[E-DISCOVERY]
Electronic discovery, also known as E-Discovery refers to methods used to preserve, collect, and review Electronically Stored Information (ESL) for the purpose of using it as evidence to present at trial.
ACQUISITION
IMAGING
DATA REVIEW
When you perform Forensic Acquisition, you are essentially performing imaging of drive. This type of E-Discovery will provide examiners with basic information like what files are being stored on the drive. When you back up your hard drive to an external drive, or to the cloud, you are making an “image” of the drive.
To perform computer Forensic Imaging, you need special software. Unlike a “backup” of a hard drive which mostly shows what files are on a computer, a full forensic image is clone of the entire hard drive. You can see everything that is on the drive, everything that has been deleted, and any and all activity including time stamps, who was logged in, Etc.
Data review is the process by which we convert the raw data into a searchable database. This allows attorneys to “mine” the database for evidence they can use to produce exhibits for trial presentation. After we have completed extraction and preservation of all of the information requested for discovery, we end up with a massive amount of data in no particular order or format.