Legacy Devices in eDiscovery
Legacy devices or legacy systems are technology that is outdated or obsolete. That does not mean that these legacy devices are no longer in use. You may have heard about government agencies using computers that are half a century old and speak figuratively “ancient” languages like COBOL and Fortran – those systems are good examples of old technology processing new and relevant data.
You may not encounter a mainframe in litigation, but there is a good chance that you may encounter a case where eDiscovery requires you to review documents stored in a computer or device that no one remembers how to use. Legacy systems may require research, specialists, and extra care to access… potentially translating to unforeseen discovery costs. Here is an overview of legacy items to consider in eDiscovery and digital forensic investigations:
Tape Storage
Before hard drives, computer data was stored on magnetic tape. Today, data is still stored on magnetic tape! Tape storage is more reliable and potentially more affordable than other storage technology, so companies may use them to store current backups. You might encounter the use of tape drives when a business has a disaster recovery plan for their data or has too much data to store in “the cloud” (another computer or set of computers on the internet).
If tape drives are still popular, why are they first on the list of legacy devices? Tape drives may be discovered in formats that are no longer supported. The tape drive itself may require special hardware AND software to be accessed. If necessary hardware and software are no longer available from the manufacturer, you need an expert to convert tape data to a usable and reviewable format.
It is worth mentioning here a form of storage that may be more familiar from home use: cassette tapes. Audio, camcorder, and video cassettes use magnetic tape to store data. We still encounter these items as evidence, especially when dealing with an older CCTV surveillance systems. Cassette tapes are often converted to digital video to efficiently review and produce in litigation.
Floppy Disks
The iconic source of the common “save” icon in most computer software, floppy disks might be difficult to extract files from. You need specific hardware and software to read the data on a floppy disk, although that can be as simple as an older computer with a floppy disk drive. Even then, you should still contact a digital forensic expert to preserve data stored on floppy disks. When properly preserved, there is the potential to recover deleted data or portions of delete files from unallocated space. You may recall that the BTK Killer was identified and arrested in 2005 due to his use of a floppy disk to send letters. Police analyzed the drive to find a deleted document that contained his first name and the name of his church in its metadata.
Feature Phones
“Feature Phones” is the nice term for “not-so-smart-phones” – mobile phones with some limited applications, often associated with the flip phones of the early 2000s. Because many people upgrade their smart phones annually, it’s rare to see someone using a feature phone. Even so, you may encounter them in desk drawers, safes, or even live use by a custodian! Cellular providers offer new flip phones to those looking for temporary or low-tech communication solutions. While these devices have nowhere near the volume of evidentiary data as smart phones, they should still be forensically preserved to produce call logs, text messages, images, and miscellaneous application data relevant to litigation.
Computers with Unsupported Software
Businesses may run antiquated or highly customized software to manage data like customer records or financial information. That software may be incompatible with newer systems or no longer be available from its publisher or manufacturer! A forensic expert can help you access information created by legacy software programs.
Hard Drives
Like tape drives, hard drives are still a very popular and affordable method of storage. Unfortunately, they have a limited life span, especially when viewed in the perspective of discovery timelines. The numbers vary by brand, but some estimates say that 4 years is the average life span for a hard drive! The less you use a drive, the longer it lasts, so this might not be an issue with a computer hard drive that has not been turned on in years. A hard drive can last 10 years… or fail within the first year of use.
Hard drives are vulnerable to physical damage from dropping or vibration. Physical damage can make them more expensive to recover, if not impossible to recover.
Another consideration when preserving hard drives is their configuration. A computer system can structure data on a hard drive using RAID technology, which simply reorganizes and/or mirrors data among multiple drives. This configuration can require RAID software or hardware to piece the data back together. A computer drive can also be encrypted by hardware built into a laptop or other computer in such a way that the data is irrecoverable if that device fails. The older any of these dependent components are, whether hardware or software, the more likely it is that specialized knowledge is necessary to produce documents for review.
