There is no problem with automating various aspects of the forensic process as long as you (the analyst) know the various processes comprising that automation and you have performed some sort of validation.
Is your friend suggesting that you do all those steps by hand, or that you confirm RR's results by hand after using it? Manual confirmation of your tool's results is wise, absolutely.
now i understand, i believe, he might be referring the analysis part.. need to manual seek out the evidence, as maybe some evidence might be overlook through automation.. by the way, if you don't mind.. if you know any research conducted in storage management for network forensics?
To go back to I5205's question about keeping records
There are usually regulations and laws about what may or may not, (or must), be kept. Along similar lines, how those records are kept is usually regulated as well.
In my experience, (working for about a year and a half as a file clerk at a law office), record keeping is not always as meticulous as it is supposed to be. This leads me to think that most people think that the consequences for keeping a badly maintained archive are unlikely. (Even if you are meticulous, you might not be able to count on clients's archives being well organized.)
Thanks again for the advice guys.
Dom