IT GRC Forum

Forensically capturing a conventional disk is straightforward: power down the system, attach the drive to a portable forensic unit using a protective write-blocking device, and then capture the device bit-for-bit. Since the drive is protected by a write blocking device, the drive is presumed completely intact. Non-conventional mass storage devices (e.g., “solid-state disks,” hereafter “SSD”) implement features that invalidate the presumptive efficacy of write-blockers. This has implications in both the government and corporate worlds.

The sheer volume of electronically stored documents (ESI) often seems to obscure the actual business data stored on information systems. Digital forensics and electronic discovery (e-discovery) procedures encompass the full spectrum of digital information. In the legal community, electronic data is known as “Electronically stored information” (ESI). The sheer volume of documents, presentations, spreadsheets and similar electronic analogs of paper documents has spawned a huge need to collate and analyze data. The “paperless” office has, in this sense, produced a blizzard of electronic documents for analysis. In this blizzard of standard format electronic documents, the actual contents of various information systems are often underappreciated. This should not be so. Information systems, whether custom or packaged, are an important source of original raw data about a business. Abstracted documents, whether memoranda or invoices, are derivative forms based upon the raw information.