Targeted Collections

A lot has changed since my early days in forensics (before gray hair started to sink in) when the imaging process started with a neutered boot disk, loading the Iomega drivers to obtain access to my JAZ drive and then imaging using SAFEBACK. As data sizes continue to increase, the need to consider targeted collections becomes increasingly important to help manage eDiscovery costs and attorney review time. I’d be interested to get a sense on what the level of use is for tools such as Microsoft’s Robocopy utility for eDiscovery collection projects where individuals are required to do a targeted collection; I’m not referring to a traditional forensic case (i.e. – misappropriation of trade secrets) where a forensic image of the former employee’s workstation is required, but rather an eDiscovery project where your client is requested to collect and produce responsive data based on a discovery request, and facets such as deleted data are non-issues – this is a targeted collection. A good example would be where there is a single folder or group of folders on a shared network drive that is intermingled among hundreds of GBs or TBs of non-responsive electronic data and the necessity and/or resources do not warrant a forensic image. What tools are you using for targeted collections? On our end we use various tools including FTK Imager and Robocopy, using the standard switches that accurately maintain the date\time stamps for the collected files while creating a log file of the collection. Although I’ve testified on forensic\eDiscovery cases throughout my law enforcement \ private sector career I’ve never had to provide any testimony regarding a targeted collection. If anyone has I’d be interested to hear about the case or be provided the case name. Thanks in advance.

Anton