[eDiscovery] The Longterm Preservation of Digital Evidence

作者：  Arthur Gingrande

原文跳转： http://www.documentmedia.com/ME2/dirmod.asp?sid=&nm=&type=Publishing&mod=Publications%3A%3AArticle&mid=8F3A7027421841978F18BE895F87F791&tier=4&id=6D44870EEFAC4C6DBD2BC6DE21DAE9DF 

---

The Long-term Preservation of Digital Evidence

By Arthur Gingrande 

As the emphasis on electronic discovery continues to grow in the legal community, there remains one issue that, for the most part, continues to elude mainstream awareness, and that is the problem of ensuring the long-term preservation of digital evidence. Digital longevity problems stem from the short life of digital information caused by storage media deterioration, rapidly changing storage devices and shifting file formats.

The majority of users are under the impression that because of its easy reproducibility, digital information, unlike analog information, has an unlimited lifetime — and theoretically it does, given the right attention and proper archival diligence. Unfortunately, this defining property of digital documents tends to blind users to their real-world transience and vulnerability. Because rapid technological change and continuously evolving standards require an unrelenting and substantial input of time, labor and funds to safeguard digital data, their preservation tends to require more attention than conservation of other media. Indeed, it does not take much effort to name forms of digital storage that have become virtually obsolete since IBM introduced the PC to the world in 1981. Tape backup systems, 5 ½ inch and 3 ½ floppy disks, immediately come to mind. Indeed, there is a lot of truth to the observation by Jeff Rothenberg that digital information lasts forever - or five years, whichever comes first.

From a legal perspective, the digital longevity problem has particular relevance, since not all litigation involves documentary evidence that is recent. So-called "cold cases" have been solved based upon DNA evidence that was over 20 years old but well preserved in an unbroken chain of custody. If these cases had instead depended on preserving digital evidence, the odds on solving them would have severely diminished.

Records as digital evidence
The ISO 15489-1:2001 defines records as "information created, received and maintained as evidence and information by an organization or person, in pursuance of legal obligations or in the transaction of business." The key word here is “evidence.” Clearly, by definition all records are evidence, but the term “evidence” covers an array of legal objects that is far more wide-ranging than the term “records.” At first, judges allowed only digital documents, such as digital photos, spreadsheets and word processing pages, which were governed by the best evidence rule. But over the past two decades, especially since the publication of the Sedona Principles of electronic discovery in 2006, the use of digital evidence has broadened to the point where judges have allowed into court the use of digital photographs, digital video or audio files, emails, ATM transaction logs, instant message histories, files saved from accounting programs, metadata, Internet browser histories, databases, the contents of computer memory, computer backups, computer printouts, “black box” data from airplanes and automobiles, GPS tracks and logs from a hotel’s electronic door locks.

All of these data types can be stored on various digital media and electronically retrieved later during legal discovery, a process known as electronic discovery or eDiscovery. Electronic discovery specifically refers to discovery of the electronically stored information (ESI) listed previously. In fact, ESI is a term that encompasses virtually anything found stored on any possible computing device – including but not limited to servers, desktops, laptops, cell phones, hard drives, flash drives, PDAs and MP3 players. Technically, information is “electronic” if it exists in a medium that can only be read through the use of computers. Such media include cache memory, magnetic disks (such as computer hard drives or floppy disks), optical disks (such as DVDs or CDs) and magnetic tapes. Electronic discovery is differentiated from “conventional” discovery in that eDiscovery involves computer-usable data while conventional legal discovery refers to uncovering information recorded on paper, film or other media that can be read without using a computer.

The law requires the sponsor of digital evidence to lay the proper foundation. The American Law Reports lists a number of ways to establish such a comprehensive foundation. It advises that the advocate demonstrate "the reliability of the computer equipment," "the manner in which the basic data was initially entered," "the measures taken to insure the accuracy of the data as entered," "the method of storing the data and the precautions taken to prevent its loss," "the reliability of the computer programs used to process the data" and "the measures taken to verify the accuracy of the program." These requirements make the problems associated with digital evidence more stringent than those associated with digital longevity.

Three ways to preserve digital evidence
Accurately and legally preserving digital evidence for a statutory retention period is a task more difficult than simply ensuring the longevity and integrity of digital documents. The definitive exposition on the problem of digital longevity was published in the January 1995 edition of Scientific American in an article entitled, "Ensuring the Longevity of Digital Information" by Jeff Rothenberg. In that article, Rothenberg declared the problem not yet solved, but did suggest some procedures which, if rigorously followed, can preserve digital documents indefinitely. Here is a brief rundown of the major procedures he discussed:

1. Refreshing involves periodically moving a file from one physical storage medium to another to avoid the physical decay or the obsolescence of that medium.
2. Digital migration entails moving digital files from one hardware or software storage system or technology to another.
3. Digital emulation concentrates on applications rather than files and allows a user to access original data by running the native software on a contemporary platform that electronically mimics the original one.

