http://www.vnunet.com/vnunet/news/2215006/lawyers-missing-trick By Iain Thomson at Infosec Europe 2008 vnunet.com 23 April 2008 Lawyers relying on the disclosure of computer evidence are losing out on valuable clues, experts warned today. When documents or emails are requested as part of a court case, many legal firms accept CDs with the requested material burned on. However, a computer forensics firm has warned that this misses crucial evidence contained on the rest of the hard drive. "If you take a burned CD you just have a lot of documents," said Alan Philips, chief executive at 7safe. "What you lose is information on the documents themselves and where they have been. If you image the hard drive you do not have to trust what they give you." Philips explained that the legal profession should learn from the police and take complete hard drive scans. These show what documents have been deleted and, crucially, where they have been moved. A scan can also trip up the less savvy, since there is still a widespread opinion that simply deleting a file erases it completely. Only the header information is deleted and a skilled investigator can find the file easily. A key driver, however, is cost. Investigators are expensive but, in a multimillion pound case, it could be a price worth paying, according to Philips. _______________________________________________ Subscribe to the InfoSec News RSS Feed http://www.infosecnews.org/isn.rss
This archive was generated by hypermail 2.1.3 : Thu Apr 24 2008 - 22:28:26 PDT