There is good news, eDiscoverySquad and the Library of Congress has some free and easy to use tools to help you in the process.

The post Free tools to Help Stressed Paralegals (used by the Library of Congress)! appeared first on eDiscoverySquad Litigation Support Services.

This is a free utility to take an inventory of drives attached to a PC running Windows.   It can be run from a removable drive, and will make a file name based on the name of the PC, and list out all the drives and related information about them.

This can be used to inventory all of the windows PC’s during a collection to make sure all drives have been copied.

It currently written in C# requires Microsoft .NET to be installed on the PC.   We are working on a c++ version that will not require this.   The next version will also have an option to invoke robocopy and generate a file listing and/or copy the drive to current drive.

Contact us at support@ediscoverysquad.com to register for updates.

For more about robocopy see our http://ediscoverysquad.com/how-to

Here is an example of the output of this program.

You can get a copy of the program here:

http://ediscoverysquad.com/files/DiskFinder.zip

This programe is being run from: C:UsersJeffDesktopDiskFinder (2)DiskFinderbinDebug

Computer Name: JEFF-PC
Number of Drives: 6
Drive – C:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Boot Drive
File System Type : NTFS
Free Space: 30021926912
Total Drive Size: 240055742464

Drive – D:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Application Data
File System Type : NTFS
Free Space: 42462507008
Total Drive Size: 240054693888

Drive – E:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Output Processing
File System Type : NTFS
Free Space: 75996823552
Total Drive Size: 480101003264

Drive – F:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Temporary File Storage
File System Type : NTFS
Free Space: 50895007744
Total Drive Size: 500104687616

Drive – G:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Output Processing Drive 2
File System Type : NTFS
Free Space: 144843849728
Total Drive Size: 480101003264

Drive – H:
Drive Type: CDRom
Drive Ready Status: True
Volume Label: F9L1002v1
File System Type : UDF
Free Space: 0
Total Drive Size: 57573376

Here is the source code for the program:

/*

* copyright (c) 2012, 2013, eDiscoverySquad, LLC.
* All Rights Reserved
*
* Date created: December 23rd, 2012
*
* DiskFinder.cs
*
* Author(s): Paul Aquino, Jeffrey Goodwin
*
*
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
* License as published by the Free Software Foundation; either
* version 2 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Library General Public License for more details.
*
*
* Notwithstanding the foregoing, you must:
*
* a) register to use this software by sending an email to: support@ediscoverysquad.com, and include the site description of where the software will be used
*
* b) Maintain eDiscoverySquad, LLC copyright notice and credit for the user of the program
*
* In order to use the program, you need to download Microsoft .NET 3.5 or later. Note, that we are working on a version of this program which does not require Microsoft .NET.
* Please contact us if you need this version.
*
*/

using System;
using System.IO;
/*
<summary>
A console program that is intended to run from an external drive which is attached to a PC. The program will record system information including the following:
* The computer name
* The number of drives in the system
* The file system type for each drive
* The properties of each drive, e.g., size, number of files, and space allocation
*
</summary>
*/
public class DiskFinder
{

/* <summary>
* The programs’ central point of control.
* There are no input arguments.
* </summary>
*/

public static void Main(string[] args)
{
/*
* Get computer drives info. This builds an array that contains the total number of drives, and characterizes the type of file system on each drive.
*
*/

DriveInfo[] mySystemDrives = DriveInfo.GetDrives();

/*
* Write the Drive Information to the output file
*/

WriteDrives(mySystemDrives);

} /* end of program */
/* <summary>

* WriteDrive method writes local drives information to the text file.

* Input Parameter: <param name=”my_driv”> Array of type DriveInfo that represents the logical drives on a computer.</param>

* Return Value: None

* </summary>

*/

public static void WriteDrives(DriveInfo[] my_driv)
{

/*
* Define output file name listing to be concatenated to computer name for the purpose of output file naming convention
*/
string OutputFileListingSuffix = ” DriveListing.txt”;

/*
* Define Text Labels to be used for entries written to the information file listing
*/

string DriveIDLabel = “Drive – “;
string FileSystemTypeLabel = “File System Type : “;
string ComputerNameLabel = “Computer Name: “;
string NumberofDrivesLabel = “Number of Drives: “;
string DriveTypeLabel = “Drive Type: “;
string VolumeLabel = “Volume Label: “;
string FreeSpaceLabel = “Free Space: “;
string TotalDriveSizeLabel = “Total Drive Size: “;
string CurrentDriveLabel = “This programe is being run from: “;
string IsReadyLabel = “Drive Ready Status: “;

/*
* Set up and open target text file. Replace pathName in StreamWriter(“pathName”) to your target text file.
*/
System.IO.StreamWriter targetFile = new System.IO.StreamWriter(Environment.MachineName + OutputFileListingSuffix);
/*
* Write current drive and directory to output file
*/

targetFile.WriteLine(CurrentDriveLabel + Environment.CurrentDirectory);

