By Iain Thomson at Infosec Europe 2008
23 April 2008
Lawyers relying on the disclosure of computer evidence are losing out on
valuable clues, experts warned today.
When documents or emails are requested as part of a court case, many
legal firms accept CDs with the requested material burned on.
However, a computer forensics firm has warned that this misses crucial
evidence contained on the rest of the hard drive.
"If you take a burned CD you just have a lot of documents," said Alan
Philips, chief executive at 7safe.
"What you lose is information on the documents themselves and where they
have been. If you image the hard drive you do not have to trust what
they give you."
Philips explained that the legal profession should learn from the police
and take complete hard drive scans. These show what documents have been
deleted and, crucially, where they have been moved.
A scan can also trip up the less savvy, since there is still a
widespread opinion that simply deleting a file erases it completely.
Only the header information is deleted and a skilled investigator can
find the file easily.
A key driver, however, is cost. Investigators are expensive but, in a
multimillion pound case, it could be a price worth paying, according to
Subscribe to the InfoSec News RSS Feed