2013 Litigation Technology Update

Discovery should focus on the technologies storing data

Karl Epps explains how technology has changed in the last year, and what impact those changes have had on current and future standards for digital evidence.

Attorneys use forensic technology experts for digital discovery.  Whether the attorney represents the plaintiff or the defendant, it is beneficial for them to have a basic understanding of what changes occurred in 2012 that will have an impact on digital evidence in 2013 and beyond.

One evolving discovery issue is there are now removable flash drives which can store 128 GB of data.  This means that the target of discovery could be using a flash drive to store all the data being used.  If they pull the flash drive, the entire body of data is gone.  Because of this, the discovery motion must focus on the technology storing the data, not just on a computer or computer system.

In addition to the sheer magnitude of data that can be stored, the physical nature of hard drives is moving toward solid state.  Recovering data from solid state drives is very different from standard hard drives.  A qualified forensic technology expert will understand this difference and adapt to it.

2012 saw an increase in the rate of new and updated electronic devices being introduced to the market.  These new and updated devices include, for example, phones such as the Samsung Galaxy^® S3 and iPhone^® 5.  Apple also introduced three new iPad^® devices in 2012, the iPad^® 3 and 4 plus the iPad^® mini. Their line of iPod Nano^® and Touch^® devices were also updated, as were the MacBook^® and Mac PowerBook Air^®.  Every time a new device is released, the internal architecture may change, thus, your forensic technology expert must be constantly updating their skills and procedures.

An example of changes in computer architecture which require the forensic technology expert to change their discovery procedures is the manner in which hard drives are built into the devices.  It is becoming more common for hard drives to be built into the devices in a manner which makes removal impossible without altering the device.  As the mantra of computer forensics is “do no harm” and “make no changes,” it is arguably bad procedure to unsolder a drive to image it.  Removal of the drives for imaging purposes has been a traditional best practice in drive imaging.  The attorney should understand that the forensic technology expert, in many cases, will now be employing different imaging methods to enable them to avoid modifying the device.  This will be critical when challenging the methods of experts retained by opposing attorneys and your own experts.

In addition to changes and new releases in hardware, the software side of technology has also seen its share of changes and updates.  In the Apple^® world, Mac released their Lion OS (operating system), also known as OSX^® (10).  Apple also released the next iteration of their mobile device platform, iOS 6.  This upgrade serves both iPads and iPhones.  In the mobile phone world, Android^™ also offered an upgrade to their operating system called “jellybean.” 

Microsoft^® released a new Windows server platform, Windows Server 2012 and Microsoft Exchange was upgraded to a 2013 version, along with HyperV^®, Microsoft’s answer to virtualization.  Let us not forget Windows 8, Microsoft’s latest consumer OS.  Upgrades have also been made to MS Office for the PC, the 2013 version is now available. 

Just as changes in the hardware architecture require the forensic expert to modify their techniques, changes in software architecture also require modifications in examination and data mining techniques.

The changes discussed above will present counsel and their experts with new and different challenges, which must be met with forensically sound processes that can be performed to obtain evidence.  Rest assured that 2013 will see a new wave of technology releases which also must be addressed.  Your forensic technology expert will be busy staying current to provide you with the expert support you will require.  It is a good idea to stay in touch with your chosen expert in order to tailor your discovery requests to the evolving technological challenges.

Note that we have not touched on the discovery issues affected by storage of data in the “cloud” or social networking applications.  That will require an article all its own in another issue.

By Karl Epps

Karl Epps is certified in Computer Forensics with the EnCe certification. He has over 15 years of experience in computer systems and troubleshooting. He is a principal with Epps Forensic Consulting, PLLC, providing computer-related services through the firm’s Epps Tech division. Visit www.eppsforensics.com.