Having come down the digital forensics track, it took me a while to come to grips with the idea of e-Discovery. I remember thinking, "So let me get this straight... A write blocker is unnecessary and data in unallocated space is not important?" While that is not always the case with e-discovery, it is more often than in a case calling for computer forensics.
It is important to differentiate whether an engagement calls for e-discovery or forensics from the beginning in order to establish goals and pricing. For example, forensics work is generally billed by the hour, whereas e-discovery processing is often charged by the amount of data. It is also not uncommon for a typical e-discovery case to require forensics processes after, let's say, the initial e-discovery production seems to be missing emails expected to have been produced.
Yesterday, I read a fantastically concise explanation for differentiating e-discovery and computer forensics by Bill Dean at Sword & Sheild's blog. Our communities need articles like this to help bridge the verbiage gap between attorneys, litigation support personnel, and e-discovery and computer forensics practitioners. I highly recommend spending five minutes to take a look.
No comments:
Post a Comment