An American Bar Journal eColumn article brings us relevant revelations about Vista’s improved ability to provide evidence for court.
Innovations within Vista apparently make it far easier to find evidence on PCs. Chief among those are Shadow Copy, Transactional NTFS, and Instant Search.
Shadow Copy holds ‘deleted’ data far longer than previous Windows versions, ostensibly for disaster recovery. It increases the ease of undeletion far after an event.
Vista’s Transactional NTFS lets investigators build more accurate timelines. “You can look in there and see something was accessed on Monday, Tuesday and Saturday at such-and-such a time going back months,” said one forensics expert.
Instant Search indexes are a new source of discoverable information about nearly everything one uses a computer for. “It’s Google Desktop on steroids,” said the PC sleuth. “It’s an indexed database of more evidence stored right there on a computer.”
An attorney said Bitlocker encryption might make life easier for small law firms and solo attorneys. If their client provides access to look in a PC, a quick scan might show the chance that data could be found by an expert.
“If you can’t afford a forensics expert for every case, at least you can take a look to see if … some potentially discoverable documents have been on a computer… Once you determine [that], … then you can talk about hiring experts.”
Has your Corporate Compliance Officer been turning handsprings about how Vista makes legal discovery much easier in litigation? Have you considered what’s saved in your Vista PCs?