DIGITAL FORENSICS, SCIENCE OR ART?

WRITTEN BY: CHRISTOPHER MIMS
Managing Editor
April 18, 2009

Digital Forensics, the science or the art, encompasses more than intrusion related security incidents. Some break the process down into acquiring, analyzing, and reporting. Dedicated academic researchers have attempted to define Digital Forensics Science in the past. For example, the Digital Forensic Research Workshop met in 2001 to define this term, and provided a “compilation from group suggestions.” It was later published by Brian Carrier in his paper Defining Digital Forensic Examination and Analysis Tools. They defined Digital “Forensic” Science in a 54 word sentence as “the use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation, and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive to planned operations.” "Art has been defined as a superior skill that is learned or obtained through study, practice and observation -- Is Art a science?

Never the less, there is a fairly new species of evidence in town. It's called ESI, for electronically stored information, and it encompasses any potentially relevant data that's stored on computers, disks, tape, gadgets and the Internet.

The amendments don't so much create new rights as compel lawyers and litigants to deal with the central role computers and the Internet play in business and our lives. ESI comprises a startling 95 percent of all information created nowadays, yet legions of lawyers have been remiss in marshalling this rich evidential resource, preferring instead to focus on familiar paper documents. The Federal Rules of Civil Procedure make clear that discovery of ESI stands on equal footing with discovery of paper documents and require that any request for production of documents be understood to include a request for ESI. Although the committee members who drafted the ESI amendments could have stretched the definition of "document" to include ESI, they wisely recognized that more was needed. After all, so much of the electronic information that impacts our lives -- databases, Web content, voice messaging, even spreadsheets -- bears little resemblance to conventional documents. Instead, ESI is defined broadly to encompass the forms computer-based information takes today and adapt to whatever tomorrow brings.

In 1970, the Supreme Court amended the Federal Rules of Civil Procedure to clarify the issue of discoverability of information stored in computers. Generally, the Supreme Court stated, the discovery principles that apply to paper-based records should apply with equal force to electronic-based records. Electronic-based records include an employee's word processing files, spreadsheets, databases, personal e-mail, backup tapes, and other items. Both the language of the Federal Rules and recent case law make clear that digital discovery requests are controlled by the traditional discovery rules set forth in Federal Rules 26 and 34. See Anti-Monopoly, Inc. v. Hasbro, Inc., 1995 WL 649934 (SDNY 1995), Crown Life Insurance Co. v. Craig, 995 F.2d 1376 (7th Cir. 1993), and National Union Electric Corp. v. Matsushita Electric Industrial Co. 494 F. Supp. 1257 (ED 1980).

While the translation of discovery principles from the traditional paper to the digital context is largely fluid, issues of cost present a potential disjoint. Traditional discovery procedure dictates that the producing party pays the costs of internal preparation for discovery, while the discovering party pays for the costs of copying and transportation. Electronic evidence introduces a more problematic situation. Copy and transportation costs are negligible, but production of the data can be extremely expensive due to the scale of what can be saved-and thereby requested-for discovery. See Sattar v. Motorola, Inc., 138 F.3d 1164 (7th Cir. 1998).

Email provides a probing example. An organization with 100 employees, each generating an average of 10 to 15 email messages per day, will accumulate 240,000 to 360,000 email messages in a year, before we even factor in copies and back-ups. Neither the emails nor, most certainly, the backups and copies will be neatly organized and labeled; as a result, they will need to be searched and categorized in response to a discovery request or turned over wholesale for inspection by the opposing party. While the Federal Rules allow for some cost shifting, we have little idea of how courts will use this discretionary power. See Fennell v. First Step Designs. Ltd., 83 F.3d 526 (1st Cir. 1996); see also Monotype Corp. PLC v. International Typeface Corp., 43 F.3d 443 (9th Cir. 1994); see also Playboy Enterprises, Inc. v. Terri Welles, 60 F.Supp. 2d 1050; 1999 US Dist. LEXIS 12895 (SD Cal 1999). "Come and get it" options appear unworkable, as no one wants adversarial parties examining personal computer systems. See Lawyers Title Ins. Corp. v. US Fidelity & Guar. Co., 122 FRD 567 (ND Cal. 1988); see also Strasser v. Yalamanchi, 669 So.2d 1142 (Fla. Dist. Ct. App. 1996).

It is possible that opposing parties will not act economically when the other party pays for discovery costs. On the other hand, overseeing the process of discovery oneself places significant burden on the producing party, rendering no option particularly compelling.

National Union Electric Corp. v. Matsushita Electric Industrial Co. 494 F. Supp. 1257 (ED 1980) demonstrates another cost issue raised by digital discovery. In National Union, the court addressed the added burden imposed by digital discovery due to the myriad of available formats in which data can be produced. The requesting party asked the court to order its opponent to provide a computer tape containing the same information as was contained on a computer printout. The producing party contested, arguing that there was no computer-readable tape of this material in existence; therefore, it should not be required to "create" the tapes for the sole purpose of discovery production. The court ordered the producing party to create the computer-readable tape, indicating that a requesting party that receives discoverable documents in hard format is not precluded from requesting and receiving a digital -- and more easily readable -- version of the same information. Further, the fact that such discoverable information never existed in a digital format in the first place does not obviate its production.

Cost and expediency of discovery concerns are complicated further by issues of volume. The simplicity of saving and archiving data with electronic media can be a burden when it comes to discovery. Digital discovery tends to be voluminous, as electronic data are easier to copy, archive and distribute; electronic data, unlike their conventional counterparts, do not disappear easily. It is difficult to actually delete and destroy an electronic document. Whether it exists as active, replicant, archival, or residual data, a document rarely dies. The requesting party can easily lose sight of the relationship between the potential value of desired data and the projected cost of retrieving it.

The new media through which electronic documents can be transmitted raise serious privacy issues. Email, records of Web sites visited, transcripts of chat room discussions, and digital voicemail are but a few examples of the relatively new venues for discovery that courts can allow. The permissive attitude courts are taking towards these media tempt employers to monitor employees' emails and Internet use and to otherwise limit workers' privacy.

These questions of cost, volume, and privacy remain open. The courts' and our legal tradition's proclivity towards integrating new forms into extant categories is the source of many of the problems of, as well as the potential solutions for, digital discovery questions. The lingering quandary that judges and advocates must grapple with is whether or not there is anything inherently different about digital discovery that would logically lead to a new discovery approach, or whether the existing discovery procedures are sufficiently elastic to meet the challenges of digital discovery.

If a new discovery approach is deemed necessary-thereby spurring clarification of the current rules or the drafting of new rules-the pace of technological change then becomes an issue. The concern is whether the process of rule adapting and adoption is quick enough to keep up with the technological times, or if any such effort is inherently doomed to obsolescence.

Information obtained from Forensics Magazine, the FBI Crime Lab, U.S. Court Case Files and additional resources have been used to compile this story.

-Chris_