Yet perhaps the real reason this data is ignored is the format of the Skype database file, which is a SQLite database. Many of the fields within the database are not of any great interest for an electronic discovery matter. Skype records history in various database tables containing countless fields of data, which in honesty is not user friendly and requires the analyst to have some database knowledge. This might not come as a surprise to many of you, and I expect that most Skype users have at some point noticed you can view your Skype message history at the click of a button. Consequently, all IM conversations, call records and details of file transfers are stored locally, be it a computer hard drive or a mobile device. Furthermore, the average user rarely disables the logging functionality of Skype. Helpfully, Skype records our activities in a non-encrypted form on the local device. Current versions of Skype support instant messaging (IM), file transfers, SMS, standard speech calls and video calls. This figure is hardly surprising when you consider that Skype runs on a range of popular electronic devices including computers and smart phones. Skype claim that during peak times they have around 20million users online (). Skype is also a perfect example of the electronic data we are overlooking in eDiscovery. Skype is an ever present communication application on both a personal level and within the business environment. Throughout this article I will discuss proof of concept solutions dealing with Skype in eDiscovery. Nevertheless, it is relatively straightforward to circumvent some proportionality claims with the appropriate skill sets and techniques. As a forensic analyst, I know only too well the variety of different data sources which are overlooked in electronic disclosure exercises, yet I appreciate the strong argument of proportionality. In time this is likely to move onto rich media, in particular video. Typically, the identification and collection phases see email and common office documents harvested, but as technology moves forward is this enough? Many of us are experiencing a rise in audio discovery projects using solutions including phonetics and speech to text. The EDRM (Electronic Discovery Reference Model) is a widely accepted workflow, which guides those involved in eDiscovery.
0 kommentar(er)
