1. Electronic Evidence Joe Kashi

2. Todays Program Types of Electronically stored information Types of Electronically stored information Accessibility and effect upon discovery Accessibility and effect upon discovery Where and how to find ESI Where and how to find ESI ESI forensics and indicators of tampering ESI forensics and indicators of tampering Revised FRCP regarding ESI Revised FRCP regarding ESI Some thoughts on authenticating photos Some thoughts on authenticating photos Demonstration of ESI forensic software Demonstration of ESI forensic software Electronic Brief demonstration Electronic Brief demonstration

3. Electronically Stored Information (ESI) Used by revised FRCP as the official term of art for electronic evidence Used by revised FRCP as the official term of art for electronic evidence ESI is pervasive ESI is pervasive recent studies conclude that ESI accounts for 93% - to 98% of all original documents recent studies conclude that ESI accounts for 93% - to 98% of all original documents arguably, ESI is now the best evidence arguably, ESI is now the best evidence Paper prints, though often easier to use in the courtroom, are usually secondary copies Paper prints, though often easier to use in the courtroom, are usually secondary copies

4. General Types of ESI – Computer Data Few original paper documents, mostly signed or hand-written items Few original paper documents, mostly signed or hand-written items Locally generated documents Locally generated documents Networks – local and enterprise Networks – local and enterprise Personal Digital Assistants, i.e., Palm, Blackberry, smart cell phones Personal Digital Assistants, i.e., Palm, Blackberry, smart cell phones

5. Internet uploads and downloads Text, audio, video, photo, music Text, audio, video, photo, music Personal web pages number in the tens of millions; example MySpace Personal web pages number in the tens of millions; example MySpace Internet collaborative documents Internet collaborative documents Usually free services Usually free services Example Google Docs Example Google Docs

6. Third Party ESI Third Party ESI Voice mail, typically stored on hard disks Voice mail, typically stored on hard disks Email, usually stored in about 4 locations Email, usually stored in about 4 locations Cell phones Cell phones voice messaging voice messaging wireless video/photo/Email wireless video/photo/Email GPS or cell tower locating GPS or cell tower locating

7. Non-computer ESI Fax and copier memory Fax and copier memory Digital cameras and camcorders Digital cameras and camcorders iPod type devices iPod type devices VHS, CD and DVD VHS, CD and DVD Audio recorders Audio recorders

8. ESI - Is It Accessible? Critical distinction under new FRCP Critical distinction under new FRCP If accessible, existence and location must be disclosed as a matter of course during initial disclosures If accessible, existence and location must be disclosed as a matter of course during initial disclosures If not readily accessible, then other factors become prominent, including whether to order discovery, sampling of records, and cost-shifting If not readily accessible, then other factors become prominent, including whether to order discovery, sampling of records, and cost-shifting

9. Accessibility depends upon media type Active data Active data Easily accessed dynamic data that can change or be lost due to ordinary use Easily accessed dynamic data that can change or be lost due to ordinary use Near line Near line Not everyday storage but can be mounted and searched without too much difficulty. Not everyday storage but can be mounted and searched without too much difficulty. Examples: CD or DVD disks and backups, portable hard disks, small USB thumb drives, digital camera memory cards Examples: CD or DVD disks and backups, portable hard disks, small USB thumb drives, digital camera memory cards

10. Not Readily Accessible ESI These may require significant effort to be usable and searchable These may require significant effort to be usable and searchable Examples: Examples: Backup tapes; each needs to be restored, mounted and searched individually; often requires new hardware Backup tapes; each needs to be restored, mounted and searched individually; often requires new hardware Old data or file formats not readable by current software Old data or file formats not readable by current software

11. Practical Guides for Trial Judges Guidelines for State Trial Courts Regarding Discovery of Electronically Stored Evidence – Conference of Chief Justices, August 2006 Guidelines for State Trial Courts Regarding Discovery of Electronically Stored Evidence – Conference of Chief Justices, August 2006 US District Court for the District of Kansas pretrial order US District Court for the District of Kansas pretrial order Zubulake and Coleman decisions Zubulake and Coleman decisions December 2006 revisions to FRCP December 2006 revisions to FRCP Sedona Principles Sedona Principles

12. Preliminary Information Types of computer systems Types of computer systems How networked How networked IT personnel IT personnel How backed up and how often How backed up and how often Disaster Recovery Plans Disaster Recovery Plans Logging of activities – very useful Logging of activities – very useful What programs are used? What programs are used? File formats and data formats File formats and data formats What data is maintained and where What data is maintained and where

13. Delete does not mean deleted Persistence Persistence Broad storage Broad storage Duplicative storage Duplicative storage Actually harder to discard than paper files Actually harder to discard than paper files Automatic logging and System Registry Automatic logging and System Registry File fragments File fragments