Free Trial

Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

Share this Page URL

Legacy Search and Identification Techniq... > Keyword and Boolean Searches - Pg. 216

216 Chapter8·DataIdentificationandSearchTechniques We will not address hard-drive images in detail in this chapter. What is important to note, however, is that once the drive is imaged, the data must be searched to identify the potentially relevant ESI via the other techniques and methods discussed in this chapter. As a general rule, hard-drive imaging is an extremely inefficient method to search for and identify potentially relevant ESI as it frequently results in a gross over-collection and over-preservation of data that is not relevant. Hard-drive imaging may often be needed for preservation purposes, and may be needed for searching, particularly when dealing with key custodians, or in the case of white-collar crime or government investigations, where the consequences of and potential for spoliation can be much greater. In other circumstances, full hard-drive imaging is not required as a matter of course. See Diepenhorst v. City Of Battle Creek, 2006 WL 1851243 (W.D.Mich. June 30, 2006). T ip Although hard-drive imaging is not always necessary or advisable, it is essential when you may need to search for deleted files, ensure preservation of all of a custodian's data, or conduct a high-risk investigation. A forensic, bit-by-bit image will enable you to search for deleted documents that may remain on the hard drive. The employee's act of deleting a document simply breaks the link between the document and the user (the path and filename of the document are removed from the computer's