Resources

• What is Avansic's Subscription Services?

  Subscription Services is a way for you to be able to process and review or just review your data, using Avansic's hardware and software that resides at our office. Clients have the ability to log on to their system at any time, but handling servers, licenses, and updates is performed by Avansic. Subscription Services gives clients immediate access to very powerful processing and review tools without the hassle of negotiating contracts for software, purchasing hardware, and hiring the personnel to setup and maintain those tools.

• How much do you charge?

  Avansic has competitive rates for collection, processing, production, and consulting. For full details and pricing please contact Avansic at (888) 808-0337.

  • We charge per hour for onsite collections plus destination media. We waive travel charges under some circumstances.
  • We charge a flat rate per device for laboratory collections.
  • We have a per-gigabyte charge for various processing services (including loadfile production).
  • For large projects, we can provide flat fee pricing.
  • Online review is billed as initial setup, monthly case hosting, and a monthly user fee.
  • Avansic’s Subscription Services are billed as a flat fee package.
  • Expert work and consulting is billed by the hour.

• How much does Subscription Services cost?

  Avansic’s Subscription Services are billed as a flat fee package. This makes it far less complex than outsourcing each individual case. Avansic’s Subscription Services cost is also far more predictable than purchasing software in house, where additional IT management is necessary. Avansic provides training on the tools, as well as documented suggested workflows. Several hours of consulting with Avansic’s expert Project Managers are built into the Subscription Services package. Please contact an Account Executive at (888) 808-0337 to quote your project.

• If I’m a Subscription Services customer, where is my data?

  Avansic handles the hardware, licensing, upgrades, and maintenance in the Subscription Services offering. All data resides on servers in Avansic’s secure laboratory behind several layers of physical and information security measures. Subscription Services clients do not have to purchase any hardware or software.

• What kind of devices can Avansic handle?

  Computer hard drives and servers are the most common digital devices requested for collection and investigation, but we can also find digital information on cell phones, printers, mp3 players, tablets, digital cameras, network equipment, email systems (Exchange, Lotus Notes, GroupWise, etc.) and voicemail systems.

• What kind of clients does Avansic have?

  Avansic works with attorneys, litigation support departments, and corporations across the country. Our smallest cases usually involve a computer hard drive; in our largest case, we processed two terabytes of data in one week.

• How does collection work?

  When possible, Avansic collects a forensically sound fully defensible copy of each digital device, which is the gold standard in the industry. We use write blockers to collect a bit-by-bit copy (also called a forensics copy). Collecting a forensics image allows us to recover deleted information as well.

  This process generally takes between 1 and 4 hours per computer to collect onsite (we can collect multiple computers simultaneously). It can be done on your site or in our laboratory. If the digital device in question is large (such as a file or email server) and only certain information is required, Avansic can perform a select data collection using forensically sound techniques.

• During collection, how long will the computer be out of service?

  Forensics copying can take up to 4 hours for a typical hard drive, which Avansic can do both during and after normal business hours. After the copy has been taken, the computer can be returned to normal use.

• What if the information is on a server that we can’t take down?

  Avansic has experience in performing live acquisitions of technology that cannot be taken offline. Call a Project Manager at (888) 808-0337 for more information.

• What if we’re not in your area?

  Avansic can collect digital evidence in any state in the nation; depending on the scope of the project, it may be possible for you to ship the digital evidence to us. Call a Project Manager at 888-808-0337 for more information.

• How does ESI processing work?

  Once Avansic receives a data set, we prepare it for processing by removing known, ignorable files otherwise known as "de-NISTing". Then, standard file categories are removed (we have a list of these categories available - contact a Project Manager).

  Then, we filter the data set. This includes applying search terms, phrases, date ranges, data locations, file categories, and a variety of other factors that depend on the case. These options are outlined in our standards document.

  Then, we de-duplicate the data set so that only a single copy of a document across the set will be retained, except where doing so would create a gap in review or production. Email and files are treated differently during de-duplication. Note that Avansic only uses defensible de-dupe and filtering techniques - some programs have error rates close to 40%. At this stage, Avansic performs document clustering and other review enhancing processes.

  Then, Avansic performs pre-production and conversion operations including privilege or confidential labels, page numbers, Bates numbers, TIFF conversion, and redactions. After the data set has been marked and converted to the customer’s specification, data export begins.

  When processing for digital forensics, a licensed examiner will work with you to find the specific data of interest.

• How does Avansic export my results?

