A variety of different digital electronic devices can be forensically preserved in Electronic Discovery, Digital Forensics and Incident Response cases.
In civil and criminal litigation, ESI is most frequenlty recovered from computer hard drives and external storage media, such as USB flash memory keys. However, any electronic appliance that processes or stores data in digital format can be imaged and analyzed.
Mobile phones are just one example. For all intents and purposes they are hand held computers with processors and memory as well as onboard and removable storage. They handle ESI the same way as desktop and laptop computers. E-discovery processes and forensic examinations therefore can be conducted against them.
Other devices from which ESI can be recovered include tablet computers such as the iPad, digital cameras and video recorders, GPS navigation devices, satellite and cable television DVRs, and digital audio recorders such as telephone answering machines.
When formatted, all digital electronic devices organize ESI into a series of contiguous clusters. Each cluster is limited in size and therefore can contain only a set amount of data - just like a page in a book, which can only contain a certain number of alpha-numeric characters.
Only two types of formatted clusters exist on an digital electronic devices, allocated and unallocated:
On Windows-based computers, allocated clusters are called Used Space; unallocated clusters Free Space:
Allocated clusters contain Operative ESI and file slack; unallocated contain Inoperative ESI and residual data.
Operative ESI includes both Active and Dormant Files. Inoperative ESI includes Deleted, Temporary and Discarded Files. Residual Data are remnants of partially overwritten or fragmented Inoperative ESI. File Slack is residual data located within an Allocated Cluster.
For more information on Operative and Inoperative ESI, see the Data page.