Infosec: IT lawyers missing a trick

Infosec Europe 2008

Lawyers relying on the disclosure of computer evidence are losing out on valuable clues, experts warned today.

When documents or emails are requested as part of a court case, many legal firms accept CDs with the requested material burned on.

However, a computer forensics firm has warned that this misses crucial evidence contained on the rest of the hard drive.

• INFOSEC VIDEO: Interview with Ed Gibson, chief security advisor at Microsoft UK

"If you take a burned CD you just have a lot of documents," said Alan Philips, chief executive at 7safe.

"What you lose is information on the documents themselves and where they have been. If you image the hard drive you do not have to trust what they give you."

Philips explained that the legal profession should learn from the police and take complete hard drive scans. These show what documents have been deleted and, crucially, where they have been moved.

A scan can also trip up the less savvy, since there is still a widespread opinion that simply deleting a file erases it completely. Only the header information is deleted and a skilled investigator can find the file easily.

A key driver, however, is cost. Investigators are expensive but, in a multimillion pound case, it could be a price worth paying, according to Philips.