Digital forensics, once used mainly by police and security forces, are increasingly used in civil discovery / disclosure.
As Luke Holden of CYFOR explains in this video, there are two main reasons why it is important to collect data using proper forensic tools and techniques.
One reason is to do with efficiency – data may sit on remote email servers, decommissioned computers or mobile phones and iPads, which may be hard to access both physically and in terms of the skills and tools needed to extract the data. Engaging an expert may actually reduce the overall costs of the exercise.
The other, and perhaps more significant, reason is the need to preserve and capture data in a way which cannot be subsequently challenged. The kind of drag and drop collection which the company might do for itself can alter the dates and times of creation of documents or inadvertently falsify the date on which they were sent. Proper forensic techniques and tools of the kind used by side for removes this possibility.
eDisclosure Information Project 