Each of these approaches, if properly carried out, can ensure digital longevity; however, each of them has shortcomings. Refreshing, for example, necessitates that its proponent guarantee commitment to a seamless series of revitalization tasks with a life cycle brief enough to keep physical media from becoming inaccessible or obsolete before they are duplicated. Migration circumvents the requirement for standards, but it increases the risk of losing information due to translation errors.Emulation poses significant development challenges and carries with it greater risk since even a slight software error can make it impossible to run the old applications in the new computing environment.

The Long-term Preservation of Digital Evidence: Part 2

By Arthur Gingrande 

» Note: For Part 1 of Mr. Gingrande's article, Click HERE.

Additional complications
Because preservation efforts in the analog world conceive the work as a physical artifact, archivists were forced to change their thinking radically when it came to maintaining legal objects in digital form. The latter requires the archivist to see information not as a physical thing but to perceive it instead as a disembodied collection of data. This concept, unfortunately, does not square up with keeping the status of digital information as evidence. Maintaining digital evidence longevity entails more than keeping a true copy of a digital object over time. The true copy also must retain its unaltered content in an unbroken chain of custody that addresses data preservation and the accuracy, reliability and durability of the hardware and software systems involved.

From a legal perspective, meeting chain of custody requirements for a digital object is not any harder than, say, meeting those for DNA or for a bullet collected at the scene of a crime. The issue is one of certification rather than replication because ensuring the chain of custody for digital content does not involve an additional act of copying or physical transformation. It simply requires that any change in safeguarding the digital object must be authenticated and recorded in order for it to be introduced as evidence at a later date. However, this problem cannot be solved by digital means alone. It requires activity outside the digital realm that documents when a change of custody has taken place — or certifies it has not. This mandate can make preserving digital evidence more difficult — but no more so than preserving DNA or keeping a lethal bullet undisturbed in its original condition.

The micro-etching solution
Today there is at least one high-tech answer to the problem of preserving digital evidence. Ironically, it requires converting the original digital content into an analog one and then storing that version forever. The solution involves micro-etching, a technology exclusively licensed by Norsam Technologies after it was adapted by Los Alamos Labs from gallium-ion beam micro-circuitry FIB machines to that of etching text and analog items. The Labs specifically developed micro-etching technology in order to store data for the federal government's nuclear waste storage program that had a congressional mandate of 10,000 years and had to be impervious to the electromagnetic effects of nuclear weapons.

Norsam uses their micro-etching techniques to manufacture a high-density archival product called HD Rosetta that can store over 100,000 pages of analog objects — and their digital renditions - from microfilm, original documents or other media onto a 2.8" metal Permafilm™ disk out of which low-cost distribution copies can be made. The final analog output is human-eye readable but, since it is etched on a molecular scale using ion-beam technology, it requires a specialized viewer to read. The micro-etching solution ultimately saves a lot of time, labor and money by eliminating the need for digital refreshing, migration or emulation and the risks associated with those preservation activities.

In a way, HD-Rosetta constitutes the ultimate "blue-collar solution" solution because, in a way, it is simply a variant of ordinary printing in which raster images are republished on a molecular scale using ion-beam transfer technology. The selection of metal — platinum, iridium, etc. — determines durability. Including a digital rendition of the analog content turns the Permafilm disk into a modern-day Rosetta Stone. A thousand years from today, if there were no viewer available, an electron microscope could be used to view the data, and the availability of the binary code would provide a means for digital translation and replication.

When tested at times up to 65 hours, the disks exhibited little or no degradation for temperatures up to 300^o C (570^o F). If they were stored in an inert gas atmosphere, it is expected that they would resist degradation at temperatures above 300^o C (570^o F). Results of exposure and electrochemical tests indicate that the Permafilm disc had a high resistance to corrosion in saltwater, tap water and marine air. After 15 weeks of exposure, no pitting was observed for any of the environments, and the text appeared virtually pristine.

To date, the Norsam alternative seems to be the best solution to the problem of digital longevity, but in its role as evidence, certain additional mechanisms would still be required to ensure that a proper chain of custody prevailed over a disk's statutory lifetime. Chain of custody issues, however, have long been worked out by the courts. For example, locking up a Permafilm disk in a state-of-the-art bank vault could provide an ironclad answer to the problem. Micro-etching technology still is a bit pricey, so it is not suitable for all interested parties. But for now, it provides a conceptual, if not always affordable, solution to the problem of ensuring the longevity of digital evidence.