Collecting and Recovering ESI from Computer Memory – Collection Fundamentals Series, Part 4
A multi-part series on the essentials practitioners need to know about ESI collections
by Matthew Verga, JD, Xact Data Discovery
In “Collection and the Duty of Technology Competence,” we discussed lawyers’ duty of technology competence and the importance of understanding collection to fulfilling that duty. In “The Broad Scope of Collection,” we discussed the potential legal and technological scope of collection. In “How Computers Store ESI,” we discussed the operation of computer memory. In this part we review collection and recovery from that memory.
Physical and Logical Collections
As we discussed in the last Part, we are generally concerned in collection with the primary, non-volatile data storage in a computer (or mobile device), whether in the form of a hard disk drive or a solid state drive (or the mobile device equivalent), and there is a distinction between what’s actually, physically stored on that drive and what the computer is currently tracking in its master storage spreadsheet for that drive. Collections can be based on either.
Physical collections of storage drives capture an exact copy – or “image” – of everything on the physical storage, regardless of what the master storage spreadsheet says about where data is and isn’t on the drive. This is a bit-by-bit copy, also known as a “bitstream” copy, which replicates all the physical contents of the storage exactly as they are, essentially creating a virtual duplicate of that physical hardware. The primary benefits of this approach are its completeness and the potential for recovery of deleted files it provides.
