What Happens if You’re Late to the Game? Part 2

In our last blog, Senior Analyst, Nick Ventura, discussed the issues a company will face when they delay preserving devices that may be relevant to an investigation or other incidnet.  He discussed loss of important data due to normal use, when devices are replaced and when employees leave the company.  In this blog, we’ll discuss another issue with delay in digital evidence preservation — increased costs.

Additional Analysis

When items aren’t preserved in due time it can inevitably lead to increased analysis costs.  The increase is mainly due to data loss.  Files and other essential data can be deleted through normal use, malicious intent or by accident.  When the data is deleted, but necessary to retrieve, data recovery methods can be used to get that data back, but those data recovery methods lead to additional costs.  When the additional recovery steps are not sufficient, questions are asked as to what else can be done, which inevitably leads to more analysis performed in attempts to recover the data, determine if it ever existed or determine what happened to the data.

When data is not found on a specific computer, cell phone or other device, eventually the question is “where else can that data reside”.  More resources are then spent identifying, preserving and analyzing those additional devices.

Dealing with Spoliation Claims

Inevitably, when important data is deleted and not able to be produced in response to a request for documents, spoliation claims are made.  The damage is increased litigation costs defending the claims as well as increased analysis costs to determine what was deleted, and was it a malicious or accidental deletion.  Depending on the gravity of the situation, sometimes no stone is left unturned in finding the deleted data.  Costs can grow quite rapidly in such a situation.

How to Mitigate the Issue

Too often, companies involved in litigation and their attorneys rely too much on just telling the employees to not delete anything and to hold onto relevant items.  That plan is fraught with danger.  First it assumes that the employees can actually determine relevance or can manage their data appropriately.  Second, it assumes that an employee doesn’t get nervous about what is on their computer regardless of whether it is relevant or not.  An itchy trigger finger develops and it points right at the delete key.  Getting your hands around the data early and preserving it properly and promptly is the key to avoiding higher costs and claims of wrongdoing.

by Greg Kelley, EnCE, DFCP, Chief Technology Officer
Vestige Digital Investigations