• Home
  • About
  • CRAIGBALL.COM
  • Disclaimer
  • Log In

Ball in your Court

~ Musings on e-discovery & forensics.

Ball in your Court

Category Archives: General Technology Posts

Storage Media: Long Past Herman Hollerith

20 Saturday Apr 2019

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts

≈ 4 Comments

It’s that semiannual time when I revise my E-Discovery Workbook in advance of the Georgetown Law Center eDiscovery Training Academy.  That means foregoing sunny Spring days in The Big Easy to pore over 500 pages of content and exercises to make them as durable and endurable as I can.  More-and-more, I find I’m adding historical perspectives.  It’s a fair criticism that, with so much to cover, I should restrict my focus to contemporary technologies and leave the trips down memory lane to my dotage.

I can’t help myself.  Though we’ve come far and fast, the information technologies of my youth are lurking just beneath the slick surfaces of the latest big thing.  The punch card storage and tabulation technologies Herman Hollerith (1860-1929) used to revolutionize the 1890 U.S. census are just a hair’s breadth behind the IBM card technologies that dominated data processing for much of the 20th century and cousin to the oily, yellow perforated paper tape that Bill Gates and I used on opposite coasts to learn to program mainframe computers via a teletype terminal in the 1970s.  The encoding schemes of that obsolete media differ from those we use today principally in speed and scale.  The binary fundamentals are still…fundamental, and connect our toil in e-discovery and computer forensics to the likes of Charles Babbage, Alan Turing, Ada Lovelace, John von Neumann, Robert Noyce and both Steves (Wozniak and Jobs).

In the space of one generation, we have come very far indeed. Continue reading →

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

The Computer Book: A Pleasant Stroll through the History of Computing

01 Friday Feb 2019

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Personal

≈ 4 Comments

I returned from frigid New York City last night, modestly triumphant that I hadn’t botched my interview with Watergate journalist and Fear author Bob Woodward.  Woodward turned out to be just the nicest guy and we got on swimmingly.  I shouldn’t be surprised as many of the highly successful people I’ve known have proved courteous and generous of spirit.  I guess nice guys finish first because we are happy to help them succeed.

In New York, heading to the Whitney to take in the excellent Andy Warhol retrospective, I happened on an architectural antiques store in the Meatpacking District called Olde Good Things.  I love such places and was delighted to find they were selling vintage Jacquard loom cards.  I collect (NERD ALERT!) examples of milestone computing technologies, especially antecedent digital storage devices like piano rolls, magnetic core memories and, now, Jacquard loom cards!  I use these for “show-and-tell” in my digital evidence classes.  In a touching twist, the cards I bought were salvaged from an abandoned lace factory in Scranton, Pennsylvania, the old coal town a/k/a Electric City where my father grew up and is laid to rest.  Here’s my acquisition:

This digression has a purpose.  Waiting for me on my return to New Orleans was a book I’d ordered called, “The Computer Book” by Simson Garfinkel and Rachel Grunspan.  It’s subtitled, “From the Abacus to Artificial Intelligence, 250 Milestones in the History of Computer Science;” but, don’t be put off by that mouthful; it’s a delightful read and a visual feast.  Each of the 250 well-curated, chronological milestones are flanked by gorgeous full-page photography.  Among them, Milestone 13, The Jacquard Loom:

The punched cards used in the Jacquard loom circa 1801 were later adapted by inventor Herman Hollerith to tabulate the U.S. Census in 1890 and were forerunner to the punched IBM cards that were a common medium to enter and store digital data from the 1930s through 1970s.  Another descendent: the punched paper tape I used to store BASIC computer programs in high school circa 1972.  Our modern computing feats are often smaller, speedier reimaginings of age-old technologies.  The Computer Book ably underscores that evolution.

