Sunbelt Blog

Litigation Support: What’s involved with Computer Forensics?

Some litigation support services offer computer forensics as a service to law firms. The field of computer forensics is growing as businesses and consumers alike conduct business and personal transactions on computers, cell phones, and other electronic devices. In law cases, digital evidence is often stored on electronic devices. Sometimes the evidence is readily available to anyone who looks while other times, the evidence may be hidden or “wiped clean.” Either way, computer forensics experts can provide the litigation support that you need by going in and finding evidence.

Why Turn to Litigation Support Services to Search for Electronic Evidence?
If you’re in possession of a hard drive, Flash drive, CD, DVD, digital camera, or other media device that may contain evidence, it’s important to know where to look. For example, if you’re working on a divorce case and suspect that a digital camera contains explicit photos, casually looking at the camera’s memory card may not yield results. After all, the images may have been deleted to avoid discovery. However, litigation support services offering computer forensics have the expertise and tools to “undelete” files.  

Types of Electronic Evidence
Electronic evidence takes many forms including photos, videos, email messages, text messages, instant messages, word processing documents, spreadsheets, and Internet files. Using computer forensics utilities and techniques, computer experts can provide the litigation support that you need by digging in and finding the data.

Finding Hidden or Erased Data
Computers readily give up secrets. Web histories, temporary Internet files, and cookies are well known for revealing a user’s Web surfing habits. Because they are well known for this, many users know how to delete their tracks. However, did you know that some operating systems have what’s known as an index.dat file that keeps track of all URLs visited, even if Web histories have been erased? Many users don’t know this, but computer forensics do. This is but one example of the many resources available to computer forensics professionals.

Another common tool used in litigation support is data recovery software. Even if a hard disc, portable storage card, or digital camera has been erased or reformatted, data recovery software makes easy work of retrieving the so-called deleted files. Many computer users are unaware of how erasing and reformatting really work. Data isn’t actually erased during deletions or formatting. Rather, the data is removed from the computer’s index and the hard drive space where the data resides considered “available.” Until new data occupies that “available” space, the original data can be recovered.

Computer Forensics Certifications
Computer forensics certification programs validate the certificate holder’s expertise at computer investigations. Many programs exist ranging from general certifications such as the Certified Computer Forensics Examiner and Certified Electronic Evidence Collection Specialist to vendor-specific certifications such as Discover-e Certification and AccessData Certified Examiner. Like other forms of evidence, chain of custody practices are as important as the evidence itself. Choosing certified computer forensics experts helps to ensure that the evidence is gathered, documented, and secured in a manner acceptable to the courts.   

While litigation support services have typically focused on more traditional services, some are beginning to branch out into computer forensics. As always, look for demonstrated expertise in the given field. In this case, certification is an excellent starting point.

Have you outsourced computer forensics? Share your experiences.

Arizona Sets Metadata Precedent

A recent Arizona Supreme Court ruling that government agencies must release an electronic document's metadata has made the news in the state and is likely to set a precedent as other states grapple with public records laws. The unanimous late-October ruling overturned an earlier Arizona Court of Appeals ruling saying that metadata is not a public record.

In the October 2009 Opinion, Justice W. Scott Bales wrote, "We today hold that if a public entity maintains a public record in an electronic format, then the electronic version, including any embedded metadata, is subject to disclosure under our public records laws."

Metadata, or "data about data," is hidden information embedded into electronic documents. One of the easiest ways to understand metadata is to open a typical Microsoft Word document. When you open the document, you see the document's text, right? Let's say that the document is a letter. You will see the date as well as the text of the letter on your computer screen. However, dates can easily be changed in a Word processor. How do you know if the date displayed is the date the letter was written? Metadata will tell you. You can check this yourself in Word 2007 by clicking on the Office button, clicking Prepare, and then clicking Properties. (In earlier versions of Word, go to File > Properties).

At first, basic metadata will appear including the author of the document and any user-generated entries such as comments, keywords, and title. Click on Document Properties > Advanced Properties and then click on the Statistics tab to view additional metadata. Now, you will see the document's creation date as well as dates when the document was modified, accessed, and printed.

