We’re not quite The Jetsons yet, and robots don’t seem to be making good on their plans for world domination. But computers and the Internet are playing a growing role in our lives. Activities and interactions that once took place offline, leaving little to no tangible trace, are being shifted online through a proliferation of websites, secured servers and mobile device applications.
Our employees’ computers keep a record of their web browsing and the programs they use, which can all be recovered and recreated in the right hands. Privacy concerns have garnered much more attention than the vital application of this data on fact investigation and litigation. Internet histories, browser caches, lists of recent files and programs and deleted data fragments can all provide critical evidence that is essential to winning a case. Yet, this data is as fragile as it is crucial, and care and experience must be brought to ensuring its preservation and production.
In both instances, the plaintiffs would have had gaping holes in their proof without access to the data stored on the defendant’s or third party’s computers.
Documents, metadata and more
Forensic technology specialists make bit-by-bit copies, called forensic images or mirror images, to gather all of this data, review it and analyze it. Back in their labs, they can piece together the last time a computer was turned on; who logged on to the computer; whether any CDs, thumb drives or external hard drives had been plugged in to the computer; and what programs and files were recently opened. They can also tell what websites you visited and recover copies of the sites as they appeared when you viewed them. This data is not necessary to every case, but, as we have seen, some cases are won solely because of the collection of this evidence.
Costs, burdens and obligations