• Home
  • About
  • CRAIGBALL.COM
  • Disclaimer
  • Log In

Ball in your Court

~ Musings on e-discovery & forensics.

Ball in your Court

Category Archives: Computer Forensics

Don’t Try This at Home, Revisited

16 Friday Jan 2015

Posted by craigball in Computer Forensics, E-Discovery

≈ 4 Comments

mcluhanThis is the fifth in a series revisiting Ball in Your Court columns and posts from the primordial past of e-discovery–updating and critiquing in places, and hopefully restarting a few conversations.  As always, your comments are gratefully solicited.

Don’t Try This at Home

[Originally published in Law Technology News, August 2005]

The legal assistant on the phone asked, “Can you send us copies of their hard drives?”

As court-appointed Special Master, I’d imaged the contents of the defendant’s computers and served as custodian of the data for several months.  The plaintiff’s lawyer had been wise to lock down the data before it disappeared, but like the dog that caught the car, he didn’t know what to do next.  Now, with trial a month away, it was time to start looking at the evidence.

“Not unless the judge orders me to give them to you,” I replied. Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Give Away your Computer, Revisited

14 Wednesday Jan 2015

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts

≈ 3 Comments

give awayThis is the fourth in a series revisiting Ball in Your Court columns and posts from the primordial past of e-discovery–updating and critiquing in places, and hopefully restarting a few conversations.  As always, your comments are gratefully solicited.

Give Away Your Computer 

[Originally published in Law Technology News, July 2005]

With the price of powerful computer systems at historic lows, who isn’t tempted to upgrade?  But, what do you do with a system you’ve been using if it’s less than four or five-years old and still has some life left in it?  Pass it on to a friend or family member or donate it to a school or civic organization and you’re ethically obliged to safeguard client data on the hard drive. Plus, you’ll want to protect your personal data from identity thieves and snoopers.  Hopefully you already know that deleting confidential files and even formatting the drive does little to erase your private information—it’s like tearing out the table of contents but leaving the rest of the book.  How do you be a Good Samaritan without jeopardizing client confidences and personal privacy?

Options
One answer: replace the hard drive with a new one before you donate the old machine.  Hard drives have never been cheaper, and adding the old hard drive as extra storage in your new machine ensures easy access to your legacy data.  But, it also means going out-of-pocket and some surgery inside both machines—not everyone’s cup of tea.

Alternatively, you could remove or destroy the old hard drive, but those accepting older computers rarely have the budget to buy hard drives, let alone the technician time to get donated machines running.  Donated systems need to be largely complete and ready to roll.

Probably the best compromise is to wipe the hard drive completely and donate the system recovery disk along with the system.  Notwithstanding some largely theoretical notions, once you overwrite every sector of your hard drive with zeros or random characters, your data is gone forever.  The Department of Defense recommends several passes of different characters, but just a single pass of zeros is enough to frustrate all computer forensic data recovery techniques in common use. Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Destined to Fail: Armstrong Pump, Inc. v. Hartman

13 Tuesday Jan 2015

Posted by craigball in Computer Forensics, E-Discovery

≈ 3 Comments

Thomas-Alva-EdisonBeing a judge looks easy, and most trial lawyers secretly believe they could do the judge’s job as well as His Honor.  But, being a good judge is harder than it looks. Trial judges must be gifted generalists.  They handle disputes in contract law, tort, patent, trademark and copyright law, eminent domain, employment law, criminal law, domestic relations, administrative law, environmental law—you name it.   Judges have to understand procedure and the process of protecting (or muddying) a record better than the average practitioner.  Judges manage bigger dockets than most lawyers with less help.  Trust me: that bozo on the bench is a lot smarter than he looks, and few imagine how much he has to endure from the advocates that come before him.  Sometimes, district court is just traffic court with better shoes.