  Avansic supports many methods of export: the most common being loadfile creation or native file production. Avansic supports dozens of specific export formats for certain tools. These options are detailed in our standards document.

• When will I get my results?

  Once Avansic has received the data, it typically takes a few days of computer time to complete the data preparation/culling/indexing/filtering stage. Filtering or investigating can take anywhere from an hour to several days depending upon the data set and scope of the project. In general, most of our clients receive results within 2-7 business days of collection. Servers and other complex data sets can take longer depending upon size, configuration, type of computer or operating system, and location.

• Can Avansic provide expert witness testimony?

  Yes, Avansic’s experts have provided testimony in many cases across the country. These cases range from small to large and represent a variety of litigation types including intellectual property, employment, insurance defense, environmental, wrongful termination, and more. Avansic can testify to the processes used during collection, processing, and export in cases we have handled. Our experts can also speak to the procedures and processes used by other experts.

• Can Avansic provide assistance with preservation planning or meet and confer?

  Yes, Avansic’s has significant expertise in the area of preservation planning and meet-and-confer issues. We has served as consultants for cases across the country on these very issues. This falls under our Professional and Expert Services.

• Can Avansic perform predictive coding?

  Yes, Avansic has developed a workflow that integrates various machine learning techniques to assist in the document review process. Avansic supports traditional predictive coding as well as unsupervised learning and document clustering. Avansic has developed a workflow using Brainspace's concept clustering and XERA's advanced online review capabilities which adds efficiency to the review process.

• Can Avansic recover a deleted text message off a cell phone?

  This depends entirely on the make and model of the cell phone, how long ago the message was deleted, and the particular storage settings of the phone.

• Does Avansic do audio or video forensics?

  No, Avansic only performs digital forensics investigations on computers.

• How can I be sure the data is secure at Avansic?

  Avansic takes security very seriously, and all client information at Avansic is handled and stored securely. Multiple layers of security are required for all areas where evidence is stored and security systems are in place to monitor all traffic into and out of the office.

• How does Avansic protect privileged information?

  Avansic has significant experience in drafting and implementing clawback agreements. We have served as a neutral third party on many occasions and are experienced with the creation of privilege logs, privileged document sets, redacted production copies, and In Camera copies.

• I’ve heard that Avansic publishes whitepapers, how can I get a copy?

  Sign up for our email list /ContactUs/EmailSignUp/.

The digital world is known for acronyms and jargon, which can be overwhelming for non-technology-based vocabularies. To help you navigate the technology speak, Avansic created the following list of key terms.

• BYOD

  Otherwise known as "Bring Your Own Device." A use policy that some companies and firms are adopting that allows users to select their electronic devices (ie, iPhones and iPads).

• Clawback

  Clawback is a method of data exchange suggested by the Federal Rules of Civil Procedure in which one party releases data to another party without relinquishing the right to later declare items or documents within as privileged. In practice, clawback is best performed using a third-party intermediary.

• Clustering

  Grouping documents based on unsupervised machine learning. Some also call this advanced analytics, technology assisted review, and predictive coding.

• Culling

  Culling is the process of removing clearly non-responsive items from a data set; for example, removing junk mail or de-NISTing the contents of a hard drive. Culling is a high-level process that seeks to reduce a data set by removing the most obviously unimportant items.

• Data Carving

  Data carving is the process of examining a computer’s slack and free space to try and discover any relevant file artifacts.

• De-Duplication (or "deduping")

  De-duplication is the process of removing duplicate files. A different process of de-duplication is typically used for files and email.

• De-NISTing

  De-NISTing is the process of removing commonly found files on computers that involve the machine’s internal operations. This is a common step performed to reduce a data set during ESI processing. There are many lists of known files available; the most commonly used is the National Software Reference Library from NIST. This is also called "Known File Filtering" or "KFF".

• Digital Forensics

  Digital forensics involves the investigation of a data set that includes hidden or deleted information on computers, cell phones and other electronic devices. This is a focused approach to finding data that yields a targeted and relevant data set.

• Early Case Assessment

  Early case assessment is a process to help determine the devices and information relevant to a particular case. This is a way to reduce the cost of eDiscovery from the early stages. Avansic provides each customer with a Project Manager to consult for this type of assessment.

• eDiscovery

  eDiscovery is a broad approach that works to filter and convert data into a reduced set of usable documents for attorney review. It generally includes all active files on a computer hard drive.

• En Camera

  Set of documents containing all privileged documents, as well as the privilege log, and when documents are being produced during the course of litigation.

