Electronic discovery and computer forensic investigations often go hand in hand. The challenge for many in the legal community is how to identify what ESI (Electronically Stored Information) requires more than typical electronic discovery processing.
First, computer investigations are technically electronic discovery, and the line between the two disciplines will continue to blur. Several key differences are:
-
The qualifications and skills required by the individual performing collections and computer investigations
-
Computer investigations typically recover and analyze areas of the suspect media unavailable through popular electronic discovery software
-
Electronic discovery processing often involves a significantly larger amount of data
-
Most computer forensic applications do not create load files or produce tiffs or electronic bates numbers
-
Computer forensic investigations often require extensive detailed reports of the processes and findings, as well as appropriate affidavits, before the work can begin and then must describe the findings
In my next post, I will discuss the types of cases and suspect information that differentiate computer forensic investigations and typical electronic discovery processing.