In fact, the Arizona ruling stems from employment discrimination case where a demoted police officer requested public records, which happened to be his supervisor's notes, from the City of Phoenix, received paper copies of the records, and then suspected that the original notes had been backdated. The metadata of the original document could confirm or deny those suspicions, but the city denied the officer's request, citing an over 50-year-old Arizona Supreme Court ruling.

The case made its way up to the Arizona Supreme Court which finally overturned the Court of Appeals ruling that the City of Phoenix did not need to provide the electronic record's metadata.
Justice Bales wrote, "The metadata in an electronic document is part of the underlying document; it does not stand on its own. When a public officer uses a computer to make a public record, the metadata forms part of the document as much as the words on the page. . ."

The issue of electronic documents and their underlying metadata isn't unique to Arizona. Arizona's opinion that metadata is part of the underlying document certainly gives us something to think about. Your thoughts? Will this ruling influence other public record laws across the United States? Should a document's creation date, modification date, print date, and other hidden data be disclosed along with the words on the page?

Benefits of Presentation Technology in Mediation

Presentation software is coming of age in the courtroom. However, are you investing the time to create compelling technological presentations in the mediation room? With only about two to three percent of all cases going to trial, using presentation technology during mediation makes sense. While you may be sitting across a conference table instead of appearing before a judge and a jury, a computerized presentation delivers numerous benefits in mediation.

Benefits of Presentation Technology
Let's start with the numbers. Within 72 hours after hearing an oral presentation, research reveals that only 10 percent is remembered. A visual presentation improves retention to about 20 percent. Combined, an audio/visual presentation improves memory retention up to 65 percent. In mediation, you don't have to convince a jury, but you do need to present your case. Ensure that your information is remembered by using presentation technology instead of delivering a speech.

For example, instead of discussing a medical procedure, use your presentation software to illustrate how the procedure is performed, enhancing it with a voiceover and onscreen bullet points. The other parties in the room will be far more likely to understand the procedure - and more importantly, they will be more likely to remember what was discussed a few days later.

Another advantage is that once you've created your presentation, it is packaged and ready to go. Instead of telling everyone to flip to a page in a report or look at an exhibit, a simple click of a button displays the exact document or exhibit that you are referencing. No more awkward fumbling or delays.

Using Presentation Technology
Numerous presentation technologies are available ranging from Microsoft PowerPoint to technologies specifically created for the legal profession. No matter which technology you select, mastering it before you attempt a presentation in mediation or the courtroom is crucial. Not only must you master the software and basic design concepts, you must also master setting up the equipment and controlling the presentation in a live environment.

Start by planning your presentation, just as you would if you were giving oral arguments. Once you have an outline, start building the presentation in the software. If your law firm has a standard template for these purposes use it. For example, your law firm's logo and color scheme may already be built into the template, making for a professional-looking background and consistency throughout the firm. If you're starting from scratch, be conservative with colors, fonts, backgrounds, graphics, sound effects, and animations. You want your message to come across, not the software's bells and whistles.

Common Presentation Mistakes
Common mistakes to avoid include:
• Cramming too much text onto a single screen
• Relying too heavily on visuals and forgetting to combine spoken elements. Remember that oral remarks or visuals alone have dramatically lower retention rates than when combined.
• Selecting difficult-to-read fonts or font sizes that are simply too small. Choose a san serif style font such as Helvetica or Arial.
• Choosing a busy background. Not only do patterned backgrounds add clutter to the screen, they also make it more difficult to read the text. Choose a solid, unobtrusive colored background or a subtle gradient.

If you're not technically savvy or if you are uninterested in the actual creation of the presentation, consider getting professional design help. If your law firm has a graphic designer on staff, ask for help or hire a designer.

Practice, Practice, Practice
Finally, practice! Not only must you practice delivering the actual presentation, you must also learn how to set up the equipment and use it. Practice setting up and using equipment as well as delivering your arguments. Practice advancing the slides manually, launching videos, pausing the presentation, and displaying evidence.

When properly applied, presentation technology can be extremely effective in mediations. Viewers are more likely to remember your message after viewing an audio/visual presentation than having heard it without visuals. Make an impression by incorporating presentation technology into the mediation room.