eDiscovery
Data Preservation
Preservation of electronic data is the first step when litigation has been filed, will soon be filed, or an investigation is needed. This copy must be properly collected, stored, and treated as evidence at all times in order to be admissible in court as mandated by the Federal Rules of Civil Procedure. Improper preservation has consequences from inadmissible data to the loss of key information due to continued computer use. Avansic can sign protective orders and execute court orders when required.
Preservation Process
Avansic begins each project by working with clients to evaluate the appropriate assets, devices and custodians to preserve.
We advise preserving this information by creating forensics copies, which is a gold standard in the industry, since it contains operating system information and deleted data in addition to any user-generated content. During this process, Avansic establishes a chain of custody, captures all of the information on the target device, utilizes a hardware write blocker to prevent altering the original device, and secures the data with a cryptographic hash.
Every case should begin with a proper forensics collection, since this preserves the maximum amount of information including metadata. Even if no additional steps are taken, the data is available for processing, filtering, or forensic investigation. Physical collection can occur on your site or digital assets can be transferred to our laboratory for forensic copying. Avansic is available to forensically copy a variety of digital devices.
If a client chooses to gather their own information, or perform their own "culling", they can provide this loose set of files, emails and other data to Avansic along with a chain of custody for processing. Alternatively, Avansic can perform a select data collection using forensic techniques to gather only targeted data.
Remote Assisted Collection
Avansic can perform remote-assisted collections. This can take place in a number of ways depending on the situation, the client's needs, security concerns, and the targeted data. Remote collection can be used in cases where travel to the client site is not feasible (either physically or economically). Although it is most desirable to create a full forensics image onsite, there are ways to make remote collection a forensically sound process.
In one scenario (Screen Sharing), Avansic's professionals use screen sharing, directing personnel on the client site through the collection process. This method leaves the client in full control of the process without Avansic having any unsupervised access to client systems but allows Avansic to originate the chain of custody and take control of the collected data.
In another scenario (Remote Access), Avansic's professionals can remotely connect to a client site using access credentials and technology provided by the client (such as VPN, remote desktop, etc). Here, Avansic directly accesses the systems and performs the collection without the need for client personnel throughout the collection process. In general, this process is used to collect websites and hosted email (such as Gmail®, Office 365®, Facebook®, Twitter®, SharePoint®, QuickBooks® Online, Salesforce.com®, and other similar sites.)
Storage
Once preservation is complete, all evidence is stored in Avansic’s secure facility and is kept separate from other data. Your data is securely stored in an evidence-grade environment, which includes an electronic access data vault, verified access only, and documentation for all evidence checked in or out of the laboratory.
Litigation Holds
When faced with litigation holds or the need to preserve data, Avansic’s experts can create an evidence grade forensic copy of important digital information and provide secure, off-site storage for this information. This service is ideal for use during employee separation events or for the preservation of data in court cases. If needed at a later time, this information can be worked seamlessly into electronic discovery, ESI processing, or data production projects.
The importance of litigation holds has been highlighted in the Pension Committee vs. Banc of America Securities opinion written by Judge Shira Schiendlin: she was the judge for Zubulake vs. UBS Warburg, a landmark digital forensics case. This opinion states that issuing a written litigation hold fulfills the obligation to preserve. The standards for such a hold have not significantly changed since Zubulake, but the court continues to be very clear about issuing sanctions to those that do not fulfill their obligations to preserve. Legal counsel has an obligation to be directly involved in the preservation process.
Licensing
Improper handling of digital media can lead directly to inadmissible evidence. The court’s acceptance of such evidence is also greatly affected by the proper licensure of the examiner. Unfortunately, these requirements vary by state (and sometimes by city), and are constantly changing. Therefore, attorneys and corporations should apprise themselves of their state’s requirements regarding the handling of electronic evidence. In most instances, forensics and eDiscovery companies should hold a private investigator license for the states in which they collect and investigate digital evidence.
Avansic maintains private investigator licenses in a number of states for all laboratory staff and key personnel. We keep up to date on the changing licensing requirements and have published a paper regarding the licensure of forensics and eDiscovery companies entitled "Overview of Licensing and Legal Issues."