I bought the book because I’ve followed Simson Garfinkel’s extraordinary career since he was a graduate student buying second hand hard drives and scaring the snot out of people by revealing how much sensitive “deleted” data could be resurrected via forensic file carving.  That’s common knowledge now, but largely because pioneers like Simson made it so.  Simson is Professor Garfinkel today as well as the Senior Computer Scientist for Confidentiality and Disclosure Avoidance at the US Census Bureau.  Shades of Herman Hollerith! Simson holds seven patents and has published dozens of articles on computer security and digital forensics.

I’m considering making the book required reading for my law classes–something I’ve not done before as I prefer my students not go out-of-pocket.  The Computer Book succeeds in being accessible to the lay reader in a way few books about computing match. To really understand technologies, laws or people, it pays to delve into their origins.  If I ran the world, The Computer Book would be required reading for anyone in the e-discovery space.

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

Loving Location Histories

01 Saturday Dec 2018

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 4 Comments

I give dozens of talks each years on electronic evidence where I discuss geolocation data and its transformative potential as evidence in criminal prosecutions and civil litigation.  Smart phones constantly track our movements using gyroscopes, accelerometers, global positioning features, geolocation apps, cell tower triangulation and three independent radio systems. Our steps are tallied, altitudes logged, and, for many, vital signs are monitored, too.  We are earthbound astronauts, instrumented and coupled to sensors and telemetry as thoroughly as any who journey into space.

This doesn’t fully resonate with audiences until I guide them through their own phones, showing the level of detail with which movements are tracked.  Some listeners boast that they’ve set their privacy settings to block geolocation.  They’re the ones most surprised to learn that, although they can disable their ability to see their own geolocation history and stop geolocation data from being shared with apps, they can’t disable geolocation broadcasting and still have a functioning phone.  Here’s the bottom line: if a phone can operate as a phone, it must broadcast its geolocation coordinates with a precision of ten meters (~30 feet) or better.  U.S. law requires it.

When I broach geolocation data and see that look of “we already know this” creep across faces, that’s when I ask for a show of hands of how many in the audience use iPhones.  Nearly every hand shoots up.  I then invite them to drill down in their phone’s Settings with me to the Significant Locations logs.  Surprisingly, most have never done this before and are shocked, even frightened, by the richness of detail in the data.

To try it on your iPhone,navigate through Settings>Privacy>Location Service>System Services> Significant Locations.  Unless you’ve disabled your ability to see geolocation data, you’ll arrive at the phone’s History list setting out locales visited, and the number of sites gone to within those locales.

But, wait!  There’s more! Continue reading →

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

Cloud Takeouts: Can I Get That to Go?

07 Wednesday Nov 2018

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 7 Comments

Apple take outTwo-and-a-half years ago, I concluded a post with this bluster:

“Listen, Amazon, Apple, Microsoft and all the other companies collecting vast volumes of our data through intelligent agents, apps and social networking sites, you must afford us a ready means to see and repatriate our data.  It’s not enough to let us grab snatches via an unwieldy item-by-item interface.  We have legal duties to meet, and if you wish to be partners in our digital lives, you must afford us reasonable means by which we can comply with the law when we anticipate litigation or respond to discovery. You owe us that.  Alexa, are you listening?”

Amazon hasn’t listened; but, Apple lately gave users the ability to download our data.  Credit for this awakening goes to the European Union’s Global Data Protection Regulation (GDPR) that went into effect on May 25.

Data takeout capabilities are essential to protecting civil liberties and meeting legal duties.  Google’s given users a simple, effective means to repatriate data (including Gmail and calendar data) for five years, although search histories have only been supplied for two.  Twitter’s supported robust data takeout for five years; and eight years ago, Facebook became the first big social media site to offer its users the ability to download contributed content.

Apple is late to the party but it didn’t come empty-handed.  The Apple takeout is extensive and can be huge.  My download comprised 63GB in 26 compressed Zip archive files.  It took Apple five days to assemble the data and make it available for download; then, I had to download each file, one-by-one.  There’s no way to download them all, leaving the distinct impression that Apple doesn’t want takeout to be too easy.  In fairness, had I opted to have Apple deliver my data in 25GB chunks (the largest chunk option) instead of the 5GB file limit I specified, it would have been easier.

