Journal of Digital Forensics, Security and Law

5-28

Authors: AleJoseph J. Schwerha, Scott Inch

The recent amendments to Rule 26 of the Federal Rules of Civil Procedure created a two-tiered approach to discovery of electronically stored information (“ESI”). Responding parties must produce ESI that is relevant, not subject to privilege, and reasonably accessible. However, because some methods of storing ESI, such as on magnetic backup tapes and within enormous databases, require substantial cost to access and search their contents, the rules permit parties to designate those repositories as “not reasonably accessible” because of undue burden or cost. But even despite the difficulty in searching for ESI, the party’s duty to preserve potentially responsive evidence remains; it simply gains the option to forgo poring over the material. Further, the court might nevertheless compel production if the requesting party demonstrates good cause. Regardless of whether the responding party believes certain documents to be reasonably accessible or not, courts may still require their production. In such cases, the court may then choose to order production, but shift the costs of doing so to the requesting party. Throughout this process, the burden and cost of production are central themes. Their determination is fluid, varying from case to case and even over time in the same situation. Nowhere is this more evident than where a responding party has numerous, geographically dispersed computers under its control that may contain responsive ESI to a request for production of documents. Traditionally, a responding party would be forced to make a decision of whether or not to send out computer forensic experts to all of these locations to make forensically sound copies of all of those computers and then analyze each. This process is time consuming and costly. Recently, several companies have put forth substantial solutions that facially allow a responding party to capture and analyze data on geographically dispersed computers remotely. That process, in general, is often defined as remote forensics. The question is now whether newly available remote forensic solution indicate that all networked computers are readily accessible under the current state of the law. This article attempts to define remote forensics, examines a selection of applicable court decisions, and then analyzes the currently available commercial software packages that allow remote forensics.

43-60

Authors: Gregory H. Carlton

The two most common computer forensics applications perform exclusively on Microsoft Windows Operating Systems, yet contemporary computer forensics examinations frequently encounter one or more of the three most common operating system environments, namely Windows, OS-X, or some form of UNIX or Linux. Additionally, government and private computer forensics laboratories frequently encounter budget constraints that limit their access to computer hardware. Currently, Macintosh computer systems are marketed with the ability to accommodate these three common operating system environments, including Windows XP in native and virtual environments. We performed a series of experiments to measure the functionality and performance of the two most commonly used Windows-based computer forensics applications on a Macintosh running Windows XP in native mode and in two virtual environments relative to a similarly configured Dell personal computer. The research results are directly beneficial to practitioners, and the process illustrates affective pedagogy whereby students were engaged in applied research.

81-84

Authors: Keyu Jiang, Ruifeng Xuan

Nelson, B., Phillips, A., Enfinger, F., & Steuart, C. (2008). Guide to computer forensics and investigations (3rd ed.). New Jersey: Pearson Education, Inc. 693 pages, ISBN: 1-4180-6733-4 (paper). Reviewed by Keyu Jiang (kjiang@fhsu.edu) and Ruifeng Xuan (r_xuan@scatcat.fhsu.edu), Department of Information Networking and Telecommunications, Fort Hays State University, Hays, KS 67601 Nelson, Phillips, Enfinger, and Steuart's book is about the science of computer forensics and its implications in crime investigations. This book is not intended to provide comprehensive training in computer forensics, but introduce the science the science of computer forensics and its implications in crime investigations. It focused on establishing a solid foundation for those who are new to this field. Nelson, Philips, Enfiger, and Steuart are experienced experts in different areas of computer forensics. Different expertise makes this book could benefit many groups of people at different educational level and industrial background.