ÿWPC(, –Éä_cK’Áõ7ÄÖUü2!g¿zõ¿š;Ô›WîƒmµØ³²Eõs™Ÿ¿×¢%ÚŸ<ÈIÁîøMä„£ý±h娷 õ5”vsôzÔ¥/O| ™þ&§Ÿ´/ÇÕ Eʥѧš¼fb•÷{wµd“êrñ™UGû¥2BMñí<_Zi>öQÄÒþ}/HÚ?‰P„d 3ÁÁz ÚwÅB]‰8€ºt¤8î‡ê;ÑÖôú@“ìér©kì€fn¯›½\åÏÊæ¢h…7ÔíÜ{¡a§"(¹$h¯1°E>º1´¢ìqe?~|¯’ ðX¥ybrò®áè]ô לÊc>{Ô§>ïЀÚgh ¨ËhØëiæ¸"½/ÛóS~^E­nóäMÂ,ªtzàLû†$‘íÇh*ú>5+2bqC*dØU7Än½¦ †€ÐôñrÛ3¿0Ü0ýëN0+Æ51…UýÍÆÇÈ ÷V…]ní¨õóÂöÞ¯u¥à¼3½XÌ#ý»k±´óŸA‡VÏ5P™Ô»­ì^^æD`…z¾–ÄÏA3ò)=üaÊí©)Ê߬ éÕÞF*u³èlmS­&}ã:}Š׆^{\pÓÇ 0±â m“ jª B° aÍ  á Në 9FOF•Ûñÿ::K…›©»Í(ÛB a"£¹$Õ*ù.#NQNŸí5Kcy‹ ¡«ÁÕ4ëR5‡RïX]XsË(á $C&Y •µ&Ëñ,3$Im$ƒ§T½H'oH…ÍRã5RK$³×0íX3‹(¡É2ß'9JO™$¯Ó*é)UF? J… Ï 1_á @ J ` >j ¨ ² Ä Î Ø î  ,  B Fb $¨ &Ì ò   (, .T 2‚ R´  " , J f p † ” 8¬ Vä \: ,– ( *ê  ! $ ! *D! 0n! (ž! Æ! XÜ! 4" L@" Œ" V˜" (î" 4# \J# ,¦# 6Ò# $ N$ (l$ .”$ Â$EÜ$ Þ$ ì$ ú$ % %<$% `% n% |% Š% ˜% ¨% ¸% È%Ø%#!ð&UN( %_(Ne( hg(xÏ( DKG) B>’) B1Ð) B-* B-.* 0‹N[* 1o©* B>+ 04V+ D+Š+U>µ+^ ó+wÿ+4,,&,(‰Qð$¡¡ÓK€À(€X°KÓÔ€ÁXpXXXÔÔ€ÁXpXXXpÔÿ€€ÿÿÿÿÀ dTABLE AN_1_http://www.fedjudge.org/pub/981001.wpdt.Table ofRules Applicable to Computer-BasedRules Applicable to Computer-Based981001.HTMRule34Rule 106Computer Software Design andComputer Software Design and981001.HTMSourceCommentsSymbolicObjectSoftware ProductionSpecificationImplementation, Or Coding, PhaseInitial TestingRevision ControlProductionTesting PhaseMaintenance PhaseComputer Programs inWhat Might Exist to BeDesign and Specification DocumentationDesign and Specification DocumentationSource Code981001.HTMHeader Files981001.HTMObject code981001.HTMFirmware981001.HTMMake981001.HTMLibraries981001.HTMDevelopment Documentation981001.HTMUnique Characteristics of Computer-Based981001.HTMUnique Characteristics of Computer-Based981001.HTMRedundant Copies of Computer-Based Evidence981001.HTMRedundant Copies of Computer-Based Evidence981001.HTMGlobal Distribution981001.HTMDeliberate Backup981001.HTMInadvertent Backup981001.HTMOff-site Backup981001.HTMSource Code Escrow981001.HTMSource Code Licensees981001.HTMBackup Copies Are981001.HTMBackup Copies Are981001.HTMComputer-Based Evidence Must Be Preserved981001.HTMThe Vast Quantity of Computer-Based981001.HTMThe Vast Quantity of Computer-Based981001.HTMThe Disorganized State of Computer-Based981001.HTMThe Disorganized State of Computer-Based981001.HTMDrafting Document981001.HTMEmbodiment of Documents981001.HTMInformation Necessary to Access Information981001.HTMEnsuring a Complete981001.HTMDrafting Interrogatories981001.HTMSoftware981001.HTMMethods Used for Document Production981001.HTMIdentification of981001.HTMAnalysis of Computer981001.HTMConclusion;  9Z+‹.Courier New Regular Rules Applicable to Computer-Based þRule34#‡û37;?CGKOS°°N_2_,Rule 106N_3_ Computer Software Design andN_5_ þSourceN_6_N_7_,Comments,SymbolicÐcObject Software Production,Specification Implementation, Or Coding, Phase,Initial Testing Revision Control Production Testing Phase Maintenance Phase Computer Programs in What Might