Computer Forensics

The vast majority of documents created in today's corporate environment are done so in electronic form.

Current statistics indicate the following:

• 93% of corporate documents are created electronically.
• 70% of those are never printed in hardcopy.
• 3.4 billion e-mails are exchanged daily.

The initial starting point for conducting electronic discovery is documenting the methodology employed by your opponent for processing electronic information. At a minimum, the following following items should be addressed:

• How does your opponent's business or firm process electronic information?
• What unique and/or non-industry standard equipment or procedures may be employed.
• Identify ALL potential sources of evidence.
• Identify information system architecture
• Identify who within your opponents business/firm is responsible for
1. Maintaining and managing their information system.
2. Maintaining and managing the information storage program.

Once the location and procedures employed for storage of potential evidence has been identified. Then the issue of forensically securing the potential evidence is required. It is highly recommended that the data acquisition phase be conducted by a certified forensic investigator and accomplished in accordance with standard forensic principles.

The International Association of Computer Investigative Specialists (www.cops.org) provides the following guidelines for:

• The Basic Elements of a Forensic Examination