I offer all that as preface for judging a judge who was just trying to make justice work with precious little help from the lawyers.  I speak of the judge in Armstrong Pump, Inc. v. Hartman, 2014 WL 6908867, No. 10-cv-446S (W.D.N.Y. Dec. 9, 2014).  I’ve never met U.S. Magistrate Judge Hugh B. Scott, but I know that he has twenty years of distinguished service on the federal bench in Buffalo; so, you can be confident he has a well-honed judicial demeanor and has seen it all before.  But, he may suffer from the same debilitating condition that afflicts me:  He was born at an early age and grew up before computers ruled our lives.  He likely learned discovery when everything was paper, and while he may have evolved into judex electronicus (the wired judge), few of his generation of judges have.  It’s asking a lot of judges to keep up with all they must do and become well-schooled in electronic search and retrieval.  That may explain why his order for relief in Armstrong Pump seems destined to fail.  Unhappily so, because when he cries, “Enough” in the opinion, I am with him wholeheartedly. Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

A Simple Breach

23 Tuesday Dec 2014

Posted by craigball in Computer Forensics, General Technology Posts

≈ 6 Comments

dbpix-hack-blog480[1]My son’s second floor apartment in Chicago was ransacked while he was in Austin for the holidays.  Thieves climbed up and kicked in the patio door.  It’s a grim reminder of the disconnect between our sense of security and its fragile reality.  A locked door is nothing to a determined intruder, and who among us is protected by more than a thin pane of glass?  Our optimistic efforts at security merely serve to stave off opportunistic threats of the sort that move on to easier pickings when a door is locked or the lights on.  The rest is mostly luck.

In the context of data breach, I laugh when companies attribute data breaches to “ultra-sophisticated attacks.”  In truth, most intrusions stem from simple vulnerabilities like compromised passwords and unpatched exploits.  The victims left the doors unlocked and packages on the porch.  Corporations–particularly banks and brokerage houses–aren’t going to admit their systems are so vulnerable that any determined burglar can jimmy the locks.  Loathe to confess they fell prey to the bungling burglars from “Home Alone,” companies blame Lex Luthor.

But here’s a refreshing exception to the Lex Luthor Lie:  Last night, the New York Times reported that, “The computer breach at JPMorgan Chase this summer—the largest intrusion of an American bank to date—might have been thwarted if the bank had installed a simple security fix to an overlooked server.”

Left shorthanded by a spate of employee departures, JPMorgan Chase’s security team reportedly failed to upgrade a segment of the network to dual-factor authentication–meaning any web surfer with a password could get in and roam around.  And roam they did, gaining high-level access to more than 90 of the giant bank’s servers.

Fast forward to the headline-making Sony Pictures hack—what some appallingly call “Hollywood’s 9/11.”  Sure, it’s attributed to North Korean hackers; but, it wasn’t necessarily the work of sophisticated North Korean hackers.  One recent report makes the case that the Sony hack was anything but the “unique”, “unprecedented” and “undetectable” event Sony’s CEO suggests.  If there’s truth to the claim that the intruders spirited off some 100 terabytes of data, that staggering haul suggests weeks or months of unbridled access.  The Sony burglars didn’t just kick in the door; they set up housekeeping and hung curtains!

Next time you hear a data breach was the work of “sophisticated hackers availing themselves of zero-day exploits,” take it with a grain of salt.  The likelihood is that they entered using a default password or an insecure authenticator like “sonyml3,” the password revealed as that of Sony CEO, Michael Lynton (ml).

Hmmm.  Maybe the North Koreans could have spared us “The Green Hornet,” if they’d  had “sonyml1” or “sonyml2.”  Kimchi for thought.

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Location. Location. Location.

26 Wednesday Nov 2014

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts

≈ 3 Comments

Gladys_KravitzI’m peripatetic.  My stuff lives in Austin; but, I’m in a different city every few days.  Lately looking for a new place for my stuff to await my return, I’m reminded of the first three rules of real estate investing: 1. Location; 2. Location and 3. Location.

Location has long been crucial in trial, too: “So, you claim you were at home alone on the night of November 25, 2014 when this heinous crime was committed!  Is that what you expect this jury to believe?”  If you can pinpoint people’s locations at particular times, you can solve crimes.  If you have precise geolocation data, you can calculate speed, turn up trysts, prove impairment, demonstrate collusion and even show who had the green light. Location and time are powerful tools to implicate and exonerate.

A judge called today to inquire about ways in which cell phones track and store geolocation data.  He wanted to know what information is recoverable from a seized phone.  I answered that, depending upon the model and its usage, a great deal of geolocation data may emerge, most of it not tied to making phone calls.  Tons of geolocation data persist both within and without phones.

