Forensic, General & Medical
Expert Witnesses

Using Electronic Stored Information


     By Interhack Corporation Computer Forensic Expert Witness: Data Breach, Information Security, Cybersecurity

PhoneCall C. Matthew Curtin, CISSP at (614) 545-4225


Expert Witness: Interhack Corporation
Information technology has come a long way since the time of cuneiform tablets. Today litigators are finding that their cases---whether "computer cases'' or not---are relying increasingly on electronic stored information (ESI). This article considers two issues of ESI: data formats and encoding, and why lawyers should not fear the technology.
Fundamentals of Information Technology

Most people think about written information in terms of documents. Working with electronic information, particularly in litigation, requires modernizing our mental models of information management and storage. Two important issues that emerge with electronic data are formats and encoding. We can understand these by working from familiar analogies.

Data Formats are Just Like Paper Forms

Imagine every U.S. taxpayer being required to send financial information to the IRS by writing a letter with critical data, together with explanations included in whatever format each person prefers to represent it. The burden of reading and processing the information---to say nothing of error detection and correction---would make the task prohibitively expensive. To address this sort of problem, organizations began to use forms---pre-printed sheets of paper with boxes to fill out, requesting specific details. Finding the right information thereby became much more economical by knowing which line item to reference on the proper form.

In computer systems, we have precisely the same issue. A Microsoft Word file, for example, is more than a document ready to be printed. It's a format defined by Microsoft to store information needed by Word to represent the document you want, to which is added other information that might be of interest. The format allows for the information to be manipulated easily, and enables storage of the last time of printing, last time of modification, and time of creation. All of these data---called "metadata,'' as they are data that describe the data most visible to the human software user---can be found and used by Word because the format provides for it, and Word knows which "line item'' to reference.

Data formats, sometimes called file formats, abound. Each format has unique properties that make it good for some uses and bad for others. The Portable Document Format (PDF) is very good for information interchange because it defines a precise layout, but does not include any document revision history. Microsoft's Word format is good for helping you to pick up where you left off when you last used it, but is viewable and editable only by persons using Word compatible software. Understanding file formats and when to use which is important, but is a topic for another discussion.

Information Must Be Encoded For Storage

Computer systems are just machines full of switches that can be turned on and off. This is what it means when we say that computers are binary machines: that all the information it stores must be encoded for the computer's benefit as a series of ones (meaning "on'') and zeroes (meaning "off'').

"Encoding'' can be a scary word, but in truth, there is nothing exotic about it. Humans have been encoding information as long as there has been communication. Encoding is simply taking information and storing it according to a set of rules. Written English, for example, is encoded in a system of twenty-six characters, ten digits, and some punctuation marks. Mariners have long used flags to encode certain information for others to see, such as the strength of wind. Morse Code works very much like today's binary systems, storing everything in a series of dits and dahs.

English: A
Morse Code: . --
ASCII Value: 65
ASCII Binary: 1000001


People that use computers need not know binary any more than the people who used telegrams for communication needed to understand Morse Code. In litigation, however, things are often not quite as they seem and digging down below the obvious can prove worthwhile.


Making Electronic Information Useful

Simply obtaining electronic information will not guarantee its comprehensibility. Before agreeing to the receipt of electronic information in one form or another, be sure that you understand your options and your objective. Do you need the ability to see previous revisions of documents? Do you care more about how the document looks when printed? Do you need the ability to verify certain technical details about the data? Knowing your objective and engaging the right expert before you've unwittingly limited your options can go a long way in helping you to be the most effective advocate that you can be.

Copyright 2008 Interhack Corporation

ABOUT THE AUTHOR: C. Matthew Curtin, CISSP
Matt Curtin is a Columbus-based technologist, writer, and entrepreneur. He helped to develop the technical infrastructure for some of the earliest electronic commerce Web sites and to show others how to use technology such as network firewalls and cryptography to protect their data and their users.

Curtin founded Interhack in 1997 as a research group that looked at the side-effects of using the Internet as a large-scale computing and communication platform. In 2000, Curtin organized Interhack Corporation and its professional service practices in Forensic Computing and Information Assurance. Interhack's forensic computing practice and Curtin's expert opinion have been used to establish the leading case law on the application of Federal wiretap statutes to Web technology, In re Pharmatrak Privacy Litigation.

Curtin maintains a regular academic appointment as a Lecturer at The Ohio State University's Department of Computer Science and Engineering.

Copyright Interhack Corporation

More information about Interhack Corporation


While every effort has been made to ensure the accuracy of this publication, it is not intended to provide legal advice as individual situations will differ and should be discussed with an expert and/or lawyer.
For specific technical or legal advice on the information provided and related topics, please contact the author.

Find an Expert Witness