Opticon Viewer image problem

We had a problem reported that some colour Tiff images that we produced were not viewable in Opticon.

After a lot of diagnostics on the images, we found a few JPG Colour Tiff images that had been produced with Motorola (big endian) byte order and not Intel (Little endian) byte order.

 It appears that a lot of viewers can cope with this type of Tiff (including irfanview) but Opticon version 3 does not appear to support it giving the error “Unable to open the following image (11011): [path]” Where the path is correct.

Anyhow, we reproduced the tiffs with intel encoding, and they worked just fine.

Martin.

DTSearch and Long File names

We have built some bespoke apps on DTSearch, and its a smooth engine, but there are a couple of bugbears that we have had to work around.

These are not DTSearch problems, but just data problems.

 1. Long filenames.  We often move the data from a disc to a SAN, under some extra subfolders. This pushes the path length above the maximum. Windows then struggles to recognise these files and DTSearch can’t see them either. Therefore we move them to a higher level. I wondered if there is any application out there that can access and index files that are longer than the maximum length. I know there is a Linux version of DTSearch… does this help?

 2. Data files.
DTSearch indexes the records in MDBs, CSVs etc as individual documents. We now how to stop this, but I wondered what the purpose of this functionality was?

3. Zip files.

On a large data set, there is nothing worse than having to unzip everything first. However, it would be nice if there was a feature to stop DTSearch indexing the files within a zip file as separate entities. Does anyone know how to do this?

4. MSG Files

When extracting resulting files from DT Search, with HTML MSGs it has the annoying habit of exporting as a folder with constituant parts. I don’t know the solution for this problem. We want it to extract the original file! Help!

Martin.

Trial Bundles

Hi all,

I wondered if any of you out there have any opinion on the best way to create a trial bundle (software wise). If we have a lot of multi page tiffs, and counsel are making changes to the bundle, and taking one page of a whole document and including that, then chopping and changing the order of the documents, and using the documents or part of a document to form other bundles, such at witness bundles, is there any software that can manage this process (including moving individual pages of documents around)?

 Any advice on software/approaches most appreciated.

 Martin.

Taxes Management Act Possession or Power

During my research on document disclosure in the UK, I cam across a great article by DLA Piper on the duty to disclose documents under the Taxes Management act. It explains in easy to understand terms, the duty to disclose document in your ‘power’ or ‘possession’.

Please see http://www.legal500.co.uk/devs/uk/cc/ukcc_013.htm .  Similar concepts apply in the CPR rules Part 31.8:

31.8

(1) A party’s duty to disclose documents is limited to documents which are or have been in his control. (2) For this purpose a party has or has had a document in his control if – (a) it is or was in his physical possession; (b) he has or has had a right to possession of it; or (c) he has or has had a right to inspect or take copies of it.

If you’d like further information, just send me an e

Make sure you are at home!

I don’t know what happened to this post. i think it just disappeared into thin air!

This is what it was supposed to say:

During the course of discovery of electronic evidence, typically collection of the data is entrusted to a few key people in conjunction with consultants and attorneys.

Often we find though, that the key IT people, especially those on the ground performing the collection of data, are entrusted to provide the data requested. Trouble is, they are not always aware of the importance of the task entrusted to them, and often a key contact ends up on two weeks holiday or working on bringing the email servers back up, instead of focussing on the tight deadlines of delievery of data.

If you are running through an exercise to provide data, the key people working on finding and extracting that data should be on call during the entire data collection phase, avoiding anyone who i likely to go on holiday. There is nothing worse than the task being passed from person to person with no real understanding of the issues at hand and theexpected dates for delivery of the data.

My recommendation is that the e-discovery consultant be responsible for the collection of data along with one key person that will be available during the discovery phase and responsible for assisting the consultant in finding the relevant information.

Does anyone have any experience of data collection going wrong due to people taking holidays? I know I have!

Martin.

Microsoft to join e-discovery bandwagon?

Just in case any of you had not seen this, it appears that Exchange has new ‘E-discovery’ features attached see : http://www.microsoft.com/events/EventDetails.aspx?CMTYSvcSource=MSCOMMedia&Params=%7eCMTYDataSvcParams%5e%7earg+Name%3d%22ID%22+Value%3d%221032304395%22%2f%5e%7earg+Name%3d%22ProviderID%22+Value%3d%22A6B43178-497C-4225-BA42-DF595171F04C%22%2f%5e%7earg+Name%3d%22lang%22+Value%3d%22en%22%2f%5e%7earg+Name%3d%22cr%22+Value%3d%22US%22%2f%5e%7esParams%5e%7e%2fsParams%5e%7e%2fCMTYDataSvcParams%5e

Foresically sound or not?

