And Did I Mention It Was FREE? - FTK Imager 3.0
I'm incessantly flogging the notion that lawyers need to get back in touch with the evidence. By that I mean, lawyers need ways to get a jump on the cost, delay and anxiety that characterizes e-discovery circa 2010 and secure quick, non-destructive access to the electronic evidence that will drive the direction and outcome of the dispute. This is what that awful marketing buzz phrase "early case assessment" would mean, if it meant anything at all.
If lawyers could just take a quick look at some of the relevant stuff that key players hold; you know, sit down with correspondence and documents like we did in the old days--browse, as it were--then lawyers could start asking the right questions from the start. And asking the right questions is a trial lawyer's most important contribution.
So, when a tool surfaces that helps lawyers get back in touch with the evidence, I look at it. When it's free and fairly easy to use, I jump up and down waving my arms madly for all to see. I'm in that latter mode for the latest release of AccessData's FTK Imager Ver. 3.0, available here.
I've long been a huge fan of FTK Imager as it's a free, flexible and effective forensic imaging tool that includes a handy hex viewer and supports file extraction and hash digest list generation. Plus, it's free. But now, at no charge, the program includes pretty robust image mounting capabilities. That means that anyone without special forensic tools and for no dinero can now access the common forensic image formats as easily as if the imaged drive were your own hard disk. Best of all, the process is read only, so you can't accidentally mess up the evidence--no, not even the marvelous, malleable metadata. Hey, did I mention that FTK Imager 3.0 is free?
The advantage offered by a tool that can mount forensic images is that it gives lawyers an immediate window into the evidence. Imaging for preservation tends to be done promptly (at least when parties are on top of their obligations). But, once the data is encapsulated in a forensic image format, it's no picnic to find ways to let lawyers gain access. Until now, lawyers had to go through someone like me for data extraction or drive restoration or purchase pricey, complicated tools they wouldn't be comfortable using.
Now, aided by an easy-to-use, no cost tool, lawyers can point at a copy of a forensic image and see the evidence drive mounted as an local hard drive on their own machine. The active data on the evidence drive is right there to be explored. Okay, a horrible notion in, say, a child pornography case, but for most civil matters, an effective, fast and affordable way to get the lawyers going on the merits--not as a substitute for a sound e-discovery methodology but as a powerful, insightful adjunct.
Kudos and salutations to AccessData for adding more utility to an already splendid tool. Gratitude and admiration for giving it away.