Exist to Be Design and Specification Documentation Source CodeN_8_ Header Files Object codeN_9_ FirmwareÐcMake Libraries Development Documentation Unique Characteristics of Computer-Based Redundant Copies of Computer-Based Evidence Global Distribution Deliberate Backup Inadvertent BackupN_10_ Off-site Backup Source Code Escrow Source Code Licensees Backup Copies Are,Magnetic Computer-Based Evidence Must Be PreservedN_12_ The Vast Quantity of Computer-BasedN_13_ The Disorganized State of Computer-Based,Drafting Document Embodiment of Documents Information Necessary to Access Information,Ensuring a Complete Drafting Interrogatories ,Software Methods Used for Document Production ,Identification of Analysis of Computer ,Conclusion ,N_1_ ,N_2_ ,N_3_ ,N_4_ ,N_5_Http://www.jli.com/papers.htm ,N_6_ ,N_7_ ,N_8_ ,N_9_ ,N_10_ ,N_11_ ,N_12_ ,N_13_HDiscovery Of Computer Software .Andy Johnson-Laird¢<meta<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">˜Epson Stylus COLOR (Copy 2)0(  Z‹6Times New Roman Regular²X¶˜c:\COREL\SUITE8\TEMPLATE\CUSTOM~2\WEB\WP8WEB.WPTc:\Corel\Suite8\Template\Custom WP Templates\Web\wp8web.wpt¸¹¸¹?web3dbord1_0dxd:web3dtlo1_  ÀÀÀd ÿÿÿd-web3dbro1_ €€€d)web3dtli  €€€d)web3dbri ÿÿÿd(›$——ÔÿÔòòÔÿÔóó#zµ37=CIOU[a­­1.1.1.1.1.1.1.1.:web3dhrz160 €€€d ÿÿÿd(†·$ÍÍò òò òó óó ó'ÈÈÈÈdxd(  Z‹&Times New Roman$%x$áO{H$`"„3|xÝ ƒQð!ÝÓK€À(€XKÓÔ€ÁX XX²XÔÔ€ÁX XXÁX ÔÝ  ÝÔ_ÔÐ ÜÜ ÐÓ  Óâ âÐ ÉÉ ÐÔ*ƒ  dd Xdd Xdd XxxÔÔ,FL ÔÔ,F2 ÔÔ+  ÔÐ  ÜÜ „„Ðò òòòDiscovery€in€ComputerÐ  ÐSoftwareóóó óÐ || Ðò òòòPatent€Litigationóóó óÐ ÝÝ ÐAndy€Johnson-LairdÐ ÐForensic€Software€AnalystÐ ÐJohnson-Laird€Inc.Ð ÐPortland,€ORÐ Ð850€NW€Summit€AvenueÐ ÐPortland€OR€97210Ð ÐTel.:€(503)€274-0784Ð ÐFAX:€(503)€274-0512Ð Ðandy@jli.comÐ Ðhttp://www.jli.com/Ð Ðò òAbstractó óÐ €€ ÐÔÌÌÌÔ[a.1]€ÔÌÌÌÝÔOne€of€the€more€frustrating€aspects€ofÏcomputer€software€patent€litigation€is€thatÏdiscovery€productions€are€usually€demonstrablyÏincomplete,€and€the€information€that€òòisóóÐ 77 Ðproduced€is€produced€in€a€maximallyÏinconvenient€form.€These€frustrations€flowÏfrom€a€series€of€assumptions€--€falseÏassumptions,€as€this€article€explains.€The€falseÏassumptions€are€as€follows:Ð Ða)€òòSource€code,óó€the€human-readable€form€ofÐ ÅÅ Ðsoftware,€appears€to€the€untrained€eye€as€text.ÏTherefore,€some€assume€that€a€printed€listingÏof€source€code€is€an€appropriate€response€to€aÏdocument€production€request.Ð Ðb)€òòSource€codeóó€exists€as€a€series€ofÐ ff Ðself-contained€text€files€(or€so€it€is€assumed)Ïand€therefore,€some€assume€that€if€òòallóó€of€theseÐ @@ Ðtext€files€are€printed€out,€the€entirety€of€theÏsource€code€will€be€produced.Ð Ðc)€òòObject€codeóó,€the€computer-readable€form€ofÐ !!" Ðsoftware,€if€printed€out,€is€assumed€toÏconstitute€a€legitimate€production€to€theÏrequesting€party.Ð ÐAll€three€assumptions€are€false.€The€falseÏassumptions€lead€to€incomplete€discoveryÏproductions.