/*
* Writing local computer name and number of local drives.
*/
targetFile.WriteLine(ComputerNameLabel + Environment.MachineName);

targetFile.WriteLine(NumberofDrivesLabel + my_driv.Length);
/*
* put an extra line between each drive information listing
*/

targetFile.WriteLine(“n”);

/*
* Traverses each drive in the drives array and writes drive name and format to results.txt.
*/

foreach (DriveInfo d in my_driv)
{
try
{
/*
* Write the Drive Name
*/

targetFile.WriteLine(DriveIDLabel + d.Name);

/*
* Write the Drive Type, e.g. Fixed, DVD, etc.
*/

targetFile.WriteLine(DriveTypeLabel + d.DriveType);

/*
* Is Ready Status
*/

targetFile.WriteLine(IsReadyLabel + d.IsReady);

/*
* Write the Volume Label
*/

targetFile.WriteLine(VolumeLabel + d.VolumeLabel);
/*
* Write the File System Type, e.g. NTFS, FAT, UDF (DVD drive)
*/

targetFile.WriteLine(FileSystemTypeLabel + d.DriveFormat);
/*
* Write the drive space information
*/

targetFile.WriteLine(FreeSpaceLabel + d.TotalFreeSpace);

targetFile.WriteLine(TotalDriveSizeLabel + d.TotalSize);
/*
* put an extra line between each drive information listing
*/

targetFile.WriteLine(“n”);
}
catch {
targetFile.WriteLine(“exception encountered”);
}
} /* end for */

/*
* close the file handle
*/

targetFile.Close();

} /* end of WriteDrives() */
} /* end of DiskFinder class */

The post Free Utility to get an Inventory of Drives attached to a PC, includes source code appeared first on eDiscoverySquad Litigation Support Services.

In working with customer engagements across the nation for small and medium sized cases, we have noticed that clients when performing their own self collections often use the standard windows file copy instead of using a more forensically sound method with Robust File Copy (robocopy.exe), that comes free with Windows 7 and was developed by Microsoft employees.

Note that SafeCopy from PinPoint Labs uses the robocopy engine to preserve directory and file name time stamps, and metadata (author, modification date, security and auditing attributes), and improve performance with the multi-threading option, which says something for the tool given that SafeCopy was recently ordered for use in a case by a federal Magistrate.

eForensic Collection (with logging)

This section explains a free self help utility that can help keep a proper chain of custody when clients choose to do a self collection by keeping forensically sound log files.

robocopy.exe /? – shows the help and all available options.  with GUI (similar in features to robocopy, but not based on it)

Quick Tutorial video on YouTube

Simply cut and paste from below into a command prompt window (cmd.exe) which comes with Windows 7.

The example below copies all of the files from the <d drive>, including recursive sub directories, and will list the results into the current director in filecopy.txt.   To enhance performance, the command below kicks off 128 simultaneous copying threads.  The /TEE option shows the output to the console in addition to the logging performed.

robocopy e: . /COPY:DATD /E /V /TS /FP /BYTES  /ETA   /R:1000000 /W:30 /LOG:filecopy.txt /MT:128 /TEE

Take Inventory of Directories

This is helpful for documenting workstations/custodians that belong to data backed up or on a file server.  The output can easily be put into a spreadsheet for making comments and assigning the custodian who was in charge of a particular source of data.

The options below takes a listing from the <d drive> and omit file names being listed, and provide a concise summary of the most important directory (5 levels deep which can be changed).   Output is put into the current directory in directorylist.txt.

robocopy d: . * /NFL /L /S /E /COPY:DAT /LEV:5 /R:1000000 /W:30 /LOG:directorylist.txt

Making an Incremental Backup

As a bonus, you can also use robocopy.exe to create incremental supplementation using the /MAXAGE parameter.

The post Free tool with Windows for Robust File Copy Performance and generating forensic logs appeared first on eDiscoverySquad Litigation Support Services.

http://www.digitalpreservation.gov/news/2010/20100924news_article_pedals_email_tool.html

I tested it and was pleased by how it performed.  My testing was performed on Microsoft .PST files.  PEDALS parses through the .PST files, and enumerates each .MSG (email), and extracts the associated attachments.   The email body and metadata are stored in an XML file.

To make this useful for litigation review platforms you need to convert the XML to a .CSV file, and store the Email body as extracted text (e.g., a .txt or rich text file).   At this point you could cull the data with a Desktop version of dtSearch, or you can then convert all of the extracted text and attachments to the target media (e.g., searchable postscript based PDF’s with optimized compression for web based download) and load them into the target Litigation Review software you plan to use.

Of course this process would be easier with some accompanying utilities to make those conversions automatically, and generate the target load file.

Fear not, eDiscoverySquad will be working on making this process easier in the future so be sure to watch our Blog for future updates.

The post Free Email eDiscovery/Archiving data extractor used by Library of Congress appeared first on eDiscoverySquad Litigation Support Services.