C64’sForensic examination?!

For what reason? What on earth would be stored on there? A couple of saved games and maybe some code half complete from “Input” magazine!? (remember that..).

Anyhow, my question about the below is, there are methods of connecting up parallel ports and floppy drives to transfer data from a C64, however, someone said to me that this was not ‘forensically sound’. What would one do in the situation whereby there is potentially information held within a system, but the only way you could get it was by using a non-forensically sound method. Surely if it was all audited and logged by a third party, this would be enough for any court to accept it as evidence? What would you do in this situation? Answers on a postcard, (or by comment or email!)Martin.

Taken from Guardian Online:

 ”the kidnapping of Natascha Kampusch has been complicated by the discovery of an obsolete computer in the house where she was held, Austrian police said today. Officers have been surprised to find that the kidnapper, Wolfgang Priklopil, a communications technician, appeared to have relied exclusively on a Commodore 64. The beige-coloured machine was popular in the 1980s but is now considered an antique, though some electronic dance acts still use it and it has a cult following among some fans of retro computers. It was hoped that the computer might contain information which might shed more light on the decision of Priklopil, 44, to snatch Ms Kampusch, when she was aged 10, in March 1998. However, Major General Gerhard Lang of the Federal Criminal Investigations Bureau, told reporters the computer would complicate investigators’ efforts to transfer files for closer examination. There are emulators available which can make a modern PC capable of running Commodore 64 programmes but Maj Gen Lang said it would be difficult to transmit the data from Priklopil’s machine to a modern computer “without loss”.

from  http://www.guardian.co.uk/austria/article/0,,1865500,00.html

e-disclosure precedent….. UK (???!)

Hi there all,

I know there are quite a few lawyers subscribed to my bLAWg and I have heard from many of you already. I wondered if any of you have any pointers to case precedents whereby claims have been thrown out, sanctions have been taken, or even individuals held in contempt of court due to the faliure of their e-discovery/e-disclosure being carried out properly? I have done a lot of research and can’t find much easily. I know the US has a lot of this type of information, but in the UK I can’t find much in depth regarding this area.

Any help much appreciated!

 Regards,

 Martin. Martin.Nikel@gmail.com

useful tool - the blawg

One thing I have noticed since starting the bLAWg is how everyone seems to be only too happy to help others out. If there are mistakes in my posts, people have been giving feedback. If there is something they want to discuss, they email me. It opens me up to a world of new knowledge by enabling discussion on products, techie items, processes, systems, events etc. So thanks to everyone who has been involved and shown an interest!

Martin.

Attenex

I get great support from the states and never heard any serious complaints from our users. The Technical guys at Attenex are very quick to respond and are always open to new ideas (e.g. Combining Tiff and OCR to generate concept searching etc).

They are very open to discussing their techniques for deduping and near deduping. Teams that have used it have praised how quick it is to learn and easy to use. It certainly is easy to demonstrate to people. We have found it has helped on our Lotus Notes issues and the back-end database structure is very easy to understand, as it is structured very well. We have used the system a lot, and its very quick when set up correctly over even a slow internet connection. It’s going to save an awful lot of people and awful lot of time!

Martin.

Lotus Notes Search Date Range

Lotus Notes has a great indexing tool, that can even index attachments. When you need to perform a quick search, you can, and the results are very accurate. However, when it comes to searching for e-mail between sent or received between certain dates.

The Notes interface provides a ‘Date’ button to construct a date search. however, this provides the ability to search for only documents created or modified between certain dates. The created and modified dates of a notes email is similar in effect to searching using file modified and created dates. The dates can be changed by many processes, including a user simply changing a draft email, or by backup or archive tools that move the email or document around. Therefore this cannot be a reliable way to search for a date range.

The correct method to use would be to utilise the ‘Field’ button, to select the standard Notes fields that relate to ’sent’ or ‘received’ dates. There are more than one or two of these fields.

the correct fields to use will depend on the way your Dominio and Notes are configured. Typically though, the relevant fields are PostedDate (similar to Sent Date), deliveredDate (similar to received date) and ForwardedDate. This, combined with created and modified dates, should allow a search that catches all of those emails relevant to your date range. Let me know if you have any questions!

Martin. Martin.Nikel@gmail.com

Lotus Notes Links

Does anyone have any information on the way in which Lotus Notes links to external references? We believe that the URLs in “DockLinks” are generated automatically and can change according to the movement of the email from, say, one NSF to another. Thats why in two NSF files, you may have exactly the same email, but the “DocLink” reference is created dynamically for each email, so differs between each email. Any information anyone has on this point, or anyone who wants to correct this opinion, please do send me an e-mail.

Thanks,

Martin.