• Home
  • About
  • CRAIGBALL.COM
  • Disclaimer
  • Log In

Ball in your Court

~ Musings on e-discovery & forensics.

Ball in your Court

Category Archives: Computer Forensics

Come and Take It: Free Corpus to Test E-Discovery Tools

28 Sunday Jul 2013

Posted by craigball in Computer Forensics, E-Discovery

≈ 6 Comments

comeandtakeitI just returned from Santa Fe where I spoke on a panel with Judges Paul Grimm and Rebecca Pallmeyer at the always excellent ALI Current Developments in Employment Law program.  I opened our sessions with a presentation I call “Spoiled and Deluded: The Shakespearean Tragedy of Search in E-Discovery.”  The presentation addresses the discontinuity between what lawyers believe their search tools can accomplish and the practical limits of same.

While I was explaining the role of stop words in indexed search and lamenting what I call the “to be or not to be” problem” (i.e., the inability of some text indexing tools to find that most famous of English language phrases because its constituent words are often omitted by text parsers), Judge Pallmeyer stopped me and said, “Is that true?”

When a federal district judge pointedly asks you if what you are telling the audience is true, it’s an opportune time to catch your breath and collect your thoughts before responding.

“Yes, Judge,” I answered, “It’s true.”  

She countered, incredulously, “But surely I can find ‘to be or not to be’ if I put it in quotes, right?”

“No, Your Honor,” I replied.  “If it’s been excluded from the index, no search will find what’s not there to be found.” Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Proof Finder Hits Philanthropic Goal

25 Tuesday Jun 2013

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts

≈ Comments Off on Proof Finder Hits Philanthropic Goal

unicef3When I was a boy, in that innocent time before poisoned Pixy Stix, Halloween was magical.  We planned our costumes for months and mapped routes to maximize candy yields.  But it wasn’t all Batman and Casper and treats.  We also turned our milk cartons into piggy banks and cried “Trick or Treat for UNICEF” at every door  A few pennies collected with Chuckles and Charms bought a month’s worth of milk for a hungry child.  Then as now, so little could do so much to aid needy children a world away.  I’m reminded of that as I share the wonderful news that Nuix has reached its goal to raise $100,000 for charity by selling licenses for Proof Finder.

My friend Eddie Sheehy, CEO of Nuix, announced today that, “To date, Proof Finder sales have helped Room to Read and local communities build schools in Nepal and Sri Lanka, publish local-language school books and provide support for 30 girls to complete secondary education. With the funds raised since March 2013, Room to Read will establish two libraries in Delhi, India and provide a full year of secondary school education for 20 girls in India.” Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

The Real Voyage of E-Discovery

25 Saturday May 2013

Posted by craigball in Computer Forensics, E-Discovery

≈ 1 Comment

The real voyage of discovery consists not in seeking new landscapes, but in having new eyes. – Marcel Proust

eye

E-discovery education is lawyers and judges teaching lawyers and judges the law of discovery, but little of the “e.”  This closed loop is unhealthy because it reinforces the misperception that understanding what makes digital different doesn’t matter.

But, of course it does.  

It’s human nature to set the standards for competence so that you meet them. No one wants to define themselves out of a job.  As a result, the trial bar keeps telling itself that grasping the bits and bytes of information technology is someone else’s problem…or not a problem.  “The top lawyers and judges out there don’t know that stuff, so it can’t be something a lawyer or judge needs to know.”  That’s the view through old eyes.

I dump on lawyers for ducking the obligation to to be competent in a world teeming with electronic evidence.  But I recognize that even the brave souls that try to cultivate new eyes for digital evidence are confounded by the paucity of e-discovery instruction affording equal stature to the technology.  Where do lawyers learn the very thing that makes e-discovery so daunting for them?  Where do they learn it in the unique context of trial practice and put their newfound skills into practice?

Right now, there’s probably only one answer to those questions: the Georgetown E-Discovery Training Academy, a weeklong program offered in early June, with the next Academy starting on June 2nd. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Prooffinder: Touch the Monolith

09 Thursday May 2013

Posted by craigball in Computer Forensics, E-Discovery

≈ 3 Comments

Prooffinder_evolveIn the spring of 1968, my sixth grade class from suburban Eastchester went to the Loews Capitol Theatre at 51st and Broadway in New York City to see 2001: A Space Odyssey.  It was an unforgettable event.  Though much of the movie went over our ten-year-old heads, we got the message about tools and evolution when our hairy forebear flung his bone “hammer” aloft and it became a sleek spaceship.  We evolve to use tools, and the tools we use drive our evolution.

