eDiscovery and Preparing Images for Examination

What it is

Electronic discovery (eDiscovery) is the legal process of identifying, preserving, collecting, reviewing and producing electronically stored information (ESI) for a lawsuit or investigation. It differs from forensics in goal: forensics reconstructs events, while eDiscovery produces relevant documents to the other side.

Once an image is collected, it must be prepared so it can be examined without being altered. The exam asks for the EDRM stages in order, what each does, and how to open an image safely.

How it works

eDiscovery process flow

In outline: a dispute is anticipated, a legal hold tells people to keep relevant data, the data is found and collected, filtered, reviewed by lawyers for relevance and privilege, and produced in an agreed format. Both sides usually discuss scope early. In US federal courts the rules for ESI are in the Federal Rules of Civil Procedure.

The EDRM cycle

The Electronic Discovery Reference Model describes the stages.

The volume of data gets smaller as stages progress, because each step filters.

Metrics and tracking

Accurate metrics keep cost and risk visible and defend the process if it is questioned.

• number of custodians and data sources, and data volume collected
• volume before and after processing and deduplication
• documents reviewed, responsive and privileged
• review speed and cost per document
• dates and people for each collection, with hash values
• a continuous chain of custody log

Collection methods

Pick the method to match the need. Self collection is risky because copying a file can change its dates.

Best practices to reduce cost and risk

• Issue the legal hold early and track acknowledgement.
• Limit scope by custodians, date range and keywords, and agree this with the other side.
• Deduplicate and cull before the expensive review stage.
• Use technology assisted review and analytics to prioritize documents.
• Keep the collection defensible: hashes, documented tools, chain of custody.
• Protect privileged material with a clawback agreement.
• Make good information governance a habit, so there is less to search.

Failure to preserve data can lead to sanctions, so risk grows when preservation is delayed.

Getting an image ready for examination

An image is prepared before analysis:

1. Check the stored hash against a fresh hash of the image file.
2. Make a working copy, and keep the master sealed.
3. Open the image read only, or through a write blocker or software that mounts read only.
4. Identify the partitions and the file systems.
5. Record the tools used and the time.

For an image of a whole disk, find the partition start sector first. The Sleuth Kit command mmls image.dd lists the partition layout, and the offset is passed to later tools with -o.

Viewing an image on forensic workstations

Mounting through the operating system can still have side effects, so use the ro option, plus noload on ext3 and ext4 so the journal is not replayed, and noexec to block execution. Better still, open the image in an analysis tool that never mounts it, since that avoids operating system side effects. Do not let the workstation auto mount or index the evidence.

A worked example

A company expects a lawsuit. Legal issues a hold to twelve custodians, and IT preserves mailboxes. A targeted collection pulls mail by date range. Processing removes duplicates and shrinks the set by half.

Reviewers mark privileged items. Separately, a disk image from an executive laptop is hash checked, mounted read only on a Linux workstation and examined with Autopsy.

How the exam asks about this

• "Which EDRM stage issues the legal hold?" → Preservation.
• "Why is custodian self collection risky?" → Copying can change metadata, and the process is not forensically sound.
• "How should an image be mounted for viewing?" → Read only.