http://ralphlosey.wordpress.com/2007/10/14/sherlock-holmes-in-the-twenty-first-century-definitions-and-limits-of-computer-forensics-forensic-copies-and-forensic-examinations/ A Team approach to electronic discovery combining the talents of Law and IT. The views expressed in this blog are my own, and not necessarily those of my law firm or clients. Copyright Ralph Losey 2008. All Rights Reserved. Wed, 20 Aug 2008 23:55:36 +0000 http://wordpress.org/?v=MU http://ralphlosey.wordpress.com/2007/10/14/sherlock-holmes-in-the-twenty-first-century-definitions-and-limits-of-computer-forensics-forensic-copies-and-forensic-examinations/#comment-6554 Report on a West-Kroll’s “A to Z” E-Discovery Workshop, and a Proposal for a Pure Question and Answer Format « e-Discovery Team Tue, 27 May 2008 11:36:02 +0000 http://ralphlosey.wordpress.com/2007/10/14/sherlock-holmes-in-the-twenty-first-century-definitions-and-limits-of-computer-forensics-forensic-copies-and-forensic-examinations/#comment-6554 [...] files. I have discussed my rationale for this several times, including in two of my favorite blogs, Sherlock Holmes in the Twenty-First Century and “Book ‘em [...] [...] files. I have discussed my rationale for this several times, including in two of my favorite blogs, Sherlock Holmes in the Twenty-First Century and “Book ‘em [...]

]]> http://ralphlosey.wordpress.com/2007/10/14/sherlock-holmes-in-the-twenty-first-century-definitions-and-limits-of-computer-forensics-forensic-copies-and-forensic-examinations/#comment-3171 Ralph Losey Thu, 18 Oct 2007 12:30:41 +0000 http://ralphlosey.wordpress.com/2007/10/14/sherlock-holmes-in-the-twenty-first-century-definitions-and-limits-of-computer-forensics-forensic-copies-and-forensic-examinations/#comment-3171 You make a good clarifying point Aaron. I agree. It requires case by case analysis, but, as a general rule of thumb, full forensic exams are for locating data that are otherwise not-reasonably-accessible, and thus require a showing of good cause. See my many other blogs on Rule 26(b)(2)(B) for a more complete picture on the application and meaning of the new rule. You make a good clarifying point Aaron. I agree. It requires case by case analysis, but, as a general rule of thumb, full forensic exams are for locating data that are otherwise not-reasonably-accessible, and thus require a showing of good cause. See my many other blogs on Rule 26(b)(2)(B) for a more complete picture on the application and meaning of the new rule.

]]> http://ralphlosey.wordpress.com/2007/10/14/sherlock-holmes-in-the-twenty-first-century-definitions-and-limits-of-computer-forensics-forensic-copies-and-forensic-examinations/#comment-3159 Aaron Gardner Wed, 17 Oct 2007 23:57:30 +0000 http://ralphlosey.wordpress.com/2007/10/14/sherlock-holmes-in-the-twenty-first-century-definitions-and-limits-of-computer-forensics-forensic-copies-and-forensic-examinations/#comment-3159 Rule 26(b)(2)(B) does not identify any particular class of data as inherently inaccessible, including deleted data or other data that is only available through forensic analysis as you defined it above. Rather, 26(b)(2)(B) refers to data that are "not reasonably accessible because of undue burden or cost." It easy to imagine that in a case involving only a few computers but where claims reach into the millions that any court would find the relatively low cost of forensic analysis would be well worth it if the requesting party could show good cause and an analysis under 26(b)(2)(C) favored the discovery in question. The point is that while the term "inaccessible" is useful shorthand, it doesn't do justice to the letter of the rule, nor does it reflect the fact that 26(b)(2)(B) will be interpreted differently over the time as technology changes. For example, the mere existence of such an excellent tool as EnCase means that deleted data are far more accessible (i.e., can be accessed with less burden and cost) than they would be otherwise. Rule 26(b)(2)(B) does not identify any particular class of data as inherently inaccessible, including deleted data or other data that is only available through forensic analysis as you defined it above. Rather, 26(b)(2)(B) refers to data that are “not reasonably accessible because of undue burden or cost.” It easy to imagine that in a case involving only a few computers but where claims reach into the millions that any court would find the relatively low cost of forensic analysis would be well worth it if the requesting party could show good cause and an analysis under 26(b)(2)(C) favored the discovery in question. The point is that while the term “inaccessible” is useful shorthand, it doesn’t do justice to the letter of the rule, nor does it reflect the fact that 26(b)(2)(B) will be interpreted differently over the time as technology changes. For example, the mere existence of such an excellent tool as EnCase means that deleted data are far more accessible (i.e., can be accessed with less burden and cost) than they would be otherwise.

]]>