In my case, almost all the volume were photos replicated in iCloud.  Notably absent was my messaging, which Apple can’t archive and thus can only be obtained from the iPhone or a backup of same (see my post Mobile to the Mainstream). Continue reading →

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

Mobile to the Mainstream

17 Wednesday Oct 2018

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 12 Comments

Mobile data burden and relevance scorecard

Click f/ PDF

Once you’ve preserved the contents of a mobile device, how do you extract responsive content in forms that are searchable and amenable to review?  Most information items on mobile devices aren’t “documents” that can be printed to a static format for review.  Instead, much mobile content is fielded data that must retain a measure of structural integrity for intelligibility.  This article looks at simple, low-cost approaches to getting relevant and responsive mobile data into a standard e-discovery review workflow, and offers a Mobile Evidence Scorecard designed to start a dialogue leading to a consensus about what forms of mobile content should be routinely collected and reviewed in e-discovery, without the need for digital  forensic examination. Continue reading →

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

On the Road Again: PREX and FEST

24 Monday Sep 2018

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Personal, Uncategorized

≈ Leave a comment

PREXFEST_SMThe Texan in me can’t hear the phrase “on the road again” without also hearing Willie Nelson’s nasal voice singing it.  But, the life I love IS making music with my friends, if by “music” we mean bringing “aha” moments to lawyers and others interested in e-discovery and forensic technology.

Today, I head to Portland, for the 2018 Preservation Excellence or PREX Conference put on annually by the good folks at Zapproved.  It’s a splendid faculty congregated in an always-lovely venue and punctuated by good conversation, fine food and the splendor that is Oregon in September.  PREX is always worth the trip; so, if you have the chance to go, by all means, attend.

This year I have a lot to do at PREX.  I have the privilege to host a keynote discussion with CNN and The New Yorker magazine legal commentator, Jeffrey Toobin.  You can be sure that the U.S. Supreme Court, the Mueller investigation and Brett Kavanaugh’s confirmation hearing will all come up.  Toobin is a bestselling author of seven books, including several on the Supreme Court and on the O.J. Simpson murder case and kidnapped heiress Patty Hearst.  Talking with Toobin rounds out my opportunity to do Charlie Rose-style conversations with Doris Kearns Goodwin and Nina Totenberg at earlier Zapproved events.

I’ll also moderate a “People’s Court” debate between Brett Tarr and Dan Nichols.  Brett is Chief Counsel for E-Discovery and Information Governance at gaming conglomerate Caesars Entertainment, and Dan is a partner with Redgrave LLP, the far-flung corporate e-discovery consultancy.  These two really despise each other, so there’s sure to be a lot of eye-gouging and attacks on legitimate parentage.  (That’s my story, and I’m sticking to it).

Finally on Wednesday, I’ll be doing a little speaking of my own in a lonely breakout session where we will talk about preserving and discovering evidence on mobile phones.  They’ve titled it, OMG, SMS & ESI: Preserving & Collecting from Mobile Devices.  The session description reads:

How does one craft a discovery request for text messages? What are the different techniques for preservation, collection and review of mobile data? When does it make sense to complete a full forensic collection on a mobile device? This session will deliver foundational information and practical examples of process and policy management for mobile devices in ediscovery.

if you haven’t yet come to grips with mainstreaming mobile devices into day-to-day e-discovery, know you’re not alone–everyone is struggling, or more likely closing their eyes, hoping mobile will go away.  Perhaps we can make some progress together.