Cell phones have always been trackable by virtue of their essential communication with cell tower sites.  Moreover, and by law, any phone sold in the U.S. must be capable of precise GPS-style geolocation in order to support 9-1-1 emergency response services. Your phone broadcasts its location all the time with a precision better than ten meters. Phones are also pinging for Internet service by polling nearby routers for open IP connections and identifying themselves and the routers.  You can forget about turning off all this profligate pinging and polling.  Anytime your phone is capable of communicating by voice, text or data, you are generating and collecting geolocation data.  Anytime. Every time.  And when you interrupt that capability, that also leaves a telling record.

Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Preserving Gmail for Dummies

15 Wednesday Oct 2014

Posted by craigball in Computer Forensics, E-Discovery

≈ 12 Comments

gmail_GoogleI posted here a year ago laying out a detailed methodology for collection and preservation of the contents of a Gmail account in the static form of a standard Outlook PST.  Try as I might to make it foolproof, downloading Gmail using IMAP and Outlook is tricky.  Happily since my post, the geniuses at Google introduced a truly simple, no-cost way to collect Gmail and other Google content for preservation and portability.  It sets a top flight example for online service providers, and presages how we may use the speed, power and flexibility of Google search as a culling mechanism before exporting for e-discovery. Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Encoding in E-Discovery: Reductio ad Absurdum

01 Wednesday Oct 2014

Posted by craigball in Computer Forensics, E-Discovery

≈ 3 Comments

ovationIn his keynote speech at the Zapproved Preservation Excellence Conference in Portland, Dr. Tony Salvador of Intel compared the “encores” of performers today to those of performers a century ago. “Encore,” Salvador noted, is French for “again;” yet, we use it to mean “more.”  Today, performers brought back by applause don’t repeat their performance; they play a different song.

But for hundreds of years, the encore was an unpredictable, spontaneous eruption.  Stirred by a brilliant aria in the midst of a performance, members of the audience would leap to their feet in applause, shouting, “ENCORE! ENCORE!” The singer and musicians were compelled to stop and perform the same song AGAIN.  This might happen over and over, until the rapture was so fixed in the listeners’ minds they’d relent and let the performance continue.

The audiences of the 18th and 19th centuries demanded repetition of what they heard because there was no technology to reproduce it.  Once Edison made sound stick to a cylinder, the mid-show encore disappeared, and the race to record everything began.

The natural world is an analog world.  The signals to our senses vary continuously over time, experienced as waves of light, vibration or other stimuli.  Much of the last century was devoted to recording analogs of these analogs; that is, preserving the waves of the natural world as waves that could be impressed upon tinfoil, wax and vinyl, as areas of transparency and opacity on photographic film or as regions of varying magnetic intensity on tape.

Then, late in the 20th century, we learned to mimic analog information using the rapid “on” and “off” of digital data, and devoted the last quarter of the century to converting our vast collection of analog recordings to digital forms.  ENCORE! ENCORE! (But this time, do it in ones and zeroes, okay?). It was my generation’s take on converting manuscripts to movable type in the middle ages. Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Dem Phones, Dem Phones, Dem iPhones

29 Monday Sep 2014

Posted by craigball in Computer Forensics, E-Discovery

≈ 8 Comments

papal investitureI am not a dinosaur.  Except that I prefer e-mail to texting, and I forget that my students have never used a record player or lived without the Internet.  I’m not near the national average of 14 daily visits to Facebook, and I’ve yet to text a photo of my genitals–a practice so routine that it has a name, “junk shots” and its very own app, “Snapchat.”  When I need to know how to turn off a nagging dashboard light, I prefer written instructions over YouTube, and I do not video every concert and papal investiture I attend.  I still have two landline phone numbers.

Omigosh!  That last one.  I AM a dinosaur!

According to the U.S. Center for Disease Control, more than 41% of American households have no landline phone, relying on wireless service alone.  For those between the ages of 25 and 29, two-thirds are wireless-only.  Per an IDC report sponsored by Facebook, four out of five people start using their smartphones within 15 minutes of waking up and, for most, it’s the very first thing they do, ahead of brushing their teeth or answering nature’s call.

I cite these astonishing statistics to underscore a tendency in e-discovery to seek information in those places where we’ve grown comfortable despite compelling evidence that relevant information is elsewhere.  I’ve written on this “Streetlight Effect” before (at p. 252 of this collection of articles), in the context of the blind eye long turned to shortcomings of keyword search.  The latest manifestation is graver still, and will make for a perilous future if we do not rise to the challenge now.

