocopy often used for Targeted Collections.
· Microsoft NTBackup for backup files (.bkf).
· Symantec Norton Ghost for backup and recovering files.