A computer or smart phone under forensic examination is like a sprawling metropolis of neighborhoods, streets, buildings, furnishings and stuff–loads of stuff. It’s routine for a single machine to yield over a million discrete information items, some items holding thousands of data points. Searching so vast a virtual metropolis requires a clear description of what’s sought and a sound plan to find it.
In the context of electronic discovery and digital forensics, an examination protocol is an order of a court or an agreement between parties that governs the scope and procedures attendant to testing and inspection of a source of electronic evidence. Parties and courts use examination protocols to guard against compromise of sensitive or privileged data and insure that specified procedures are employed in the acquisition, analysis, and reporting of electronically-stored information (ESI).
A well-conceived examination protocol serves to protect the legitimate interests of all parties, curtail needless delay and expense and forestall fishing expeditions. Protocols may afford a forensic examiner broad leeway to adapt procedures and follow the evidence, or protocols may tightly constrain an examiner’s discretion, to prevent waiver of privilege or disclosure of irrelevant, prejudicial material. A good protocol helps an examiner know where to start his or her analysis, how to proceed and, crucially, when the job is done.
As a litigator for over 35 years and a computer forensic examiner for more than 25 years, I’ve examined countless devices and sources for courts and litigants. In that time, I’ve never encountered a forensic examination protocol of universal application. “Standard” procedures change over time, adapted to new forms of digital evidence and new hurdles–like full-disk encryption, solid-state storage and explosive growth in storage capacities and data richness. Without a protocol, a forensics examiner could spend months seeking to meet an equivocal examination mandate. The flip side is that poor protocols damn examiners to undertake pointless tasks and overlook key evidence.
Drafting a sensible forensic examination protocol demands a working knowledge of the tools and techniques of forensic analysis so counsel doesn’t try to misapply e-discovery methodologies to forensic tasks. Forensic examiners deal in artifacts, patterns and configurations. The data we see is structured and encoded much differently than what a computer user sees. The significance and reliability of an artifact depends on its context. Dates and times must be validated against machine settings, operating system functions, time zones and corroborating events.
Much in digital forensics entails more than meets the eye; consequently, simply running searches for words and phrases “e-discovery-style” is far less availing than it might be in a collection of documents.
If you can conceive of taking the deposition of a computer or smart phone, crafting a forensic examination protocol is like writing out the questions in advance. Like a deposition, there are basic inquiries that can be scripted but no definitive template for follow-up questions. A good examiner–of people or computers–follows the evidence yet hews to relevant lines of inquiry and respects boundaries. A key difference is, good advocates fit the evidence to their clients’ narrative where good forensic examiners let the evidence tell its own story.
If you’ve come here for a form examination protocol, you’ll find it; but the “price” is learning a little about why forensic examination protocols require certain language and above all, why you must carefully adapt any protocol to the needs of your case. Continue reading
Checking the mailbag, I received a great question from a recent Georgetown E-Discovery Training Academy attendee. I’m posting it here in hopes my response may be useful to you.
I received a fine gift this morning from U.S. District Judge Paul Grimm, and with the authors’ permission, I’m sharing it with you. It’s a 
Two years ago, I 
I have been lucky all my life, a fact taken for granted until standout strokes of good fortune prompt grateful reflection. Today, it’s how blessed I have been, personally and professionally, by association with gifted and indomitable women. In the last sixteen months, I’ve presented with Supreme Court Justice Sonia Sotomayor, NPR legal Correspondent Nina Totenberg and last Monday night, most fun of all, Presidential biographer and pop-culture icon, Doris Kearns Goodwin. How’s that for luck!
You’d have to have been in a coma (lucky you) to have missed the presidential ire and fury roused by the book, Fire and Fury: Inside the Trump White House by Michael Wolff and its excerpts in New York magazine. In them, we learn the President is an insecure, incurious buffoon and his posse of dim opportunists are a bunch of toadies and backstabbers (including many doing double-duty as backstabbing toadies). Who knew?
Houston is my hometown. I wasn’t born there (though both my children were); but, I got there as quickly as I could, at age 17 to study at Rice University. I practiced law in Houston and kept a home in the Houston area for 38 years, longer by far than anywhere else. I have deep Texas roots, proud Houston roots. So, it pains me to see what’s happening in Harris County, and as a past President of the Houston Trial Lawyers Asociation, I’m thinking of all my colleagues whose offices are submerged or inaccessible and whose practices will be devastated and disrupted by Hurricane Harvey.
This article makes the case for routine, scalable preservation of potentially-relevant iPhone and iPad data by requiring custodians back up their devices using iTunes (a free Apple program that runs on PCs and Macs), then compress the backup for in situ preservation or collection.
Cybersecurity and personal privacy are real and compelling concerns. Whether we know it or not, virtually everyone has been victimized by data breach. Lawyers are tempting targets to hackers because, lawyers and law firms hold petabytes of sensitive and confidential data. Lawyers bear this heady responsibility despite being far behind the curve of information technology and arrogant in dismissing their need to be more technically astute. Cloaked in privilege and the arcana of law, litigators have proven obstinate when it comes to adapting discovery practice to changing times and threats, rendering them easy prey for hackers and data thieves.
Ball in your Court 