| In This Issue:
 FROM THE FORENSIC LAB: KROLL ONTRACK
ENHANCES ITS COMPUTER FORENSIC SERVICES WITH
ELECTRONICDATAINVESTIGATOR™
Kroll Ontrack Inc. recently announced the
enhancement of its award-winning computer forensic
services with the addition of
ElectronicDataInvestigator. This easy-to-use software
allows Kroll Ontrack's computer forensic customers to
view, search, sort, bookmark, and report on their
computer forensic data – without the need for native
applications or additional software. This software will
be distributed to all Kroll Ontrack computer forensic
customers at no cost.
“ElectronicDataInvestigator's powerful search
functionality puts an end to the frustrating,
time-consuming process of manually sifting through
computer forensics results in search of relevant data,”
said Kristin Nimsger, Electronic Evidence Product Line
Manager for Kroll Ontrack. “Add to this the ability to
view all documents without having to purchase their
native applications, and you have an extraordinarily
easy and intelligent way to conduct a computer forensics
investigation."
Key
features of the software include:
- Simple User Interface – An
easy-to-use button structure and large file viewing
area simplify the investigation of computer forensic
data.
- Universal Data Viewing – Users
can view all files and associated metadata without
having to purchase the native software
packages.
- Enhanced Searching – Offers
the ability to search emails, attachments, documents
and more, using a number of different terms and with
several connectors. Searching is made easy with a
step-by-step searching wizard.
- Ability to Bookmark Important
Files – Users can bookmark data, files, and
folders to flag them as important to the
investigation. Comments can also be placed on the
bookmarked files or folders, for inclusion in the
customized reports.
- Customized Reporting Options –
After bookmarking a file, the investigator can easily
create a customized report, an essential tool in
presenting the forensic findings to the judge, jury,
or opposition.
For
more information visit http://www.krollontrack.com/eEvidence/Software/ElectronicDataInvestigator/.
THE PEOPLE THAT MAKE IT
HAPPEN: BOB HACKETT, MANAGER OF COMPUTER FORENSIC
OPERATIONS
In
13 years, Bob Hackett has seen Kroll Ontrack (known as
“Ontrack Computer Systems” when he began) grow from
approximately 35 employees to a global, publicly traded
company that successfully merged with Kroll Inc. into a
larger, multi-service company.
Along the way, Bob has held many positions. For
the last three and a half years he has been managing
Kroll Ontrack's Remote Data Recovery engineers. Earlier
this year, Bob also assumed the additional
responsibilities of managing operations for Kroll
Ontrack's Computer Forensic team. In addition to his
management experience, Bob delves into the technical
side of things. He conducted the company’s initial
training for the data recovery engineers, helped to
create the first computer forensic lab for the company,
worked on many computer forensic investigations when the
field was just beginning to emerge, conducted thousands
of data recoveries, and worked in Ontrack's clean room
for three and a half years. He says, “It has been an
amazing experience watching the company grow as the
technology evolves. It is the incredible people that
drive the innovation in this industry and make
everything work to provide our customers the best
products and services possible.”
FROM THE BRILL FILE:
STOPPING AUTOMATED E-EVIDENCE DESTRUCTION WHEN
LITIGATION ENSUES
Written by Alan Brill, Senior Managing
Director for Kroll Ontrack, The Brill Files reflect his
work in the field with clients who have encountered some
not-so-pleasant events and what was done to remedy the
situation.
It
happened to Oliver North in the Iran Contra scandal. It
happened to Bill Gates in the Microsoft/Justice
Department Litigation. They suddenly found themselves
facing questions about emails that they had sent or
received, but which they believed had been erased long
ago.
Today, virtually every email package provides the
option for setting an upper limit to the age of email
messages. Companies choose a time limit – 30 or 60 days
are common choices – and set the system to automatically
delete messages that have been in the in-box for that
time period. The messages are no longer copied to
backups, and over a short time period (given that most
companies use a 7 or 14-tape rotation cycle for daily
backups), the deleted emails are no longer available
either on the network or on tape. An individual user can
move particular email messages to personal folders for
more long-term storage, or they can print a hard copy of
an email, but failing either of those actions,
eventually the email is gone. Certainly some remnants of
messages may be out on the hard drive and be accessible
through forensic methodologies, but as a practical
matter, they are gone for good.
The
problem comes up when an organization using an email
system with an automatic aging and purging function
receives a preservation letter or court order
instructing the company to keep all records relevant to
a situation and not to destroy such records or hide
them. If email records are covered in this request or
order, whoever gets the request (most often it will
probably flow from the General Counsel) the issue that
must be quickly resolved is whether or not current email
traffic will have to be protected. If it must, then the
issue arises of how counsel can stop the automated
purging systems. For this
reason it is vital that an organization’s IT department
and Corporate Counsel both be aware of the issue and
have a procedure in place to stop all purging of old
emails when directed to do so by counsel. Counsel should
also consider instructing the IT department to safeguard
the backup tapes and start using new ones. When a
company has other programs that automatically purge data
after a given period, Counsel should also be made aware
of them.
The object is to prevent what attorneys
call “spoliation” or the destruction of potential
evidence which the organization had a duty to prevent.
Generally speaking, programs that purge emails are
perfectly acceptable and legal, but once an order has
been received or a notice from counsel that information
must be preserved, the knowing destruction is
potentially dangerous. Where these automatic destruction
processes exist, courts may also find that the company
knew or should have reasonably known of these systems
and that there was an implied duty to stop them. Like
the old saying “better safe than sorry,” it is far
better to avoid such problems wherever
possible.
Kroll Ontrack News and
Events:
To
learn more about electronic discovery and computer
forensics, attend one of these events:
| 5/28/03 |
ElectronicDataViewer Online
Demonstration |
| 5/29/03 |
Orange County Paralegal Association,
Irvine, CA |
| 6/3/03 |
E-Discovery: What You Need To Know Now, Los
Angeles, CA |
| 6/5/03 |
E-Discovery: What You Need To Know Now, San
Francisco, CA |
| 6/10/03 |
E-Discovery: What You Need To Know Now,
Philadelphia, PA |
| 6/26/03 |
E-Discovery: What You Need To Know Now, New
York, NY |
Visit our Upcoming Events section at http://www.krollontrack.com/upcomingevents/
to learn about these presentations and more.
Kroll Ontrack Requests
Your Input
Our
legal consultants, project managers, and technology
experts strive to stay on top of e-discovery law. If you
are aware of any additional local court rules or new
cases in this area of the law, please do not hesitate to
contact us by writing to abrill@krollontrack.com.
For
more information about electronic discovery and computer
forensics services, contact Kroll Ontrack at
1-800-347-6105 or www.krollontrack.com.
|
