One common question we encounter is this: When collecting data from custodians, is it necessary to perform forensic disk imaging of the entire hard drive? In most cases, our answer is a clear and resounding: No!
Adam Feinberg, CCFS, CEDS, BIA’s Senior Vice President of Professional Services and one of our Computer Forensics Experts responds, “It is absolutely not necessary in the vast majority of civil litigations to perform forensic disk imaging of a custodian’s entire hard drive. Indeed, doing so will often only saddle you with the significantly increased costs associated with preserving and filtering through tons of irrelevant system files and the like that you never needed to collect or preserve in the first place.” Truth be told, unless there’s a compelling reason (i.e. you suspect a custodian may have improperly deleted files or you’re dealing with a potential criminal matter), you’re much better off doing a targeted collection of the custodian’s actual data. In the end, you’ll have a better, more focused and meaningful process, and you’ll save a ton of money too!
Think of the “old-fashion” paper world, and you’ll see a very instructive analogy. If you were collecting paper documents from your client, would you walk into their office and grab every filing cabinet, folder and loose piece of paper from every desk? Would you go through the trash and the shredder looking for more? Maybe if you were the FBI conducting a raid and asset seizure you would (which, by the way, is where the whole idea of imaging an entire hard drive originated – in law enforcement), but in just about any other context, that is clearly heavy-handed and unnecessary – bordering on absurdity. But, in effect, that and more is exactly what you are doing when you resort to full forensic disk imaging.
In that paper world example, instead of grabbing everything, you’d take a reasoned and informed approach. You’d work with the client and its employees to identify potentially responsive materials and selectively duplicate just those for further review prior to production. Well, you’re approach to collecting and preserving digital information really should be no different. Just as in the paper world, you should work with custodians to identify and focus on sources of potentially relevant information and keep the stuff you’re certain you’ll never need from artificially inflating your costs.
Indeed, BIA was founded on that very idea: that the “image everything” approach was clearly overkill and only would lead to ever-increasing costs (and that’s back when a few gigabytes was a lot of data for a single custodian to have). To address that concern, we developed the industry’s first forensically sound, targeted data collection tool: DiscoveryBOT™. Over the last decade, DiscoveryBOT™ has been used to collect petabytes of data from tens of thousands of resources spread across more than 44 countries on six continents.
Along the way, it’s helped our clients realize untold millions in savings with a very simple idea: don’t collect what you’ll never need. Not once has that idea been successfully challenged. From opposing parties to government agencies, everyone who has examined that process has found it effective and defensible. Isn’t it time you stopped collecting more than you need to?