Digital Detectives

Current Issues in Computer Forensics


Knowledge of eDiscovery is vital to today’s legal profession. On this edition of Digital Detectives, co-hosts Sharon D. Nelson, Esq., President of Sensei Enterprises, Inc. and John W. Simek, Vice President of Sensei Enterprises, welcome computer forensics technologist, Craig D. Ball, to talk about how some courts view computer forensics analysis as simply searching on a list of terms, avoiding waste in eDiscovery and the challenges of effective keyword searching.

Special thanks to our sponsor, Applied Discovery

  • Mark


    I listened to your comments regarding your “open letter” to Judges saying they should require 3rd Party Neutral Examiners in most cases. That’s irresponsible, ridiculous and an absurd statement to make to a Judicial Officer!

    In my 14 years of computer forensics experience involving over 500 examinations, third party neutral examiners have only been used in 5 cases in which I was involved. And when it was used, it involved a claim by one of the parties of attorney client privilege or spoilage of evidence – both serious issues.

    And in two of those cases, I acted in the capacity of a third party neutral examiner. Although the parties agree to a search protocol in advance, it’s process is very cumbersome, much more expensive, unnecessarily slow and restricts the ability of the examiner to do a comprehensive examination. The digital evidence given to the examiner is never found to be exactly as the parties say it is – in structure or content. So establishing strict search protocols that a neutral needs to operate does not necessarily make for a better search outcome.

    The expense of a computer forensics examination can often be burdensome on the parties of a case. Adding an additional expense for a third party neutral examiner unduly increases that expense burden. And the parties are still going to retain individual experts to advise them on how to manage the neutral anyway.

    In my experience, a Protective Order has the power and scope to allay the majority of privacy claims made by the parties regarding the review of their digital evidence. Although, some attorney’s think examiners are interested in their client’s personal non-relevant data, we really could care less.

    So based on your judicial open letter, attorney’s will now add the 3rd party neutral tactic to their bag of tricks and quite possibly have the favorable ear of the Judge.

    Instead of providing clarity to an important issue, you made the waters a considerably more murky. Congratulations!


  • Pingback: Podcast: Current Issues in Computer Forensics | Legal Talk Network : Legal Technology Today

  • Ralph Losey

    Excellent interview. Craig is again the model of clarity and elucidation. And the questions asked and responses by Sharon and John were very good too.

    I will try to remember the Justice Holmes quote “Even a dog knows the difference between when it is kicked and stumbled over.” I also like the “trains on time” quote, but am not sure I have the guts to use that one the way Craig does.

    When is the cruise? I’ve been thinking about that one too and have a crew lined up. Let’s do it!

  • Craig Ball

    Hello Mark:

    Thanks for your unsparing comments. Did you read the open letter I reference, or are you just working from the interview? I don’t expect you’ll agree with me in any event, but your comments suggest you may not know the specifics of what I proposed or when it would adhere. I was addressing the propensity for abuse that follows a turnover order of a storage device without protections in place to shield legitimate privacy and privilege interests. I certainly did not advocate anything that applies to ” most cases.”

    I appreciate that you may hold a different view, but might you be gilding the lily to suggest that what I advocated was irresponsible, ridiculous and absurd? It’s not like called on people to vote for Sarah Palin.