Windows Vista: A Forensics Examiner's Dream Come True

A report by the American Bar Association notes that from a litigator's perspective, Windows Vista makes it easy to uncover what's been performed on a particular PC. Quite simply, forensic evidence maintained by Vista makes it easier to find out what was done and when it was done.

What am I talking about?

Shadow copy is a new feature built into Vista that backs up all of your data and stores it on unused sectors of the hard drive. It was designed to prevent data loss but because the information it stores stays on there, it's easier for a forensic examiner to find deleted data.

Transactional NTFS, another new feature in Vista, keeps much more detailed user records. The records it keeps allow attorneys to construct more accurate time lines of events.

The new Search feature in Vista indexes almost everything the user has worked on.

"It's google desktop on steroids. It's an indexed database of more evidence stored right there on a computer," says John Simek, the co-founder of legal technology and computer forensics firm Sensei Enterprises. "Right now you can say information was accessed on a certain day, but that might not prove anything," he said.

Simek also believes that you can peer into Vista and see when something was accessed by going back through several months of data.

"From a defense perspective, it scares me to death. One of the things I have a hard time educating my clients on is the volume of data that's now discoverable," says R. Lee Barrett, associate attorney with Forshey & Prostok.

For tips on managing shadow copy, more information is available at zdnet.com.

Visit Bill's Links and More for more great tips, just like this one!