Ð ÐÔÌÌÌÔ[a.2]€ÔÌÌÌ×ÔThe€analysis€of€source€code€on€paper€isÏfar€more€costly€in€time€and€money€than€is€theÏanalysis€of€that€same€material€on€computerÏmedia.òòÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(1)Ô6Œ ÔÝ‚¼›  ƒÝÔÿÔóóÝ  ÝÔ7Ý Î Ôóó€Simple€searching€of€thousands€ofÐ I*I*, Ðlines€of€source€code€on€paper€may€take€hours,Ïin€contrast€to€a€few€seconds€were€that€sourceÏcode€on€computer€media.€Printed€listings€ofÏsource€code€are€usually€incomplete,€although€itÏmay€take€several€days€or€weeks€of€analysis€toÏdetect€that.Ð ÐÔÌÌÌÔ[a.3]€ÔÌÌÌl ÔSource€code€printed€on€paper€lacksÏâ âimportant€forensic€information€contained€inÔ ÿÿ ÔÏthat€same€source€code€on€computer€media.ÏPrinted€object€code€is€essentially€useless€when€compared€with€that€same€object€code€on€computer€media.Ð  ÐŽÔÌÌÌÔ[a.4]€ŽÔÌÌÌ› ÔThe€absolute€truth€about€a€computer€program's€behavior€resides€in€one€place€and€one€place€alone:€the€computer€program€as€it€executes€on€a€computer.€The€next€nearest€representation€of€the€absolute€truth€is€a€static€copy€of€that€program's€object€code€on€computer€media,€followed,€in€order€of€increasing€distance€from€the€absolute€truth,€by€the€computer€source€code€on€computer€media€and€the€computer€source€code€on€paper.€Object€code€on€paper€is€almost€worthless€except€for€the€analysis€of€very€small€pieces€of€the€program.Ð  ÐŽÔÌÌÌÔ[a.5]€ŽÔÌÌÌáÔProducing€parties€who€avoid€these€false€assumptions€and€produce€relevant€computer€software€on€diskettes€or€magnetic€tape€usually€presume€that€it€will€be€possible€to€divine€how€this€computer€media€can€be€accessed€to€reload€the€information€it€contains.€That€presumption€is€usually€false.€To€access€the€information,€one€needs€to€know€very€specific€information€about€the€hardware€and€software€used€to€write€the€relevant€software€onto€the€computer€media.Ð  ÐŽÔ4‚Ý ÔÝ‚¼ÝÝ  ÝÔ5  ÔDownload€this€article€as€a€Wordperfect€documentŽÔ6ßÔÝ‚¼óƒÝÝ  ÝÔ7Ý ÔÔ  ÔÐ (±1±14 „„(ÐÔ% ‡ ÔÔ%†¿ÔTable€of€ContentsÐ ÐÔ4‚ Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô1€RULES€APPLICABLE€TOÔ6ýÔÝ‚¼›ƒÝÔÿÔóóÝ  ÝÔ7Ý 1?ÔÐ 6 ÐÔ4‚ Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔCOMPUTER-BASED€EVIDENCEÔ6ÍÔÝ‚¼›áƒÝÔÿÔóóÝ  ÝÔ7Ý ÔÐ õõ7 ÐÔ4‚ Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔRule€34Ô6žÔÝ‚¼›²ƒÝÔÿÔóóÝ  ÝÔ7Ý làÔÐ ââ8 ÐÔ4‚ Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔRule€106Ô6_ÔÝ‚¼›sƒÝÔÿÔóóÝ  ÝÔ7Ý Ð¡ÔÐ ÏÏ9 ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô2€COMPUTER€SOFTWAREÔ6 ÔÝ‚¼›4ƒÝÔÿÔóóÝ  ÝÔ7Ý SbÔÐ ˜˜: ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔDESIGN€AND€PRODUCTIONÔ6îÔÝ‚¼›ƒÝÔÿÔóóÝ  ÝÔ7Ý Ó0ÔÐ ……; ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔSource€CodeÔ6½ÔÝ‚¼›ÑƒÝÔÿÔóóÝ  ÝÔ7Ý üÿÔÐ rr< ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔCommentsÔ6‚ÔÝ‚¼›–ƒÝÔÿÔóóÝ  ÝÔ7Ý ]ÄÔÐ _ _ = ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔSymbolic€ConstantsÔ6DÔÝ‚¼›XƒÝÔÿÔóóÝ  ÝÔ7Ý ;†ÔÐ L L > ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔObject€CodeÔ6ÔÝ‚¼›$ƒÝÔÿÔóóÝ  ÝÔ7Ý èRÔÐ 9 9 ? ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔSoftware€Production€PhasesÔ6ÕÔÝ‚¼›éƒÝÔÿÔóóÝ  ÝÔ7Ý ¿ÔÐ & & @ ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔSpecification€PhaseÔ6©ÔÝ‚¼›½ƒÝÔÿÔóóÝ  ÝÔ7Ý $ëÔÐ   A ÐÔ4‚Ý öÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔImplementation,€or€Coding,€PhaseÔ6vÔÝ‚¼›ŠƒÝÔÿÔóóÝ  ÝÔ7Ý °¸ÔÐ B ÐÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔInitial€TestingÔ6PÔÝ‚¼›dƒÝÔÿÔóóÝ  ÝÔ7Ý ’ÔÐ ííC ÐÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔRevision€ControlÔ6ÔÝ‚¼›-ƒÝÔÿÔóóÝ  ÝÔ7Ý [ÔÐ ÚÚD ÐÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔProduction€DocumentationÔ6ãÔÝ‚¼›÷ƒÝÔÿÔóóÝ  ÝÔ7Ý %ÔÐ ÇÇE ÐÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔTesting€PhaseÔ6µÔÝ‚¼›ÉƒÝÔÿÔóóÝ  ÝÔ7Ý ÷ÔÐ ´´F ÐÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔMaintenance€PhaseÔ6|ÔÝ‚¼›ƒÝÔÿÔóóÝ  ÝÔ7Ý ¾ÔÐ ¡¡G ÐÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔComputer€Programs€in€FirmwareÔ6G ÔÝ‚¼›[ ƒÝÔÿÔóóÝ  ÝÔ7Ý ‰ ÔÐ ŽŽH ÐÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô3€WHAT€MIGHT€EXIST€TO€BEÐ WWI ÐDISCOVERED?Ô6!ÔÝ‚¼›1!ƒÝÔÿÔóóÝ  ÝÔ7Ý _!ÔÐ DDJ ÐÔ4‚Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔDesign€and€SpecificationÔ6"ÔÝ‚¼›#"ƒÝÔÿÔóóÝ  ÝÔ7Ý Q"ÔÐ 11K ÐÔ4‚ Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔDocumentationÔ6â"ÔÝ‚¼›ö"ƒÝÔÿÔóóÝ  ÝÔ7Ý $#ÔÐ L ÐÔ4‚!Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔSource€Code€DocumentationÔ6©#ÔÝ‚¼›½#ƒÝÔÿÔóóÝ  ÝÔ7Ý ë#ÔÐ   M ÐÔ4‚"#Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔHeader€FilesÔ6|$ÔÝ‚¼›$ƒÝÔÿÔóóÝ  ÝÔ7Ý ¾$ÔÐ øøN ÐÔ4‚$%Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔObject€CodeÔ6B%ÔÝ‚¼›V%ƒÝÔÿÔóóÝ  ÝÔ7Ý „%ÔÐ ååO ÐÔ4‚&'Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔFirmwareÔ6&ÔÝ‚¼›&ƒÝÔÿÔóóÝ  ÝÔ7Ý I&ÔÐ ÒÒP ÐÔ4‚()Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô"Make"€FilesÔ6É&ÔÝ‚¼›Ý&ƒÝÔÿÔóóÝ  ÝÔ7Ý  'ÔÐ ¿¿Q ÐÔ4‚*+Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔLibrariesÔ6'ÔÝ‚¼›£'ƒÝÔÿÔóóÝ  ÝÔ7Ý Ñ'ÔÐ ¬¬R ÐÔ4‚,-Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔDevelopment€DocumentationÔ6R(ÔÝ‚¼›f(ƒÝÔÿÔóóÝ  ÝÔ7Ý ”(ÔÐ ™™S ÐÔ4‚./Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô4€UNIQUE€CHARACTERISTICSÔ6$)ÔÝ‚¼›8)ƒÝÔÿÔóóÝ  ÝÔ7Ý f)ÔÐ b b T ÐÔ4‚01Ý ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔOF€COMPUTER-BASED€EVIDENCEÔ6÷)ÔÝ‚¼› *ams€ÝÔÿÔóóÝ  ÝÔ7rogr9*ÔÐ O!O!U ÐÔ4‚23rogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô5€REDUNDANT€COPIES€OFÔ6Ê*ÔÝ‚¼›Þ*ams€ÝÔÿÔóóÝ  ÝÔ7rogr +ÔÐ ##V ÐÔ4‚45rogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔCOMPUTER-BASED€EVIDENCEÔ6š+ÔÝ‚¼›®+ams€ÝÔÿÔóóÝ  ÝÔ7rogrÜ+ÔÐ $$W ÐÔ4‚67rogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔGlobal€Distribution€of€DocumentsÔ6k,ÔÝ‚¼›,ams€ÝÔÿÔóóÝ  ÝÔ7rogr­,ÔÐ ò$ò$X ÐÔ4‚89rogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔDeliberate€Backup€CopiesÔ6E-ÔÝ‚¼›Y-ams€ÝÔÿÔóóÝ  ÝÔ7rogr‡-ÔÐ ß%ß%Y ÐÔ4‚:;rogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔInadvertent€Backup€CopiesÔ6.