EdiscoveryCanada.com

Lawyers and organizations alike must bear in mind the substantial difference between forensics and e-discovery. Forensics tools usually allow investigators to (a) mirror image hard drives; (b) index and search through native format data; and (3) restore deleted or otherwise difficult to access files and fragments. Forensics tools are needed where fraudulent conduct is suspected and a user's computer behaviour is at issue. They are not to be used as substitutes for electronic discovery processing tools, which are designed to extract files and data from multiple sources and make them accessible for searching, sorting and reviewing.

Today a client who used a proprietary forensics tool to capture a hard drive (why?) needs to review and produce the documents in litigation. Since they no longer have access to the original hard drive (or to an accessible mirror image), all they have is a digital dog's breakfast.