The Difference Between Computer Forensics, Data Recovery & E-Discovery

 

The three fields work with digital data.  It's all in the form of zeroes and ones. It's taking information that may be hard to find and presenting it in a clear and concise manner.  There are some common characteristics, however the skill sets require different tools, different specializations, different work environments, and different ways of viewing the results.

Data Recovery-normally involves broken hardware or software. When a computer crashes, or an external hard disk, thumb drive, or memory card becomes unreadable, then data recovery might be required. Normally a digital device that requires data recovered will have electronic damage, physical damage, or a combination of the two. It is usually a very expensive process and must be performed in a clean room.

E-Discovery-or electronic discovery typically deals with hardware and software that is undamaged. Due to the nature of computers and of email, there are likely to be very many identical duplicates ("dupes") of various documents and emails. The largest challenge for e-discovery is "de-duping." Searches often are conducted through a very large volume of existing or backed-up emails and documents.  Usually this data resides on dozens even hundreds of computers, and specialized software is needed to conduct the search.

E-discovery tools are designed to reduce the data to a manageable size by indexing and removal of duplicates.  E-discovery is mainly software driven.

Computer Forensics-has components of both e-discovery and data recovery. The forensic examiner (CSFA) searches through both active (existing) archival (data that has been backed up and stored) latent (previously existing, or deleted data).  Performing this type of discovery, a forensics expert may need to work with damaged hardware although uncommon. More frequently the forensic examiner encounters purposeful attempts to hide or destroy data.
The computer forensics expert is also often called upon to testify as an expert witness in deposition or in court. The computer forensics expert’s methods and procedures may be scrutinized.  The expert often is called upon to explain and defend his or her results and actions.