Infosec: IT lawyers missing a trick

Infosec: IT lawyers missing a trick
Infosec: IT lawyers missing a trick 

By Iain Thomson at Infosec Europe 2008
23 April 2008

Lawyers relying on the disclosure of computer evidence are losing out on 
valuable clues, experts warned today.

When documents or emails are requested as part of a court case, many 
legal firms accept CDs with the requested material burned on.

However, a computer forensics firm has warned that this misses crucial 
evidence contained on the rest of the hard drive.

"If you take a burned CD you just have a lot of documents," said Alan 
Philips, chief executive at 7safe.

"What you lose is information on the documents themselves and where they 
have been. If you image the hard drive you do not have to trust what 
they give you."

Philips explained that the legal profession should learn from the police 
and take complete hard drive scans. These show what documents have been 
deleted and, crucially, where they have been moved.

A scan can also trip up the less savvy, since there is still a 
widespread opinion that simply deleting a file erases it completely. 
Only the header information is deleted and a skilled investigator can 
find the file easily.

A key driver, however, is cost. Investigators are expensive but, in a 
multimillion pound case, it could be a price worth paying, according to 

Subscribe to the InfoSec News RSS Feed 

Site design & layout copyright © 1986-2015 CodeGods