The Differences Between Digital Forensics And Electronic Disclosure

By Author: Nathan Wilson
Total Articles: 8
Comment this article

The fields of Digital Forensics and Electronic Disclosure are narrowing. However, there are still specialisms required at both ends of the scale.

The merger of Digital Forensics and Electronic Disclosure is becoming more common as the essence of the two tasks is the same. In both instances you must collect the data, then reduce that data down to the potential documents, search the documents for those that are likely to be relevant, and then review them to identify the critical pieces of evidence.

Here are the major differences:

Data Volumes

Electronic Disclosure is much more geared towards handling large data sets, and tools have the capability to batch process and analyse data on a much more scalable format.

Digital Forensics tools have the ability to focus on small segments of data. As data volumes continue to expand we will need the scalability to deal with unlimited data sets while maintaining our capability to handle data in the finest detail.

Multi Source and Multi Custodian

In E-Disclosure the perfect data set is around 30 email files, whereas in Forensics the perfect ...
... data set is a single computer. The ability to merge data sets will continue to be critical as we are tasked with reviewing multiple segments of data. However we must maintain our core traditional skill set, as analysing individual pieces of evidence will remain essential.

Data Complexities and Deleted Volumes

E-Disclosure is all about identifying the most critical documents quickly by only searching the likely data areas, As such the methods will tend to focus on ‘simple’ data such as live emails.

Whereas in Digital Forensics it is important to analyse the entirety of the evidence, and any data recovered from any areas.

Traditionally, Digital Forensics cases review graphic based documents, whereas Electronic Disclosure reviews text based documents.

No Stone Unturned Vs Selecting the Most Responsive Documents

In Electronic Disclosure all investigations must be proportionate, proportionally has been a key factor in E-Disclosure since the arrival of the Jackson Reforms and clearly states that all investigations carried out must be proportionate to the size of allegation, whereas the courts are still demanding in Digital Forensics cases that every bit is still reviewed to ensure there is no doubt in the decision of guilt, hence all investigations must analyse the data in full.

CCL Investigation Vs Client Review

In Digital Forensics it is up to highly trained investigators to analyse and locate the most critical documents in a case. In Electronic Disclosure the data are reviewed by client review teams. This is often done, at a basic level, by paralegals that have very little knowledge of the case. Going forward it is increasingly likely that computer aided review (predictive coding) will be used instead of a 1st pass review.

For more information on electronic disclosure or digital forensics, please call CCL on 01789 261200, or check out our website.

Author:
Nathan is a digital forensics specialist at CCL Group - the UK’s leading supplier of electronic disclosure and digital forensics investigator, including: computer forensics, mobile phone forensics and cell site analysis services. Check out http://www.cclgroupltd.com/digital-forensics