ÔÝ‚¼›+.ams€ÝÔÿÔóóÝ  ÝÔ7rogrY.ÔÐ Ì&Ì&Z ÐÔ4‚<=rogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔOff-site€Backup€CopiesÔ6ê.ÔÝ‚¼›þ.ams€ÝÔÿÔóóÝ  ÝÔ7rogr,/ÔÐ ¹'¹'[ ÐÔ4‚>?rogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔSource€Code€EscrowÔ6º/ÔÝ‚¼›Î/ams€ÝÔÿÔóóÝ  ÝÔ7rogrü/ÔÐ ¦(¦(\ ÐÔ4‚@ArogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔSource€Code€LicenseesÔ6†0ÔÝ‚¼›š0ams€ÝÔÿÔóóÝ  ÝÔ7rogrÈ0ÔÐ “)“)] ÐÔ4‚BCrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô6€BACKUP€COPIES€ARE€INCOMPLETEÔ6T1ÔÝ‚¼›h1ams€ÝÔÿÔóóÝ  ÝÔ7rogr–1ÔÐ \+\+^ ÐÔ4‚DErogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔMagnetic€TapesÔ6,2ÔÝ‚¼›@2ams€ÝÔÿÔóóÝ  ÝÔ7rogrn2ÔÐ I,I,_ ÐÔ4‚FGrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔPreserve€Evidence€ImmediatelyÔ6ô2ÔÝ‚¼›3ams€ÝÔÿÔóóÝ  ÝÔ7rogr63ÔÐ 6-6-` ÐÔ4‚HIrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô7€THE€VAST€QUANTITY€OFÔ6Ê3ÔÝ‚¼›Þ3ams€ÝÔÿÔóóÝ  ÝÔ7rogr 4ÔÐ ÿ.ÿ.a ÐÔ4‚JKrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔCOMPUTER-BASED€EVIDENCEÔ6›4ÔÝ‚¼›¯4ams€ÝÔÿÔóóÝ  ÝÔ7rogrÝ4ÔÐ ì/ì/b ÐÔ4‚LMrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô8€THE€DISORGANIZED€STATEÔ6k5ÔÝ‚¼›5ams€ÝÔÿÔóóÝ  ÝÔ7rogr­5ÔÔ4‚NOrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔOFÔ ÿÿ ÔÏCOMPUTER-BASED€EVIDENCEŽÔ6(6ÔÝ‚¼›<6ams€ÝÔÿÔóóÝ  ÝÔ7rogrj6ÔÐ Â+Â+e ÐŽÔ4‚PQrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô9€DRAFTING€DOCUMENT€REQUESTSŽÔ6 7ÔÝ‚¼›7ams€ÝÔÿÔóóÝ  ÝÔ7rogrM7ÔÐ ¯,¯,f ÐŽÔ4‚RSrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔEmbodiment€of€Documents€ProducedŽÔ6å7ÔÝ‚¼›ù7ams€ÝÔÿÔóóÝ  ÝÔ7rogr'8ÔÐ œ-œ-g ÐŽÔ4‚TUrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔInformation€Necessary€to€Access€InformationÐ ‰.‰.h ÐProducedŽÔ6Ã8ÔÝ‚¼›×8ams€ÝÔÿÔóóÝ  ÝÔ7rogr9ÔÐ v/v/i ÐŽÔ4‚VWrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔEnsuring€a€Complete€ProductionŽÔ6É9ÔÝ‚¼›Ý9ams€ÝÔÿÔóóÝ  ÝÔ7rogr :ÔÐ c0c0j ÐŽÔ4‚XYrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô10€DRAFTING€INTERROGATORIESŽÔ6¤:ÔÝ‚¼›¸:ams€ÝÔÿÔóóÝ  ÝÔ7rogræ:ÔÐ P1P1k ÐŽÔ4‚Z[rogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔSoftware€AuthorshipŽÔ6};ÔÝ‚¼›‘;ams€ÝÔÿÔóóÝ  ÝÔ7rogr¿;ÔŽÔ4‚\]Ý ÔÝ‚¼ÝÝ  ÝÔ5  ÔMethods€Used€for€Document€ProductionŽÔ68<ÔÝ‚¼L<ƒÝÝ  ÝÔ7Ý g<ÔÐ  ÐŽÔ4‚^_Ý ÔÝ‚¼ÝÝ  ÝÔ5  ÔIdentification€of€VersionsŽÔ6ë<ÔÝ‚¼ÿ<ƒÝÝ  ÝÔ7Ý =ÔÌŽÔ4‚`aÝ ÔÝ‚¼ÝÝ  ÝÔ5  Ô11€ANALYSIS€OF€COMPUTER€SOFTWAREŽÔ6ˆ=ÔÝ‚¼œ=ƒÝÝ  ÝÔ7Ý ·=ÔÌŽÔ4‚bcÝ ÔÝ‚¼ÝÝ  ÝÔ5  Ô12€CONCLUSIONŽÔ6+>ÔÝ‚¼?>ƒÝÝ  ÝÔ7Ý Z>ÔÔ  ÔÐ)µ1µ1c ?  )ÐÓ  ÓÔ‡dX pXXÁX ÔòòPortions€of€this€paper€were€first€published€in€the€August€1994€issue€of€The€Computer€Lawyer€in€the€article,Ð ÜÜ ÐòòSmoking€Guns€and€Spinning€Disks.€Theóó€author€gratefully€acknowledges€the€assistance€of€G.€Gervaise€Davis€IIIÐ ^^ ÐEsq.€with€the€legal€topics€addressed€in€this€paper.