Attorneys need to understand both the way specific devices function and how to explain “what happened” to the data on those devices. Analyzing available related system data (referred to as “metadata”) is often the only way to determine fact from fiction as to what actions were taken with respect to specific documents or files. Forensic analysts investigate at a deeper level of digital context to reach their conclusions, focusing on “the evidence about the evidence.” For example, in traditional discovery, one would simply read a document (whether a hard copy or stored on a device) to assess its evidentiary significance. In the digital environment, however, a document does not exist in isolation – it is surrounded by a host of evidentiarily-significant data that is saved by the machine but is not generally available to the user. Forensic analysts must consider that document not only on a single device, but also in its context on an enterprise network – saved, transferred, edited, and shared via numerous platforms and applications. In short, the evidence about the evidence can often be just as critical as the document itself.
