Dates in any legal case are always important, hence the most common question asked by any a solicitor or lawyer, in relation to a document is:
“When was the document created?”
This question, while simple and entirely reasonable, is fraught with difficulties.
Does the solicitor mean date the document was “first created”, when it was created on the “current computer”, or when it came to be “created” in its current state.
Below are some examples that demonstrate the problem.
1. User A creates a document on a file server on 1st Feb 2003. The file is copied to a desktop of User B on 2nd March 2004. Initially examination of User B’s desktop.
a. Which is the “created date” of the document 1/2/03 or 2/3/04?
2. User A creates a document on a file server on 1st Feb 200, then emails it to User B on 8th September 2008. User B reads the email, via Outlook, on 9th September 2008. User B then saves the document onto his desktop, on 10th September 2008.
a. Which is the “created date” of the document? 1/2/03, 8/9/09, 9/9/09, or 10/9/9?
3. User A creates a blank sales order form, to be used as a template, on 1/1/09; User B fills in the details of the form and “creates” a sales order on 1/2/09.
a. When was the created date for sales order form? 1/1/09 or 1/2/09
There is no right answer, given the limited question. The answer will depends on the needs of each question. Therefore it is the job of the technical advisor/consultant to ask their client, what they are trying to achieve.
If a solicitor/lawyer asked for the created date of the document in example (3), the correct answer for any service provider, or technical consultant, would be:
“What are you trying to show from this date?”
If the solicitor/lawyer replied:
“The case hinges on how the sales order templates were created. Its believed the template changed at a certain date, and we need to know what the date is”
Then the consultant would know to seek out the date the original form was created. It may be that this date is not available, but it is critical that the computer forensics consultant or technical advisor does not provide the right date, for the wrong question.
Given the huge number of dates for any given document, created, modified, access, last written, last saved, first created, emailed, first opened, last opened, last printed, it is critical that any computer forensics, or electronic discovery professional know the dates they are looking for, and what they are providing to the client
This can only be achieved by asking for questions of the client.