PREX  September 25 – 27, 2018  |  Portland, OR

Then, no-rest-for-the-dreary, I wing to the Windy City of Chicago (so-called NOT due to weather, but for the propensity of its politicians to pontificate at length).  I’m heading to the annual Relativity Fest, a stupendous amalgamation of e-discovery education and evangelical tent meeting cum rock concert.  If there were the slightest doubt that Relativity dominates the e-discovery review space (and is hungry to gobble up the rest of the EDRM), such foolish doubt will be crushed by the power of Fest.

I enjoy Fest for many reasons, not the least of which is the chance to work with the always-engaging David Horrigan, Relativity’s discovery counsel and legal content director.  David is a fine writer, insightful commentator and skilled teacher.  Eclipsing that is his distinction as a great guy, someone always fun to be around and adept at eliciting the best from those he hosts.

At Fest, David will moderate a panel I’m on called The Internet of Things from a Legal, Regulatory, and Technical Perspective.  I’m fortunate to join Gail Gottehrer, Partner and Co-Chair of the Privacy, Cybersecurity, and Emerging Technology Practice at Akerman, who will give the regulatory perspective, and Ed McAndrew, Partner at Ballard Spahr and former DOJ cybercrime coordinator, who’s charged with the legal point of view.  I guess that leaves the technical stuff to me, which is where I’m happiest anyway.

Relativity Fest  Sep. 30 – Oct. 3, 2018 | Hilton Chicago

I hope to see you at one or both of these exciting confabs, enjoying two fine faculties in wonderful venues.  The joy and value of these events isn’t just what’s planned, but the interactions around and outside of the sessions, too.

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

Preserving Alexa History: Ugly-but-Easy

24 Saturday Mar 2018

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 7 Comments

amazon-alexa-history-angleTwo years ago, I blogged about the challenge of seeking to preserve records of interactions with the Amazon Echo/Alexa family of devices and applications.  I concluded:

“Listen, Amazon, Apple, Microsoft and all the other companies collecting vast volumes of our data through intelligent agents, apps and social networking sites, you must afford us a ready means to see and repatriate our data.  It’s not enough to let us grab snatches via an unwieldy item-by-item interface.  We have legal duties to meet, and if you wish to be partners in our digital lives, you must afford us reasonable means by which we can comply with the law when we anticipate litigation or respond to discovery. “

In a testament to my thought leadership, nothing whatsoever has happened since my call-to-arms in terms of the ability to preserve Alexa app history data.  It’s as bad as it was two years ago and arguably worse because Echo products have grown so popular and the Alexa interface has been integrated into so many devices that the problem is bigger now by leaps and bounds.

Don’t get me wrong, I am Alexa’s biggest fan (and adore her sisters, “Amazon” and “Computer,” so-called for the alternate “wake words” I use to trigger voice communication to Amazon’s servers from other Echo devices).  If anything, Craig the Consumer is happier now with the Echo ecosystem than two years ago.  Wearing my user hat, Alexa’s a peach (and, yes, I am perfectly comfortable with her from a privacy point of view).  Wearing my e-discovery propeller beanie, Alexa is a pain in the butt.  She’s a data gold digger who cooks the books to make it supremely difficult to account for what she’s taken. Continue reading →

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

Docendo Discimus: Q & A

07 Wednesday Mar 2018

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 7 Comments

teach-learn

The Latin maxim Docendo Discimus means “by teaching, we learn.”  So true, because absent my need to stay up-to-date to teach, it’s easy to fall behind.  I teach various places, but of longest standing at the University of Texas School of Law, my alma mater.  My subject is E-Discovery and Digital Evidence, a three-credit, 14-week course.  In my course, information technology enjoys equal status with case law and procedure.  Half the semester is dedicated to mastering the “e” in e-discovery: the foundations of modern information storage and retrieval.  That balance is unique among law school courses.  I don’t elevate information technology because I happen to know how to teach it; I do it because I think it’s what the students need most and don’t get.  It’s certainly what lawyers need most and don’t get.

Why?

