In both civil and criminal courts, digital evidence in various electronic formats is gathered and examined in the process known as Electronic Discovery. The task of seeking out electronic information suitable for usage as evidence generally involves a larger collection of specialists than other legal procedures. Forensic investigators, IT managers and lawyers are often involved in the process.
Electronic data needs to be approached differently than evidence found on paper because of its elusive size and form. Electronic information is virtually impossible to destroy. Often times, the only way electronically stored information may be eliminated is by the physical demolition of the original source of the information as well as any other hard drive containing the information. Unlike paper evidence that can be burned, shredded or disposed of completely, even when a user hits the “delete” button to remove information on a computer, the information does not cease to exist. Deleted files are merely removed from the file allocation table making them more difficult to find.
Electronic data is typically joined with metadata not found with printed material. This metadata can play a significant role in a case as you can thereby determine when an electronic document was written. Content from various websites, instant messaging chat rooms, e-mails, computer files, images and voicemails may be searched by specialists for valuable evidence. Due to the electronic data’s obscure origin, electronic evidence may not be revealed in court. Certain devices used for data replication may have been destroyed. Information may remain untouchable because it has been erased and/or and recorded over. In order to obtain this electronic information, investigators quarantine the original source. The computer storing the original piece of evidence is placed in a secured location. A copy of the hard drive is made for investigative use, while the original computer is kept in optimal condition.
Searching digital data requires measurably less time than scrutinizing printed materials. Computers allow information stored to be searched for simply, while printed information must be tediously examined manually. Modern electronic data archiving systems allow for effective storage and minimal retrieval time. In 2006, the United States Supreme Court amended to the Federal Rules of Civil Procedures a category for electronically stored information that require data within emails and instant messaging chat rooms to be stored and retrieved when necessary. Archiving systems are put in place that may archive information only accessible with the application of a secure code. This prevents alterations to original evidence, and protects data from being deleted.
Businesses may be required to archive voicemails created by their employees if potential litigation arises for one of their employees. However, information stored on corporate-issued PDAs or smartphones may pose an issue, as tools for obtaining data from these devices could be difficult to acquire.
Electronic evidence may be reviewed by litigators in print, via PDF file, in its “native file” format or as a single- or multi-page TIFF image. This makes the information more easily reviewed by those involved in a case. Data collected through the electronic discovery process is then sifted through and examined. This evidence could prove vital in determining one entity’s guilt or innocence.