Certainly, in preparation for litigation, the collection of relevant evidence is at the forefront of everyone’s concern. It must be collected in sound manner and be able to be authenticated to prove authenticity. Certain documents have already been established by the court under Rule 902 as self-authenticating. You can reference it here:
This is great for records which exist in public places, however, it is fair to say that this is not where the bulk of your evidence is likely to appear. So where do we go from here? In the course of your evidentiary quest, it is most likely that the information that you seek will be from computers, memory devices, mobile phones, and possibly Fit-Bits, GPS systems, tablets, and perhaps even cloud sources. The proper acquisition and authentication methods of this collection must be done according to a proper protocol in order to validate the information that you have. Many have purported that they simply can do it themselves.
How Much “Free” Can Your Case Afford?
Very few attorneys have made their reputation on discount rates and cutting corners. The changes to the Federal Rules of Civil Procedure which seek to make forensic evidence more self-authenticating, though noble, may very well cost you the very case that you are pursuing. As we have discussed in the last portion of this series, there is a difference between e-discovery and forensic discovery. Certainly, with ediscovery, it is much easier to locate the “low-hanging fruit” that is discoverable. The primary difference between e-discovery and forensic discovery is authenticating electronic evidence which is a little more complex to attain. For instance, authenticating a mobile device, or even a laptop computer that may be called into question now requires a “qualified person” to be able to authenticate the evidence as being an accurate representation of the evidence which can be replicated and authenticated by any other “qualified person.” Once this is accomplished, the standard had been met. The cost of attaining evidence is always a concern to the parties involved, however, the ability to authenticate the evidence is of paramount concern.
Can a law firm do their own collection and authentication? Yes. Absolutely. The question, however, is does the firm have qualified persons to accomplish the task? Typically, you have other priorities for your technical personnel. As well, your people would need to become qualified. There are a number of different software and hardware packages that will perform the bit-by-bit imaging and authentication of evidence. Some are available at no cost and others can easily run into many thousands of dollars. Our concern is challenge of collection by people who have little to no experience in the collection of such information.
There are obviously different tools for different jobs. For ease of use and low cost, we would recommend Paraben E3 for all mobile devices. When looking at USB devices, and hard drives, you may very well want to try a free copy of FTK imager from Access Data. Regardless, these are just tools and they do require training. We are fortunate enough to have two individuals who have achieved the coveted certification of certified computer examiner from the International Society of Forensic Computer Examiners. There are currently less than 800 active CCEs worldwide. It is a software and hardware agnostic examination which covers the most diverse and complex of scenarios.
We are more than happy to assist law firms in qualifying individuals within a firm to be able to capture and authenticate data.
You have no doubt heard that the capture of certain phones has been next to impossible throughout the last year. However, considering how integral the mobile phone has become in our society, we simply cannot afford to play “fast and loose” with this, or any kind of discovery.
What Devices Can Be Imaged?
- Mobile phones
- iPads, tablets,
- Hard drives
- Thumb drives (USB devices)
- GPS systems
- Personal training devices (Fit-Bit, etc.)
An item that must be discussed is the use of a “write blocker” in the acquisition of evidence. This device prohibits accidental “writes” to the evidence being captured. It is not optional. If you choose to proceed with a self-collection without knowing the protocol to securely capture the data, your technique may very well be called into question when authentication is performed.
In short, none of this is as easy and straight-forward as the changes in the FRCP are seeking to accomplish. However, we are more than happy to help guide you through the maze of evidence collection and authentication. Randall William Zinn