Computer Forensics & Digital
Discovery "The New Frontier" By:
Bill E. Branscum
I realize that many of you whom I consider to be professional colleagues
have not yet reached consensus, but personally . . . I believe that
computers are here to stay. I know that's a bold statement, and
I can certainly relate to those of you who stubbornly cling to the
venerable IBM Selectric II, but I'm willing to go out on that limb!
A few years ago, Kevin Ripa, my good friend and my favorite Canadian,
whom many of you know to be a real expert, persuaded me to take
an interest in Computer Forensics, the technological aspect of retrieving,
restoring and analyzing digital and electronic evidence intended
for use in criminal or civil courts of law. It has been almost as
fascinating and challenging as it was expensive; I would certainly
recommend it to any of you with an interest.
There are many aspects to Computer Forensics, such as; secure
drive imaging, the recovery of deleted partitions, files and folders,
by-passing passwords, the examination of file slack and unallocated
clusters, the retrieval of documents and images that people have
endeavored to hide, the preservation and presentation of evidence,
and the maintenance of a viable chain of custody. Computer Forensics
is complicated, demanding and time intensive, but for the investigator
who enjoys puzzles (and who among us doesn't) it is intellectually
challenging and rewarding.
With the proper hardware, software, and training, digital evidence
may be recovered from various types of computer media, including;
hard drives, CDs, DVDs, floppy disks, zip drives, flash cards, jump
drives, RAID systems, cellular phones and other forms of electronic
storage media. We have recovered and retrieved files and information
from hard drives and electronic media, including e-mails, digital
photographs, word processing documents, instant message logs, files
saved from accounting programs, spreadsheets, internet browser histories,
databases and digital video or audio files, even when those files
had been previously deleted from the target drive.
There are various tools and products available to us, but we rely
upon EnCase, this industry's "gold standard," manufactured
by Guidance Software. Those of you who may be considering this should
expect an initial "out-of -pocket" investment of about
thirty thousand dollars - not counting your time. In this ever-evolving
theater, maintaining proficiency requires a significant commitment
Similarly, and intimately related, is the management of Digital
Discovery, often referred to as, "E-Discovery." My interest
in, and involvement with, digital data management began during my
career in federal law enforcement more than twenty years ago. During
the investigative process, there is no tool like CaseMap; I haven't
any investment in the product, or connection with the company, but
I have been a "power user" of Casemap for many years,
and I may very well be their most vocal proponent.
When the Digital Discovery would fill a truck, Concordance is one
of the most widely recognized tools for that job, and it merits
mentioning that Concordance integrates seamlessly with CaseMap.
We handle cases for law firms domestically, and internationally,
who find themselves deluged with Digital Discovery, which often
includes forensic images of hard drives that must be analyzed with
EnCase. It is a rapidly expanding niche.
Lexis-Nexis published an article about a complex case that I managed
to simplify rather dramatically with the right tools. Perhaps more
art than science, it is the objective of all good case presentations
to simplify the evidence and present a picture that any layman can
comprehend. For example, note particularly the Graphic Analysis
published below - could anyone page thru that presentation and remain
unconvinced that this was an outright fraud?
In another recent case, I was asked to investigate
allegations of government misconduct upon which the Defense proposed
to base a Motion to Dismiss. I am sure you have all seen this sort
of desperate nonsense before, we all have, but there were aspects
of the allegations that gave me pause. The discovery was overwhelming,
the evidence was voluminous, and the case took me all over the place,
from Florida to Washington state, including almost two weeks in
Most recently, I was the Investigator retained
by Wesley Snipes, to assist with his criminal tax case. It was widely
touted to be the unwinnable case in the unwinnable place, but we
took the government's case apart as they presented it so effectively
that we put on no defense of our own. Winning these cases requires
intense trial preparation, and mastering the art of functioning
as a team.
I will be publishing various articles related to Computer
Forensics, Digital Discovery, Complex Case Management, etc. If any
of you have anything in particular that you would like to have me
address, please let me know.