óóÔ#†ÁX XXdX pö>#ԀРàà ÐÔ% ‡e ÔÔ%†e@ԀРÐò ò1.€Rules€Applicable€to€Computer-Based€Evidenceó ó€Ð –– ÐÔ% ‡f ÔÔ%†fAԀРÐò òRule€34€of€Federal€Rules€of€Civil€Procedure€-€Production€of€Documents.ó ó€Ð ss ÐÔÌÌÌÔ[1.1]€ÔÌÌÌ•AÔFed.€R.€Civ.€Pro.€34(a)€states:ÌÓC€ g ‡û# CÓ(a)€ò òScopeó ó.€Any€party€may€serve€on€any€other€party€a€request€(1)€to€produce€and€permit€the€partyÐ , ,  Ðmaking€the€request,€or€someone€acting€on€his€behalf,€to€inspect€and€copy,€any€designatedÏdocuments€(including€writings,€drawings,€graphs,€charts,€photographs,€phono-records,€and€otherÏdata€compilations€from€which€information€can€be€obtained,€translated,€if€necessary,€by€theÏrespondent€through€detection€devices€into€reasonably€usable€form),€or€to€inspect€and€copy,€test,Ïor€sample€any€tangible€things€which€constitute€or€contain€matters€within€the€scope€of€Rule€26(b)Ïand€which€are€in€the€possession,€custody€or€control€of€the€party€upon€whom€the€request€is€served;Ïor€(2)€to€permit€entry€upon€designated€land€or€other€property€in€the€possession€or€control€of€theÏparty€upon€whom€the€request€is€served€for€the€purpose€of€inspection€and€measuring,€surveying,Ïphotographing,€testing,€or€sampling€the€property€or€any€designated€object€or€operation€thereon,Ïwithin€the€scope€of€Rule€26(b).ÔÌÌÌÔ[1.2]€ÔÌÌÌFÔWriting€inòò€Federal€Practice€and€Procedureóó,€Wright€andÐ qq ÐMiller€take€the€first€step€in€applying€Rule€34(a)€to€computerized€information:ÌÓC€ g ‡û##gCÓOne€seemingly€small€but€actually€quite€important€change€made€in€the€1970€amendments€of€RuleÏ34€brings€the€federal€rules,€in€some€ways€for€the€first€time,€into€the€computer€age.€The€originalÏrule€had€spoken€only€of€documents€and€tangible€things.€Today€much€information€of€importanceÏin€litigation€is€no€longer€on€documents€stored€in€files€but€is€on€punched€data€cards,€electronicÏdisks€or€tapes,€or€otherwise€stored€in€a€computer.€Plainly€this€information€must€be€subject€toÏdiscovery€and€the€1970€amendment€clearly€provides€for€this.òòÔ4‚hÝ ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(2)Ô68IÔÝ‚¼›LIams€ÝÔÿÔóóÝ  ÝÔ7rogrzIÔóóÔÌÌÌÔ[1.3]€ÔÌÌÌáIÔWright€and€Miller€reasonÐ ÈÈ Ðthat€Rule€34(a)'s€reference€to€"other€data€compilations€from€which€information€can€be€obtained,Ïtranslated,€if€necessary,€by€the€respondent€through€detection€devices€into€reasonably€usableÏform,"€makes€it€clear€that€the€requesting€party€is€entitled€to€have€the€computerized€data€presentedÏin€a€form€such€as€a€hard€copy€printout.€However,€in€computer€software€patent€litigation,€thatÏwould€be€inadvisable,€since€a€printout€often€lacks€significant€additional€information€onlyÏavailable€by€forensic€examination€of€the€computer-based€version€of€the€document.ÌÔ% ‡i ÔÔ%†idLԀРÐò òRule€106€of€Federal€Rules€of€Evidence€-€Related€Writingsó ó€Ð  " "! ÐÔÌÌÌÔ[1.4]€ÔÌÌÌçLÔFed.€R.€Evid.