|“Regarding virtual machines specifically, there are many possibilities for inadvertent or malicious destruction of electronically-stored information (ESI).”
Jason Briody, How Virtualization Affects EDD Collection
Today’s WhatIs.com Word of the Day is spoliation. It’s legaleze for “destroying evidence.” Jason Briody’s written an EXCELLENT post about how virtualization has mucked the e-discovery waters. He says:
Virtualization can affect your case in three main ways:
1. Increase costs and collections: Virtualization means the end of the “one computer per box” generation. If you get a rough estimate of an electronically stored information collection by merely counting the physical computers or servers, virtualization can throw your estimates way off. It is now commonplace for multiple computers to run on the same hardware that used to be reserved for one.
2. Cause you to overlook evidence: If certain forms of virtualization have been implemented, and an examiner is not made aware of it, they might miss crucial evidence. When searching a user’s hard drive, for instance, certain files contained within encapsulated virtual machines may not respond to keyword searches. The virtual machine files may have to be “opened” prior to the search to ensure accurate results.
3. Increase the risk of collection issues and/or spoliation: Virtualization involves separating computers and data storage from its physical hardware. This new technology brings with it new features that may increase the possibility of losing or destroying ESI. Examples include the ability to:
- “roll back” a computer to a previous “snapshot” and inadvertently lose newer data;
- move computers and data from one piece of physical hardware to another and accidentally misplace or compromise data; and
- delete entire machines with a single click and completely erase data.