Nationwide Toll Free: (877) 787-7075

Duplicate Copies During a Forensic Data Collection

7 Reason to make duplicate copies during a forensic data collection by www.ssgllc.org .

1:2 Forensic Data Collection

“Twinning” & 7 Reason why Duplicate Images Should Be Made During the Data Collection Process.

The basic reason for a forensic data collection is to preserve data as well as its integrity.  There are many ways to conduct forensic data collection services. At Surveillance Specialist Group, we believe that dual imaging data collection should be conducted whenever possible.  Using this 1:2 methodology, two forensic images are made simultaneously for each data source. Here seven reason why the forensic data collector should create two copies during the forensic imaging process.

 #1 Cost – One of the best ways to reduce your client’s cost is to cut the data collection cost in half by possessing the ability (and equipment) to make two simultaneous copies at on time.  Less reputable companies offer data collection services may see this as cutting client’s billable hours in half.  Here at Surveillance Specialist Group, we see this as offering our clients better service as well as an opportunity to build a long-term relationships.

#2 Hard Drive Failure – All media is made by man and therefore subject to failure. Hard drives can fail during and after a data collection.  When it comes to e-Discovery cases, whereby data collection is done per a subpoena, you may never get a second chance.  Surely if you have to explain to the client that you lost their data, embarrassment maybe the least of your worries.  When duplicate forensic images are created to two separate drives, you now have redundancy.  You can always make additional copies of your forensic image, should one of the copies perish.

#3 Failure To Verify – Part of the forensic data collection process requires that the forensic image be validated against the original.  There are a number of reasons why a drive could fail to verify.  These failures can be as simple as bumping a SATA cable during the data collection.  Forensic data collection devices that offer simultaneous copies have duplicate data paths to the target drives.  This is particularly important when you are imaging large hard drives.  No one wants to learn after eight hours of imaging; it’s time to start over.

#4 Lab and Archive – After you have obtained dual copies of forensic images you now have a copy to be used for forensic analysis as well as a copy to archive.  The redundant image can be called in the event the lab copy fails to verify after your forensic analysis.  This practice also safeguards against accidental deletion and other instances of human error.

#5 Client and Examiner – It’s not uncommon when working for large corporation for their legal team to request a copy of the data for themselves.  A dual image data collection will provide a copy for you and your client.

#6 Alternate Transport – In cases whereby your client my be in another state, its not uncommon for your client to request two forensic copies of all data be made.  One copy can then shipped to the client, while you retain an alternate copy.  Once the client receives their copy and verify its forensic integrity, they may request that you destroy your copy.  This methodology safeguards against a single forensic image being lost or damaged in shipping.

#7 Continuity – Often during the forensic data collection process, multiple electronic storage containers may be involved.  Devices such as the Voom Hard Copy 3P and the Tableau TD2 (we use both) allow you to not only make duplicate copies of forensic images simultaneously, but also, offer the ability to place multiple images on a single hard drive.  For example, a recent data collection project involved a laptop with a 500GB hard drive, a desktop with a 80 GB hard drive, and a third desktop with another 500GB hard drive.  During the data collection processes, we were able make simultaneous, duplicate images of all the drives onto two separate 2TB hard drives.  This process makes it easier to transport forensic images; they are easier to manage in the Lab; and easier to store in your safe.  The storage space required to store two hard drives is far less than six. Finally it’s less costly to overnight on drive versus three.

 

We hope that you found this article informative and consider it in when choosing your data collection vendor. If your data collection project is in Florida, we hope you consider Surveillance Specialist Group. To learn more about our services, and us visit us at www.ssgllc.org or all us at 877-787-7075.