€106€states:ÌÓC€ g ‡û##gCÓWhen€a€writing€or€recorded€statement€or€part€thereof€is€introduced€by€a€party,€an€adverse€partyÏmay€require€him€at€that€time€to€introduce€any€other€part€of€any€other€writing€or€recordedÏstatement€which€ought€in€fairness€to€be€considered€contemporaneously€with€it.ÔÌÌÌÔ[1.5]€ÔÌÌÌvNÔWright€andÏMiller€comment:ÌÓC€ g ‡û##gCÓComputerized€materials€present€difficulties€of€analysis.€The€use€of€a€document€prepared€by€aÏcomputer€involves€a€writing€and€should€be€treated€in€the€same€fashion€as€other€documents€underÏthe€Rule.€The€problem€arises€where€a€party€asserts€that€the€data€stored€within€the€computerÏconstitutes€the€"writing"€and€the€print-out€is€an€incomplete€part.€Or€the€opponent€may€assert€thatÏthe€print-out€requires€the€use€of€the€program€to€be€correctly€understood.€This€Rule€offers€noÏguidance€on€such€questions.Ì.€.€.Ìâ âThe€proper€treatment€of€photographs€and€motion€pictures€under€Rule€106€is€equally€obscure.Ð ˆ1ˆ1. Ð.€.€.Ìâ âBut€the€fact€that€Article€X€of€the€Rules,€unlike€the€state€codifications,€treats€motion€pictures€andÏphotographs€as€a€distinct€category,€rather€than€a€species€of€"writing,"€might€lead€to€an€inferenceÏthat€writing€is€to€be€given€the€same€restricted€meaning€for€purposes€of€Rule€106.Ì.€.€.ÌSince€a€picture€is€worth€a€thousand€words,€to€a€liar€as€well€as€to€an€honest€man,€there€wouldÏseem€to€be€an€even€greater€danger€of€misleading€photographs€than€of€documents€taken€out€ofÏcontext.€It€is€possible€to€crop€photographs€and€edit€motion€pictures€to€alter€theirÏsignificance.òòÔ4‚jrogrÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(3)Ô6ÀSÔÝ‚¼›ÔSÔÝÔÿÔóóÝ  ÝÔ7ê?TÔóóÔÌÌÌÔ[1.6]€ÔÌÌÌiTÔTo€some€extent€these€dangers€can€be€avoided€by€manipulation€of€the€"bestÐ Ø Ø  Ðevidence"€rule,€but€even€though€photographs€are€"writings"€for€purposes€of€that€rule,€there€areÏmany€uses€of€photos€to€which€the€"best€evidence"€rule€does€not€apply.€It€can€also€be€argued€thatÏthe€same€policy€reasons€that€justify€treating€photographs€as€"writings"€for€purposes€of€the€"bestÏevidence"€rule€are€applicable€to€the€same€issue€in€connection€with€the€completeness€doctrine.ÏMoreover,€photographs€and€motion€pictures€do€not€raise€the€administrative€problems€thought€toÏjustify€excluding€conversations€from€Rule€106.(4)ÌÔÌÌÌÔ[1.7]€ÔÌÌÌWÔWith€the€arrival€of€audio-visual€computing,€often€referred€to€as€"multimedia,"€even€smallÏpersonal€computers€can€store€textual€documents,€digitized€photographs,€motion€pictures€andÏhigh-fidelity€sound.€This€digitized€information€can€be€manipulated€easily€and€in€a€way€that,€inÏthe€future,€will€doubtless€cause€much€consternation€to€attorneys€and€judges€alike€as€they€struggleÏwith€the€application€of€Rules€34€and€106€to€computer-based€information.€When€digitizedÏinformation€is€involved,€there€is€actually€no€one€original€document.€There€are€few€technicalÏmeans€to€determine€the€authenticity€of€a€given€document,€or€to€detect€whether€someone€hasÏtampered€with€a€digitized€photograph,€video€recording,€or€audio€recording.