Surprisingly, that’s a contentious question.  The arguments against teaching the technology side of e-discovery and digital evidence range from “it’s not law” to “lawyers hire people for the tech stuff, so why bother?”

I think the explanation for the marginalization of information technology in e-discovery classes is simpler: lawyers teaching law school classes have a limited ability to teach technology.  My guess is that if the teachers knew the technology as well as they know the law, there would be more balance in the curriculum.

The limits of instructors hobbles the curriculum of e-discovery, which should spring from the needs of the students.  We should gear our syllabi to what must be learned rather than what can be taught.  First, let’s teach the teachers.

That won’t be easy.  The level of interest is low, and who wants to draw the circle of competence to leave themselves outside the circle?  Too, there are virtually no instructional channels or materials.  No formal incentives.  No funding.  Many invested in the status quo ante.  And all that aside, there’s a dearth of experienced instructors.  We are fuc… challenged.

Continue reading →

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

Houston: We’ve Got a Problem

30 Wednesday Aug 2017

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Personal, Uncategorized

≈ 7 Comments

19-hurricane-harveyHouston is my hometown.  I wasn’t born there (though both my children were); but, I got there as quickly as I could, at age 17 to study at Rice University.  I practiced law in Houston and kept a home in the Houston area for 38 years, longer by far than anywhere else.  I have deep Texas roots, proud Houston roots.  So, it pains me to see what’s happening in Harris County, and as a past President of the Houston Trial Lawyers Asociation, I’m thinking of all my colleagues whose offices are submerged or inaccessible and whose practices will be devastated and disrupted by Hurricane Harvey.

Right now, the needs are basic: shelter, food, clothing, medical care and such.  Soon, however, we must restore the legal and business infrastructure.  Though Houston is home to several megafirms, the majority of Houston lawyers–the best lawyers in the world–are small firm- and solo practitioners.  It’s these lawyers who will help people pick up the pieces of their lives by prosecuting claims for storm damage when insurers decline to pay what’s owed.  In Texas, the need is dire as the toadying Texas Legislature serves at the pleasure of big national insurance carriers, a fact borne out by legislation that, even before Harvey’s waters recede, will operate to deprive Texas insureds of substantial rights to recover for storm losses, effective September 1.  Ironic.  Tragic. Despicable.

So, we must pull together to help Gulf Coast lawyers recover from the storm. My friend, Tom O’Connor, unselfishly organized a relief effort for Louisiana lawyers when Katrina crippled New Orleans and environs.  I’m proud to have contributed in a small way to that effort, financially and by speaking in New Orleans about tech tools to help lawyers cope. I look forward to the chance to work with Tom and with The Computer and Technology Section of the State Bar of Texas to do the same for Gulf Coast lawyers.

There is so much to do, and we must each do what we can according to our particular ways and means. Helping Texas lawyers harness technology to weather the storm is something I can do, and I know it’s within the capability of many of my readers. Houston needs help, and Houston deserves it.  After Hurricane Katrina, Houston took in a quarter of a million evacuees, some forty thousand of them stayed.  When I was at Rice, Houston welcomed 200,000 Vietnamese refugees.  No city is more diverse.  None more self-reliant and can-do.  No city has a bigger heart.

There are a lot of sodden computers and hard drives in Houston and all along the Gulf Coast.  Where once we grabbed the family photo album in an evacuation, today, cherished photos (and crucial client data) is all digital.  To that end, I offer this link to a post I wrote after Katrina addressing data recovery.  We have come a long way since since August 2005.  The Cloud and mobile devices play a big role in data storage, and many hard drives are now solid state; still, the majority of computers rely on mechanical hard drives for long term storage, and water plays havoc with mechanical hard drives. What you do with a damaged device in the aftermath makes a huge difference in whether the data they contain can be resurrected.

Please help Houston, and Houston lawyers, get back on their feet.  Believe me, Houstonians would be there for you.  They’ve proved it many times before.

 

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...

