I hate to do it, because I have the utmost respect for him, but my experience tells me that Craig’s latest article is going to create problems for Lit Support folks everywhere. Not because he’s wrong in any of it, but because far, far too many attorneys are going to see the headline, and the first paragraph, and walk down to their Lit Support department and demand that we do forensic collections.
They’re going to miss Craig’s later points about how to do single drive images correctly (Write blockers, secure work areas, locking evidence cabinets, pshaw! We don’t need that, I just need a copy of the drive.), and they are going to miss his suggestion that you know your limitations. It’s the rare attorney who understands the difference between a standard desktop hard drive, and an SSD drive, or flash memory, and why you need different equipment (connectors) to image them, or why smartphone forensics are very different, or a web or email server is a very different ball game.
The reality is that once you open up a “single drive imaging” shop in a law firm, a good portion of the lawyers are going to believe, and promote to their clients, that the firm does in-house forensics! The person tasked with capturing these images will spend just as much time explaining, arguing, and getting flack from attorneys who don’t understand the limits than they do actually imaging drives for a lower cost. I’ve been that person. It’s not worth the hassle.
To be fair, Craig covers that in the article, and attorneys with a good technical understanding will be able to grasp the conditions under which single drive imaging is really a simple task. Unfortunately, I don’t know how many firms really meet those conditions. I think quite a few don’t even really have a competent person to do the imaging. Note that I’m not saying they don’t have competent IT people, it’s just that your typical IT person is not schooled in the proper handling of evidence, and may or may not actually know how to use whatever tools are available to them. I’ve seen plenty of examples of perfectly good tech support or networking folks who do a horrible job of dealing with eDiscovery. (I’ve been that person too, in a former career.)
At the end of the day, maybe I don’t really disagree with Craig as much as I see the legal world from a different perspective. In a perfect world, there is really no reason why firms can’t do single drive imaging. My experience and my connections in this field tell me that this perfect world doesn’t really exist, though. Not in law firms, anyway. Not yet.