• ESI (Electronically Stored Information)

  Electronically Stored Information is any information stored on a digital device or on digital media. This term is commonly used in the eDiscovery industry.

• ESI Processing

  ESI processing is a general term that typically applies to any the filtering, searching, and de-duplication stage of eDiscovery. Both digital forensics and eDiscovery

• Filtering

  Filtering is the stage of ESI Processing where the data set is reduced by keywords, date restrictions, custodians, or phrases.

• Forensic Examiner

  A forensics examiner is a professional trained in recovering digital information for legal or investigative purposes.

• Forensics Copy (Image)

  A forensics copy or image is a special copy of a hard drive taken by a forensics specialist that duplicates every single piece of information, written as 0s and 1s, on the hard drive. This special copy ensures that all of the information on the drive can be investigated, including deleted files.

• Hard Drive

  A hard drive is the part of a computer that contains all programs, documents, and the operating system. This is the device that is copied during a forensics collection. Hard drives can also be contained within other electronic devices, including iPods.

• Hash

  A hash value is a small digital fingerprint of data commonly used to test if data has been altered. Common hashes include MD5 and SHA.

• Indexing

  Indexing is a term used to describe the preparation of data to be searched. Similar to the index in the back of a textbook, this process allows quick and ready searching of the entire electronic device. For other searching techniques, the addition of a keyword or term requires a search of the entire drive again.

• Information Security/Information Assurance

  The practice of protecting, detecting and preventing information systems from unauthorized and potentially harmful events.

• Internet History

  Internet history is a computer’s record of which Web sites have been visited. The specific information will depend on which browser was used and the settings for that browser.

• Loadfile

  A loadfile is a file used to import data into a software program. The most common loadfiles are destined for Summation and Concordance. A Concordance loadfile (also called a .dat or .opt file) is nothing more than a sophisticated spreadsheet with rows and columns. A Summation loadfile is a text file with a list of items. Loadfiles contain information that directs the program how to handle data.

• Subscription Services/Managed Services

  Subscription Services, sometimes referred to as Managed Services is a way for you to be able to process and review or just review your data, using Avansic's hardware and software that resides at our office. Clients have the ability to log on to their system at any time, but handling servers, licenses, and updates is performed by Avansic. Subscription Services gives clients immediate access to very powerful processing and review tools without the hassle of negotiating contracts for software, purchasing hardware, and hiring the personnel to setup and maintain those tools.

• Metadata

  Metadata is "data about data", which refers to information captured about a document that isn’t necessarily viewable; this may include access dates, formatting changes, save locations, and users of a document.

• Native File

  A native file is a file produced in the same form in which it was created and stored. For instance, a Word document that is produced as .doc file or an Excel file that is produced as .xls file is a native file.

• Online Review

  The process of reviewing documents using electronic tools and electronic document repositories. Tools typically allow the user to collaborate on a project, tagging, sorting and organizing documents.

• Privilege Log

  When documents are held back from being produced due to privileged content, such as attorney-client or doctor-patient communications, a privilege log is kept of the specific documents and the reason for their exclusion. This log is produced to the opposing counsel and to the judge for the case.

• Predictive Coding

  Uses training sets and supervised machine learning to assign a document into a particular category. There are a variety of tools and workflows available to facilitate this process.

• Production

  Production is the release of documents requested by the other party’s attorneys during litigation. Production can also include the release of documents from a digital forensics or electronic discovery firm to clients, generally in the form of a CD or DVD.

• PST, OST (Mail Store)

  If Microsoft Outlook is used as the e-mail program, e-mails are stored in a single file with the extensions ".pst" or ".ost."

• Redaction

  Redaction is removing sensitive information from a document or document set before release to either the opposing party or to the public. It is common to redact privileged information from a production set before turning it over to the opposing party. Another example of redaction is removing classified information from government documents before making them publicly available.

• Server (File or Email)

  A server is a computer used to allow general access to commonly used files and software through a network. Servers have much more storage and processing capacity than desktop computers.

• Slack/Free Space

  Slack and free space is the unused space on a hard drive that contains leftover and deleted information. A digital forensics image of a hard drive captures this information, which allows forensics professionals to piece together deleted files.

• TIFF, JPG, PDF files

  These are common file types for electronic document production. .TIFF and .JPG file types are image files, and .PDF is a document file that is generally used to transfer content that the user does not wish to be changed. PDF files appear the same regardless of the computer’s operating system.