Publications
The Case for Electronic Discovery
-
Steven
Burgess Forensics
Nearly every document begins its life on a computer, as a computer file. Computer files are quite dynamic in nature. They change over time as they are accessed. Computer files are not immortal, but the act of deleting a file does not destroy it. Nonetheless, the very act of using a computer overwrites computer files.
This document describes how documents are created, what happens to them after their creation or attempted destruction, and explains the following important points:
· Documents when deleted are not necessarily destroyed, and as such, may be recoverable by a professional computer forensics examiner.
· Files retrieved by commercially available data recovery programs are not likely to include all relevant documents or information.
· Continued use of a computer after file deletion may cause the destruction of previously deleted files or documents: Time is of the essence.
· Copying of computer media can be performed without disrupting the data on the computer.
Burgess, S. 2006, "The Case for Electronic Discovery". In: San Luis Obispo Bar Journal, San Luis Obispo Bar Association, San Luis Obispo, CA.