Electronic Data discovery plays a major role in an increasing number of court trials these days. Electronic detectives find murder, fraud or other important clues deep inside PC's, PDA's or other electronic devices, even if the owner of those devices tried to completely delete the incriminatory files. Here are some of the most common techniques used to discover hidden electronic data:
The "Why jump the fence when the door is open" method - The name says it all doesn't it. Before starting to dig deeper and deeper into the suspect's PC or handheld device, look for evident clues that were not deleted or hidden. It will save you a lot of time and it's the common thing to do. In 2000 a trial was postponed 2 months to give the detectives more time to dig into the suspect's computer, searching through hidden clusters, registries, file allocation units…when they finally realized they didn't check the actual information on his computer. Therefore they lost 2 months because of a simple error that could have easily been avoided.
"Backup Sources" - Data Backups are systems that protect from interruptions caused by physical disasters, files which become unreadable, and situations where data errors or deletions accidentally occur. Practically all companies regularly make data backups. These backups may be held by the business itself and/or by offsite storage services
"Reviewing E-mail correspondence" - Most of today's business data is transmitted through e-mails. Do not limit the searching to e-mails only. Open attachments on each e-mail that has one, because the data has a good chance of being there, not inside the e-mail itself.
"Reviewing the suspect's personal disks and home computer" - Employees often backup their own work (or the company's) on removable drives like floppy disks, CD's, DVD's, Memory Sticks, etc.. Even if the company he works in has a strict retention policy, important information might still be found on these personal disks or on home computers, laptops, etc..
"Examining a user's PDA" - Calendars, contact lists, meeting notes, and even Word and Excel files are now being stored on hand-held devices. As wireless networks continue to expand and memory storage grows, these devices become increasingly important.
"Window's Trash" - People constantly forget to disable the windows trash bin, or forget to empty it after deleting files. This would also go well under the first point as it is an "open door" in a "high fence".