We can’t deal with electronic evidence without tools.  The more adept we are with those tools, the more adept we become with electronic evidence.  Tools that let us touch data—hold it up to the light and turn it this way and that—change the way we look at data.  Tools change us.

 I’m always preaching that lawyers must get their hands dirty with data and get back in touch with the evidence.  It’s a metaphor, but it’s also a manifesto.  A master builder needn’t swing every hammer; but, a master builder knows how a hammer feels in the hand. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Busted! How Happy Accidents Help Forensic Examiners Prove Data Theft

26 Saturday Jan 2013

Posted by craigball in Computer Forensics, E-Discovery

≈ 12 Comments

datatheftA big part of my practice is assisting courts and lawyers in cases where it’s alleged that a departing employee has walked off with proprietary data. There’s quite a lot of that. Studies in the U.S. and abroad suggest that some two-thirds of departing white collar employees leave with proprietary data. So, it seems data theft is the norm.

Of course, not all data leaves with the requisite scienter (“evil intent”) to be called theft. In this wired world, who doesn’t have data on thumb drives, phones, tablets, backup drives, webmail accounts, legacy devices, media cards, CDs, DVDs, floppy disks and good ol’ paper? You work for a company a while and you’re going to end up with their stuff strewn all over your devices and repositories. But, few data theft lawsuits stem from stale data on forgotten media.

The “classic” data theft scenario is the after-hours mass movement of copious quantities of closely-guarded internal documents to an external USB hard drive or capacious thumb drive. While such actions look dastardly at first blush, a few dimmer bulbs may actually act with a pure heart, intending to take only their personal data (like family photos or music), but dragging entire folder families that also hold corporate ESI.

I tend to be skeptical of such claims unless the usage patterns that follow and other forensic evidence bear out the “I really thought it was just my stuff” defense.  It’s not hard to tell the difference, so long as devices aren’t lost or corrupted.

But you may be wondering: How do forensic examiners determine data was taken, and how do they identify and track storage devices used to carry away ESI? Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Spilling the Beans

23 Wednesday Jan 2013

Posted by craigball in Computer Forensics, E-Discovery

≈ Comments Off on Spilling the Beans

beansI don’t do paid product endorsements (though I’m flattered when someone asks that I do).  So, if I sound like a shill when I come across something that helps me, it’s because I want it to help you, too.  That said, if you buy something as important and expensive as an e-discovery tool or review platform just because I use and like it, you haven’t done your due diligence.

I do freely endorse products I use and love (and I try to be as reticient as my big mouth allows concerning products I use and don’t love).  There are a handful of tools that fall into the category of “What would I do without them?”   Some are free little gems, like FTK Imager.  Others, like X-Ways Forensics or Prooffinder, are extraordinary bargains that pay for themselves in every case.  Finally, there are tools that don’t come cheap but equip lawyers, firms and companies with such powerful capabilities that they tip the scales steeply in their users’ favor in terms of getting a handle on the cost and complexity of e-discovery.  One of these is Nuix, an Australian import that I turn to almost daily to gain the upper hand with the evidence in my cases.

With that gassy preface, let me spill the beans on a little video that offers a lively perspective on data volumes in e-discovery.  It commits the cardinal sin of offering a byte equivalency for ESI, but it does it in the right way: by stating its assumptions up front and identifying the composition of the data used for the extrapolation.  Above all, I applaud Nuix’ courage in choosing beans to make its point.  Considering the well-known propensities of the musical fruit, it’s hard to conceive of a better analogue for the gusts of hype that will waft through the halls of LegalTech New York next week!  See you there!

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

No Hard Drives Were Harmed in the Making of this Picture

11 Saturday Aug 2012

Posted by craigball in Computer Forensics, General Technology Posts

≈ 7 Comments

Last week, one of my son’s friends lost a summer of work he’d done filming a documentary.  It was a crucial college project for which he’d solicited and received considerable financial support via Kickstarter.  He’d backed up months of footage garnered from extensive travel and interviews to an external hard drive.  Secure that he had a backup, he deleted the source data to gain more room on his Mac.  It wasn’t until the external hard drive failed that it dawned on him that a backup isn’t a backup if it’s your only copy.

My son’s friend was distraught and ready to run all manner of over-the-counter recovery programs in a desperate attempt to salvage his labors.  That would have been about the worst possible thing to do since running these tools against a mechanically compromised or logically corrupted drive often extinguishes any hope of data recovery.

