Rules and Regs Pertinent to Computer Investigations

Computer forensics is the identification, extraction, analysis, preservation, and documentation of digital evidence, whether from computers or other electronic media. While there is some parallel with the physical world and the rules and case law that have organically grown around the ability of the government to search and seize property and information, there are unique ethical and legal problems that arise due to the obvious difference with the nature of electronic information. Electronic information is dichotomous in that it is both uniquely fleeting and improbably permanent, depending on the exact circumstances. Electronic information can be encrypted, overwritten, deleted, or hidden. This can make it difficult, if not impossible, to find. At the same time, the ability of computer forensic analysts to find “deleted” files leads to the comment among the tech-savvy that the only way to truly ensure information is deleted from a hard drive is to physically destroy the hard drive itself.

As most communication moves to electronic media and the real history of our lives is stored electronically rather than on paper, the reality is that no information ever truly disappears. That information can later emerge at the most inopportune moments. Limiting that potential is a critical goal in protecting your clients and winning your case.

This is an area where the normally distinct areas of criminal and civil practice blur. Government investigations in the areas you would normally consider to be civil, such as by the Securities and Exchange Commission (SEC) or the Internal Revenue Service (IRS) can easily involve or lead to criminal charges. For that reason, as well as the inherent nature of government authority, it is important to examine the same considerations in either area, and to know the rules that are not only applicable to computer investigations, but that can also alter the outcome of a case.