Free Trial

Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.

Share this Page URL

Standards > Auditability and Reproducibility - Pg. 146

146 Chapter6·DefensibleDataCollectionTechniquesintheEnterprise Figure6.3 NTBackup Log File Accuracy Inaccurate or incomplete collection puts you are risk of data spoliation. Have all potential custodians and the possible locations of their ESI been accounted for? Did the tools you use preserve the meta- data of the files you collected? Do you have a way to verify that you collected everything at issue? A common way to establish the accuracy of a collection is through the use of hash values. Typically, MD5 hash values are utilized. A hash value is a unique value generated via an algorithm run against the contents of a file. If one bit within a file changes, the hash value will change. If hash values are deter- mined at the point of collection and documented, the accuracy of a file can always be verified. Auditability and Reproducibility The protocol used for data collection should be auditable and reproducible to be defensible. Documentation, as outlined earlier, is a large factor in the audibility of a production. Although collection of data from a live system will not be reproducible because data is constantly changing, the methods to collect it should be reproducible by anyone with proper experience following the steps outlined in your documentation and collection protocol.