Information Technology Reference
In-Depth Information
5
The Hunt
Recovery.and.Acquisition
5.1 INTRODUCTION
In.this.chapter.we.begin.looking.at.the.recovery.and.acquisi-
tion.procedures.you.should.think.about.in.your.organization.
or.even.as.an.individual..These.processes.and.ideas.can.assist.
anyone.who.needs.to.better.understand.the.“where.and.how”.
of.electronic.evidence.(Figure 5.1).
We.consider.the.“hunt”.and.all.of.the.different.ways.that.
that.all.important.electronic.data.may.elude.capture..We.also.
discuss.the.classiication.of.data.as.“privileged”.or.“sensitive”.
or. “unreasonably. accessible,”. and. all. the. requirements. you.
need.to.meet.to.prove.those.classiications..We.give.you.the.
means.to.recognize,.organize,.and.document.those.classiica-
tions.in.a.way.that.will.hold.up.in.court,.or.for.an.audit,.or.
simply.for.your.own.organization.and.protection.of.said.data.
We.also.talk.about.nonrepudiation.versus.plausible.deni-
ability,.the.very.basis.of.evidentiary.law,.and.in.many.cases,.
189
