Guidance Software, best known in the e-disclosure / e-discovery world for enterprise network collections with EnCase eDiscovery, has announced a new forensic tool for the Apple iPad, iPhone 4 and iPod Touch. Encase Neutrino also handles Android 2.1 and 2.2.
An iPad may seem small fry compared with the enterprise servers which hold the bulk of a company’s data. The iPad is, however, increasingly the first tool of choice for many executives – it is said that one in five Americans plans to buy one over the next six months, on top of the many who have one already. The volumes on any one iPad are relatively small, but it tends to be immediate in the sense that this is where the employee was working yesterday. It is also right to point out, as Guidance Software’s Frank Coggrave does in this article, that each iPad potentially contains 64 GB of very mobile storage.
It is also interesting to see that IT security departments, who are not unreasonably resistant to the ad hoc addition of external devices to their precious networks, are having to bow to the inevitable in the face of such widespread usage, another point made by Frank Coggrave. When IT departments have spent years trying to encourage user adoption of new technology, they have found it hard to stand in the way of such spontaneous user demands.
Apple products have a way of raising challenges. Giving a talk to lawyers recently, I explained that my iMac desktop had a virtual Windows PC inside it. The word “virtual” obviously passed some of them by, and one could see a mental picture forming of a traditional Windows PC case somehow shoehorned into the slim iMac. What I meant, as I went on to explain, was that you can run Windows within a suitably specified Mac, with its own applications and, potentially, a great deal of data, all invisible to those who were not familiar with the concept of a virtual PC. Forensic data collection is not a game for the amateur.
I am not quite ready to abandon my conventional laptop in favour of the iPad, and I will take both to LegalTech next week. I strongly suspect that, by the end of the year, I will be leaving the laptop behind on such trips, and if anyone needs to collect my data, they will have to do it off my iPad, as well as finding the virtual PC lurking in my iMac.