We all understand legal cases are impacted by evidence, and digital forensics is a critical facet for many legal cases. Digital forensics can be defined as the collection, study, and analysis of electronically stored information.Most often associated with criminal cases, digital forensics is now a vital source in family and civil litigation matters. Electronic information is stored on devices we use in our daily business and personal lives.
Legal Eagle is prepared to provide support in advising on digital forensics and collecting electronically stored information from devices.One of the most important aspects of discovery is following a proper protocol for obtaining evidence, whether physical or digital. As law enforcement seizes digital evidence in criminal investigations through a warrant, in civil litigation, devices are provided to counsel for data acquisition through the Rules of Civil Procedure. Most often, it is at the direction of the attorney who initiates a data collection under a specific discovery request or identification of discoverable information for legal hold purposes. Legal Eagle maintains data in a forensically sound manner in a secure environment.
Another important factor in digital forensics is maintaining a chain of custody for the device or source of information. Tracking evidence is extremely important. Creating logs of the data collection through digital means is also important. Legal Eagle utilizes the cutting-edge software for digital forensics including, Cellebrite, PinPoint Labs, and Sumuri. These tools provide extremely valuable collection logs that may help legal professionals analyze the data. Cellebrite, in particular, provides extremely useful formatting and reporting features. Each project includes a reader version of the application allowing the user to interface with the extracted data. The simplified search methodology across all electronic files collected from a device is efficient.
The value Cellebrite brings to a project is unparalleled. In a recent project, recovering more than 70,000 text messages from a mobile phone, the attorney was provided a Cellebrite report. Through a searchable PDF report, he was quickly reviewing the thousands of messages supporting the case and building a defense.
Devices may include a variety of electronically stored information, including email, text messaging, internet search history, photographs, videos, images, and word processing files. Individuals are often unaware that mobile devices may store thousands of electronic files. Laptops or other electronic devices may contain different versions of documents or fragments not contained on other devices. Legal Eagle can assist with collecting data from a variety of devices including mobile phones, tablets, laptops, iPads and other tools with electronic information.
Extraction of electronically stored information with industry-standard tools does not alter or amend the digital footprint of data. Metadata is “data about the data” and describes specifics about the digital file. For example, a digital photograph may contain physical attributes of the date and time and location of the digital photograph. By simply copying the electronic file from a device or location, certain metadata properties can be disturbed or overwritten. This interruption may lead to the spoliation of evidence and trouble in discovery. In broader eDiscovery terms, collecting files in their “native format” is the best strategy. An electronic file in digital form contains the metadata and affords attorneys with greater ammunition to prosecute or defend a client.
For more complex collections, Legal Eagle may assist with developing a strategy for mapping sources of digital information. For example, if your client has data in email format, mobile phones, server files, or other locations, mapping and outlining the sources may be helpful in documenting digital evidence collected and preparing legal hold notices. Preparing useful diagrams or litigation affected systems may generate an easier response to discovery requests. In addition, a silver lining to this work is establishing information governance for the client for future cases. Knowing this information early may alleviate frustrations in litigation.
Social media is now mainstream in many legal cases. Collecting publicly associated social media posts may be helpful to a legal case. If warranted, passwords may be provided to formally collect social media accounts. Legal Eagle can assist with these types of collections with tools and applications. The important factor with social media data is authenticating the electronic evidence. Under Federal Rules of Evidence 902, electronic evidence, such as social media should have an authentication certification. This certification asserts key information of how, when and where the evidence is secured and by whom. Amended in 2017, the rule now provides a process to authenticate the data for trial purposes. Legal Eagle can provide a workable file ready for trial to satisfy the Court’s requirements.
A final note on digital forensics is knowing when to move forward with a digital forensic collection. As mentioned above, early identification is key. Collecting devices at the earliest point may render evidence that may otherwise be destroyed through normal technology updates or hardware replacements. For example, an electronic device may actively destroy data through disk formatting and should be shut down immediately to avoid data destruction. If the device is collected early on, you will certainly secure relevant information but also prevent certain arguments of spoliation.
Tim Thames is the eDiscovery Director for Legal Eagle. Based in Columbia, SC, Tim brings 28 years of legal experience to the legal community. He has certifications from Cellebrite for digital forensics collections and analysis. Legal Eagle is a full-service legal service provider. From eDiscovery and forensics to document services, trial presentation, and court reporting, Legal Eagle is your only South Carolina owned and operated full-service vendor in South Carolina.