(Text for those without flash or javascript) Fulcrum's professionals are experienced CPAs, MBAs, ASAs, CFAs, affiliated professors and industry specialists Our expertise encompasses damages analysis, lost profit studies, business and intangible asset valuations, appraisals, fraud investigations, statistics, forensic economic analysis, royalty audits, strategic and market assessments, computer forensics, electronic discovery and analysis of computer data.
Computer Forensics / Electronic Discovery

ELECTRONIC DISCOVERY CAN NO LONGER BE IGNORED

February 13, 2003
Library Sections:
Business records are continuing to move away from paper towards electronic storage.  In 2000, 10 percent of documents existed solely in digital format.  In two to three years, the percentage of records stored only in electronic form will likely exceed 60% according to Xerox.  It is quickly reaching the point where electronic discovery is required because paper records alone will miss important information. 

One merely needs to consider your own business, and the business of your clients, to realize that this is the case.  Email usage continues to skyrocket and now exceeds postal mail as the preferred mode of business communication.  Enterprise Resource Planning ("ERP") systems now target middle market manufacturers and wholesalers with applications that streamline business operations and reduce paper flow.  These and other advances replace the need for printed documents, causing less evidence to be in a file cabinet. 

The good news is that this electronic discovery should cost no more, and may cost less, than traditional paper efforts.  Today's technology has reduced costs considerably, making electronic discovery a viable solution for practically all commercial disputes. 

Discovery That Will Win Your Case 

For those looking for information, the additional good news is that electronic records are more likely to be retained.  The view among most data processing professionals is that data is valuable.  As a result, most computer systems are designed with data preservation as a key goal.  Data is generally stored in several locations as a result of multiple users having their own copies of files, and the systems storing redundant back-ups.  In many cases, administrators and computer users purposefully retain deleted files to allow one to change his mind about the deletion.  Even when truly "deleted" in the system, data recovery is possible until the underlying electronic information is physically overwritten.   

Techniques used to extract valuable evidence include the following: 

Recovering files from backup sources- Data backups protect from interruptions caused by physical disasters, files which become unreadable, and situations where data errors or deletions accidentally occur.  Practically all companies regularly make data backups.  These backups may be held by the business itself and/or by offsite storage services.  

Back-ups are typically made at least weekly.  When stored on tape, the backups are often kept for at least a month, with quarterly or yearly backups retained for much longer.  Backup tapes may provide copies of files that have otherwise been deleted and are no longer recoverable from disk drives.  Separate backups may exist for files, email, and financial data, all of which should be considered.

Reviewing email correspondence and attachments-An email database is usually a valuable source of information.  Email sometimes contains comments that would not otherwise be available because users sometimes treat these communications casually.  Investigators can easily search email by name, date, or key words.  Importantly, email may also include attached files that have since been deleted in the overall computer system.

Reviewing employee disks and writable CD's-Employees often backup their own work to floppy disks, or writable CD's.  Even if a company follows a strict file retention and deletion policy for files on the server, important files may still exist on disks retained by an individual employee.

Examining an employee's home computer-Working at home probably means that business files are on a personal home computer.  A file retention and deletion policy is difficult to enforce on these computers, allowing for the possibility of obtaining otherwise deleted information.  While it may be more difficult to gain access to a home computer, this effort is worthwhile for an opponent's owner, key officers and key witnesses.

Examining a user's PDA-Calendars, contact lists, meeting notes, and even Word and Excel files are now being stored on hand-held devices.  As wireless networks continue to expand and memory storage grows, these devices become increasingly important.

Recovering the contents of Window's trash bin-Users often forget to empty their Window's trash bin after deleting files.  The trash bin settings delete everything instantly, or empty the trash bin only when prompted.  The "only when prompted" option is the default, and is used in most instances.  Separate electronic trash bins usually exist for the operating system and the email system.

Recovering deleted files-In the computer world, "deleted" does not mean destroyed.  When a file is deleted, the computer makes the space occupied by that file available for new data.  The reference to the file is removed from the directory listings and file allocation table, but the bits and bytes remain on the hard drive until overwritten.  Software can be used to recover the files that have not yet been overwritten. 

All this, and it Costs Less 

Electronic discovery is more affordable than before.  When determining the cost benefit of electronic discovery, consider the following:  

  • Save time when searching documents.  Once electronic data is obtained, thousands of pages can be quickly reviewed using key word searches.  These search capabilities allow a legal team to search Word, Excel, email, and other common files with ease. 

  • Analyze electronic financial data more quickly and with greater accuracy.  Being able to query financial databases, review spread sheet formulas, and perform custom calculations will provide valuable information.  All of this can be done more quickly and accurately than using paper sources. 

  • Retrieve, store and share electronic data more easily.  Less time spent filing, retrieving, and mailing information means more time for analyzing the data. 

  • Modern applications use standard protocols, enhanced user interfaces, and improved data export capabilities.  The Internet has also caused data to be more easily shared between disparate applications and systems.  This means it is easier and cheaper to extract electronic information than ever before. 

  • More powerful computers mean that more information can be found on relatively simple PC's.  

However, cost-effective is not the same as easy.  Electronic discovery should be performed with the assistance of a trained professional.  Our firm offers this assistance.  We are also available to coordinate the results with required data and financial analysis, as significant synergies exist in closely coordinating the data retrieval, data searches and financial analysis.