I speak of the rapid accretion of unique, relevant data on mobile devices that has greatly outstripped our ability (or willingness) to preserve and process same.  Look around you.  Do you see the look down generation out there?  Why do you suppose the person in front of you on the jetway is walking so #$%^& slowly?

Apple just sold ten million units of its latest iPhone.  Ten million.  In a week.  How many of those purchasers sought a better device for making phone calls?  Did Apple even hint it had improved the phone as a phone?  No siree, Bob! Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

A Guide to Forms of Production

19 Monday May 2014

Posted by craigball in Computer Forensics, E-Discovery, Uncategorized

≈ 6 Comments

forms_iconSemiannually, I compile a primer on some key aspect of electronic discovery.  In the past, I’ve written on computer forensics, backup systems, metadata and databases. For 2014, I’ve completed the first draft of the Lawyers’ Guide to Forms of Production, intended to serve as a primer on making sensible and cost-effective specifications for production of electronically stored information.  It’s the culmination and re-purposing of much that I’ve written on forms heretofore, along with new material extolling the advantages of native and near-native forms.

Reviewing the latest draft, there is much I want to add and re-organize; accordingly, it will be a work-in-progress for months to come.  Consider it a “public comment” version.  The linked document includes exemplar verbiage for requests and model protocols for your adaption and adoption.  I plan to add more forms and examples. Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Becoming a Better Digital Forensics Witness

03 Monday Mar 2014

Posted by craigball in Computer Forensics

≈ 14 Comments

Bragg_Your WitnessI love to testify—in court, at deposition, in declarations and affidavits—and I even like writing reports about my findings in forensic exams.

I love the challenge—the chance to mix it up with skilled interrogators, defend my opinions and help the decision makers hear what the electronic evidence tells us.  There is a compelling human drama being played out in those bits and bytes, and computer forensic examiners are the fortunate few who get to tell the story.  It’s our privilege to help the finders of fact understand the digital evidence.[1] 

This post is written for computer forensic examiners and outlines ways to become a more effective witness and avoid common pitfalls.  But the advice offered applies as well to almost anyone who takes the stand. Continue reading →

Share this:

  • Click to email a link to a friend (Opens in new window) Email
  • Click to print (Opens in new window) Print
  • Click to share on X (Opens in new window) X
  • Click to share on Facebook (Opens in new window) Facebook
  • Click to share on LinkedIn (Opens in new window) LinkedIn
Like Loading...
← Older posts
Newer posts →
Follow Ball in your Court on WordPress.com

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,231 other subscribers

Recent Posts

  • A Master Table of Truth November 4, 2025
  • Kaylee Walstad, 1962-2025 August 19, 2025
  • Native or Not? Rethinking Public E-Mail Corpora for E-Discovery (Redux, 2013→2025) August 16, 2025
  • Still on Dial-Up: Why It’s Time to Retire the Enron Email Corpus August 15, 2025
  • Chambers Guidance: Using AI Large Language Models (LLMs) Wisely and Ethically June 19, 2025

Archives

RSS Feed RSS - Posts

CRAIGBALL.COM

Helping lawyers master technology

Categories

EDD Blogroll

  • Corporate E-Discovery Blog (Zapproved )
  • CS DISCO Blog
  • E-Discovery Law Alert (Gibbons)
  • Basics of E-Discovery (Exterro)
  • GLTC (Tom O'Connor)
  • Complex Discovery (Rob Robinson)
  • eDiscovery Today (Doug Austin)
  • E-D Team (Ralph Losey)
  • Sedona Conference
  • eDiscovery Journal (Greg Buckles)
  • The Relativity Blog
  • Minerva 26 (Kelly Twigger)
  • Illuminating eDiscovery (Lighthouse)

Admin

  • Create account
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.com

Enter your email address to follow Ball in Your Court and receive notifications of new posts by email.

Website Powered by WordPress.com.

  • Subscribe Subscribed
    • Ball in your Court
    • Join 2,083 other subscribers
    • Already have a WordPress.com account? Log in now.
    • Ball in your Court
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar
 

Loading Comments...
 

    %d