From corporate fraud investigations to civil divorce proceedings the examination of data from computer systems has become a routine part of the evidence gathering process. As the storage space available on computer systems has increased, and the requirement to maintain data in backup archives has been forced by regulatory pressure, the sheer volume of data to be processed has increased geometrically.

In short, the size of the haystack within which the needle is hidden is increasing by a massive amount each year. The question is can we afford to increase the time and costs of the investigation of computer data?

If you have

• Backup tapes to process as part of a forensic investigation
• Email data to be examined and organised for legal purposes
• Hard disks to be secured and imaged
• Computer media of unknown contents to be checked

The advice of computer forensics specialists should be sought before proceeding further.

To deal with large volumes of data as stored across an entire tape backup archive requires the application of thought and technology. Tapes can be scanned to eliminate large numbers from detailed examination, data can be de-duplicated to avoid the restoration of data that has already been restored, and tapes can be processed in parallel so that for even massive archives the process can be dealt within a reasonable time.

The art of successful computer forensic and data processing is in the planning, brain-first not head-first, planning the processing to match precisely what is required and eliminating that which is not.