Archive for July, 2008


Email Discovery as Electronic Evidence

Tuesday, July 22nd, 2008

In today’s legal discovery world, electronically stored information requires special attention in litigation. The recent emphasis on producing electronically stored information requires an e-discovery team to apply legal principles to information technology. But electronically stored information in some cases drive them out of business, especially in companies as they are unaware to find electronically stored information, especially Email and associated attachments. Most email discovery efforts relate to the collection and review of Email as they remain one of the highest risk areas.

Email is most popularly used by all the people for communication of personal or business related matters. Currently more than 1000 million Email accounts are in use Worldwide, with an average of more than 4 Email accounts per person. With the Email accounts, all your incoming, saved, and sent mail is stored on a mail server with in IMAP folders. As we know we all rely on Email to operate our businesses in our personal lives, it is important to take preventive measures to avoid the ultimate disaster of unrecoverable Email.

The message index in the Email s lists the messages and is stored as entries in a database associated with the file structure. When you delete mail messages the attachments of the deleted file are also deleted as well. How ever you can restore them as they are only moved to a special deleted message folder called Trash folder, like the files in Recycle bin. These deleted Email s still remain on a computer hard drive, servers or retained on back-up tapes.

After deleting the Email from the folder, it reduces the size of the database file by eliminating this vacant space. Once they get deleted they restore it in the trash folder, which can be easily retrieved. These files are not removed from an index of the files, they just move to the trash directory and the space is considered to be available for writing new data.

But if an Email in the trash folder is deleted again then it is no longer indexed and no longer readily accessible. But these files are not truly deleted; they still exist on your hard drive. These deleted files have not been erased, but in most of the cases they can be easily retrieved. To retrieve the data from the trash files, forensic examination is required to locate and retrieve them. In some circumstances, these mails may be impossible to retrieve from the server, hard drive or pc because they have been overwritten by other files.

Even if your Email is completely lost, then these mail recovery tools are used to scan the entire hard disk, locate and recovers the deleted Email and also repairs the database if it is corrupted.

Imagine your Email database deleted or the file system corrupted. If that happens, you would need an undelete tool to get the files back. Though the database becomes corrupted, the data content may still exist, but the structure of the file may be wrong such that the mail cannot list the messages. Then you need to use email discovery tools typically to scan your hard disk and list a whole bunch of files with damaged, crippled file names.

As different mail programs store data in different formats like word, Excel, csv, pdfs etc, you must use a data recovery tool that supports the mail software you are using. For Outlook Express or Windows Mail, Mail Recovery is effective and easy to use, For Microsoft outlook files to recover, you need Outlook recovery, and for Mozilla thunderbird mail folders you can recover by using a text editor as they are plain text files.

To avoid severe legal sanctions, you need an easy way to search for relevant Email in order to quickly meet legal discovery requests. In fact, an effective Email discovery solution can help mitigate these legal risks. www.Datatriage.com is one of the leading experts in the field of email discovery, which restores electronically stored information in Email and associated attachments.

Hard Drive Recovery for Your Valuable Data

Thursday, July 10th, 2008

The most valuable assets of a company or an organization reside in files on computer hard drives. This is the main storage element in the system. In many cases the electronic evidence on the hard drive requires special skill and experience in data recovery to identify and retrieve the data. The current crisis of the system can be attributed to a number of factors, such as the inability to access a hard drive especially when back-ups are not available.

Hard drive crashes, Virus attacks or losing your valuable files through accidental deletion can be quite disturbing in your work. Unfortunately the data loss caused by such a failure will lead to financial losses in an organization, as well as to personal life. If the data disaster caused by a hard drive failure is not immediately managed properly, then the data loss can become permanent.

Hard drives are mechanical magnetic storage devices that are extremely susceptible to failure such as head crashes, circuit board shorts, electrostatic shocks, power surges, overheating, etc. To a major extent power failure could damage the hard drive. While Power surges and sags damage hard drives to crash and corrupt Windows systems, databases and other programs and services which need safer shutdown. Unless you have good surge protectors, UPS and backup generators, you can’t always believe to have good and safe data.

Hard drive crashes and Disk Failures in general can be broadly classified into five categories they are…

  • Firm ware corruption
  • Electronic failure
  • Mechanical failure
  • physical corruption
  • Logical corruption

Like other software, firmware can have bugs. When powered on, if the hard disk spins up and is not recognized by the computer then it can be altered as firmware failure. Sometimes the computer will properly recognize the hard drive spin up, but during boot up process it just hangs up before it starts up. The hard disk firmware is soft and corruption in it will not allow the computer to interact with the hard disk. The data in the disk could be recovered if the repair in the drive is rectified and reprogrammed. Recovery requires small level of programming and manipulation of the hard drive.

An electronic failure problem is based on the controller board of the actual hard disk failure where the computer power supply also acts as a source of fluctuations on the hard disk.

Mechanical hard disk failures are due to components internal to the hard disk itself. The data on the hard disk will become inaccessible as soon as an internal component goes wrong .This can be diagnosed, when the system is powered ON it makes a tickling sound. Do not attempt to open a hard disk if you suspect a mechanical fault because there is also a chance that you will destroy any chance of successfully recovering the data. Most common in recovery is unusual disturbing, which a hard disk recovery specialist alone could handle.

When your hard drive is making a ticking or a scratching noise due to bad parts, head crash, water damaged hard drive, and fire damaged hard drive can be caused and will indicate a physical failure. The aperture arm in the hard drive can fail motors or the platters can become damaged and lose the data that they hold.

In case of logical crash the damage is caused by the user such as invalid entry in file allocation, accidentally formatting the drive, loss of file system on a fragmented drive.

Of all these crashes you either need a hard drive recovery specialist or hard drive recovery software where hard drive recovery can work on all kinds of damages. www.datatriage.com is the specialists in data recovery where they retrieve the lost data by using the state of the art data recovery tools for crashed hard disk drives or damaged hard disk.