By virtue of the superior genetic material and parenting skills of his mother, my son Madison is a very bright young man and had the presence of mind to intercede and tell his buddy to stop, do nothing and bring the drive to my lab to see what could be done.  My son also understood that data recovery is uncharacteristically economical when you know someone who will do it for free. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

1, 2, 3. Testing, Testing: Better Keyword Search for a Sou

09 Monday Jul 2012

Posted by craigball in Computer Forensics, E-Discovery

≈ 6 Comments

I give about 50-70 educational presentations each year, so I do a fair number of sound checks.  “Testing. one, two, three.  Testing, testing.”  Scintillating stuff, and hopefully not the highlight of the show.

But “testing, testing” may indeed be the most important point I make, because “testing, testing” should be the mantra of all who use keyword search in e-discovery.  Few actions deliver as much bang for the buck as simple testing of search terms, or do more to forestall boneheaded mistakes.

The tip I share today is one that will cost you little and but could save your client or company a lot of time, money and grief.  It’s a capability lawyers can and should have at the ready, on their very own desktops. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Free CLE Alert: Computer Forensics for Legal Professionals

06 Friday Jul 2012

Posted by craigball in Computer Forensics, E-Discovery

≈ Comments Off on Free CLE Alert: Computer Forensics for Legal Professionals

There’s always so much great stuff to do in Washington D.C. in the summertime.  If I could be there next Friday evening, July 13, I might (as I did last month) take in the patriotic repertoire of the U.S. Army Band on the west steps of the Capitol or catch the comedic Capitol Steps at the Ronald Reagan Center.  Plus, there’s Cirque de Soleil at the Verizon Center.  But if I were in D.C. next Friday, the event I surely wouldn’t miss would be to hightail it over to the Hilton Washington at 1919 Connecticut Avenue NW from 6:15-7:15PM to hear the DOJ’s incomparable Ovie Carroll talk about Computer Forensics for Legal Professionals in the International Ballroom East. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

CEIC 2012: From an iPad Aloft

20 Sunday May 2012

Posted by craigball in Computer Forensics, E-Discovery

≈ Comments Off on CEIC 2012: From an iPad Aloft

20120520-215126.jpgI’m writing this post from 36,000 feet on my way to Las Vegas for the annual CEIC (Computer Enterprise and Investigations Conference) that begins tomorrow at the Red Rock Resort in Summerlin, NV, ten miles off the Strip. Between my personal Scylla and Charybdis of e-discovery and digital forensics, I attend a ridiculous number of forensic technology conferences each year (merely ridiculous, as I cede “insane” to the Grand Dukes of EDD, the always avuncular Browning Marean and ever erudite Chris Dale). Some, like CEIC and New York LegalTech are big, bustling events in splendid venues that feel more like family reunions than trade shows. Others, like my trek to this Friday’s Appalachian Institute for Digital Evidence in Huntington, West Virginia, are intimate gatherings sized to local law enforcement and student budgets. Big event or small, I’m grateful to be invited to play my part in the educational components of them all.

But I confess that CEIC is one conference that I look forward to more than most. Sure, I love its alternate annual situs in Las Vegas and Orlando; but, the real draw to CEIC is the quality and breadth of its educational offerings and the collegiality of the mixed group of attendees: cops, techies, warriors, lawyers, judges and three-letter agency types (and a few booth babes–it’s Vegas after all). Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...
← Older posts
Newer posts →
Follow Ball in your Court on WordPress.com

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,238 other subscribers

Recent Posts

  • A Refresh of the Annotated ESI Protocol May 1, 2026
  • Free at Last: Ditching TurboTax for FreeTaxUSA April 5, 2026
  • A Dog and Its Tail: Don’t Let Version Uncertainty Cloud Linked Attachment Production April 2, 2026
  • The EDRM Isn’t Broken; It’s Misunderstood. March 18, 2026
  • Detecting Deep Fakes February 24, 2026

Archives

RSS Feed RSS - Posts

CRAIGBALL.COM

Helping lawyers master technology

Categories

EDD Blogroll

  • Illuminating eDiscovery (Lighthouse)
  • Basics of E-Discovery (Exterro)
  • GLTC (Tom O'Connor)
  • eDiscovery Today (Doug Austin)
  • E-D Team (Ralph Losey)
  • Complex Discovery (Rob Robinson)
  • Corporate E-Discovery Blog (Zapproved )
  • Sedona Conference
  • The Relativity Blog
  • E-Discovery Law Alert (Gibbons)
  • CS DISCO Blog
  • Minerva 26 (Kelly Twigger)
  • eDiscovery Journal (Greg Buckles)

Admin

  • Create account
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.com

Enter your email address to follow Ball in Your Court and receive notifications of new posts by email.

Website Powered by WordPress.com.

  • Subscribe Subscribed
    • Ball in your Court
    • Join 2,090 other subscribers
    • Already have a WordPress.com account? Log in now.
    • Ball in your Court
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar

Loading Comments...

    %d