Custodian-Directed Preservation of iPhone Content: Simple. Scalable. Proportional.

26 Wednesday Jul 2017

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 29 Comments

charge sync2This article makes the case for routine, scalable preservation of potentially-relevant iPhone and iPad data by requiring custodians back up their devices using iTunes (a free Apple program that runs on PCs and Macs), then compress the backup for in situ preservation or collection.

The Need
Most of you will read this on your cell phone.  If not, it’s a virtual certainty that your cell phone is nearby. Few of us separate from our mobile devices for more than minutes a day.   On average, cell users spend four hours a day looking at that little screen.  On average.  If your usage is much less, someone else’s is much more.

It took 30 years for e-mail to displace paper as our primary target in discovery.  It’s taken barely 10 for mobile data, especially texts, to unseat e-mail as the Holy Grail of probative electronic evidence.  Mobile is where evidence lives now; yet in most cases, mobile data remains “off the table” in discovery. It’s infrequently preserved, searched or produced.

No one can say that mobile data isn’t likely to be relevant, unique and material.  Today, the most candid communications aren’t e-mail, they’re text messages.  Mobile devices are our principal conduit to online information, eclipsing use of laptops and desktops.  Texts and app data reside primarily and exclusively on mobile devices.

No one can say that mobile data isn’t reasonably accessible.  We use phones continuously, for everything from games to gossip to geolocation.  Texts are durable (the default setting on an iPhone is to keep texts “Forever”).  Mobile content easily replicates as data backed up and synched to laptops, desktops and online repositories like iCloud.  The mobile preservation burden pales compared to that we take for granted in the preservation of potentially-relevant ESI on servers and personal computers.

Modest Burden.  That’s what this article is about.  My goal is to demonstrate that the preservation burden is minimal when it comes to preserving the most common and relevant mobile data.  I’ll go so far as to say that the burden of preserving mobile device content, even at an enterprise scale, is less than that of preserving a comparable volume of data on laptop or desktop computers.  Too, the workflows are as defensible and auditable as any we accept as reasonable in meeting other ESI preservation duties. Continue reading →

Share this:

  • Email
  • Print
  • Twitter
  • Facebook

Like this:

Like Loading...
← Older posts
Newer posts →
Follow Ball in your Court on WordPress.com

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 1,490 other followers

Recent Posts

  • Privacy: A Wolf in Sheep’s Clothing? I’m November 12, 2019
  • A Primer on Processing and a Milestone November 4, 2019
  • Dig We Must: Get It in Writing October 24, 2019
  • Apple Card: Heavy Metal October 3, 2019
  • Cryptographic Hashing: “Exceptionally” Deep in the Weeds October 2, 2019

Archives

RSS Feed RSS - Posts

CRAIGBALL.COM

Helping lawyers master technology

Categories

EDD Blogroll

  • E-Discovery Law (K&L Gates)
  • The Relativity Blog
  • Litigation Support Guru (Amy Bowser-Rollins)
  • BowTie Law (Josh Gilliland)
  • Sedona Conference
  • E-Discovery Daily (Doug Austin)
  • Corporate E-Discovery Blog (Zapproved )
  • GLTC (Tom O'Connor)
  • Ride the Lightning (Sharon Nelson)
  • EDA Blog (Kelly Twigger)
  • Complex Discovery (Rob Robinson)
  • eDIP (Chris Dale)
  • E-D Team (Ralph Losey)
  • E-Discovery Law Alert (Gibbons)
  • Illuminating eDiscovery (Lighthouse)
  • ED&E (Michael Arkfeld)
  • Basics of E-Discovery (Exterro)

Admin

  • Register
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.com

Enter your email address to follow Ball in Your Court and receive notifications of new posts by email.

Powered by WordPress.com.

Cancel
loading Cancel
Post was not sent - check your email addresses!
Email check failed, please try again
Sorry, your blog cannot share posts by email.
%d bloggers like this: