In sharp contrast to imaging, targeted live recovery using forensically sound tools and processes is possible. Evidence is sought and not altered by the searching process in that the file data and metadata remain unaltered. Recovered data is collected in a forensically sound and password-protected evidence container. E-discovery tools have been heralding this change—a change I predict will spill over into criminal evidence recovery processes.
Recent developments in the technology available for undertaking e-discovery are now signaling a paradigm shift away from the cumbersome existing processes used to capture and identify digital evidence. For companies involved in civil litigation, there is an increase in electronic discovery involving the capture of relevant digital information for evidentiary purposes.