ÌÔ% ‡k ÔÔ%†kþYԀРÐò ò2€Computer€Software€Design€and€Productionó ó€Ð `` ÐÔÌÌÌÔ[2.1]€ÔÌÌÌqZÔAttorneys€who€have€a€good€mental€model€of€the€nature€of€computer€software,€what€it€is,Ïand€how€it€is€produced,€are€far€more€effective€in€motivating€an€opposing€party's€counsel€toÏproduce€the€relevant€software€in€a€form€in€which€it€can€be€analyzed€cost€effectively.€Therefore,€itÏis€appropriate€to€begin€a€discussion€about€the€discovery€of€computer€software€with€anÏintroductory€overview€of€how€we€design€and€produce€software.€This€overview€helps€to€answerÏthe€question:€What€information€exists€that€òòcanóó€be€discovered?€What€follows€is,€of€necessity,€aÐ ñ ñ  Ðbrief€introduction€to€the€world€of€computer€software€design€and€production.òòÔ4‚lê?ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(5)Ô6+]ÔÝ‚¼›?]ÔÝÔÿÔóóÝ  ÝÔ7ê?m]Ôóó€Ð Þ!Þ! ÐÔ% ‡m ÔÔ%†më]ԀРÐò òSource€Codeó ó€Ð ¸#¸#! ÐÔÌÌÌÔ[2.2]€ÔÌÌÌ@^ÔTo€visualize€computer€source€code€requires€little€more€than€a€simple€thought€experimentÏwhich€one€has€to€commit€to€writing.€The€essential€problem€is€to€translate€a€real-world€act€into€aÏsimple€series€of€steps€and€then€write€those€steps€down€in€the€proper€order.ÌÔÌÌÌÔ[2.3]€ÔÌÌÌq_ÔAs€an€example,€imagine€sending€an€email€message€or€a€letter€to€a€child€telling€him€or€herÏhow€to€calculate€a€15%€tip€on€a€restaurant€bill.€The€age€of€the€child€will€determine€the€level€ofÏabstraction€at€which€one€must€write€the€instructions.€A€younger€child€will€require€more€detailedÏinstructions,€perhaps€at€the€level€of€specifying€which€buttons€to€press;€for€an€older€child€a€simpleÏinstruction€of€"enter€the€total"€will€suffice.€We€can€tell€an€even€older€child€merely€to€"multiplyÏ0.15€times€total,€and€add€the€result€to€the€total."ÌÔÌÌÌÔ[2.4]€ÔÌÌ̵aÔNow€imagine€a€more€complicated€set€of€calculations:€calculating€a€consultant's€billingÏbased€upon€hours€worked€(converting€to€decimal€hours),€client-specific€billing€rates€and€so€on.ÏAt€some€point€the€complexity€and€scope€of€the€problem€to€be€solved€exceed€one's€ability€to€holdÏthe€entire€problem€in€one's€head,€and€it€becomes€easier€to€create€a€written€òòspecificationóó€of€theÐ |1|1. Ðproblem€to€be€solved.€Real-world€programming€has€many€of€the€characteristics€described€above.Ð i2i2/ ÐTypically€a€written€specification€will€describe€the€problem€to€be€solved€and€its€solution€at€a€highÏlevel€of€abstraction;€the€programmer€then€will€translate€this€into€a€more€detailed€level€ofÏabstraction€as€he€or€she€writes€the€human€readable€form€of€the€code,€the€òòsource€codeóó.€ThisÐ ¶¶ Ðsource€code€is€then€òòcompiledóó€using€a€òòcompileróó€to€translate€the€source€code€into€òòobject€codeóó€toÐ ££ Ðform€an€òòexecutable€programóó€that€can€be€run€on€the€computer.Ð  ÐÔÌÌÌÔ[2.5]€ÔÌÌÌôeÔSource€code€can€be€written€in€a€so-called€high-level€language€such€as€"C."€òòÔ4‚nê?ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(6)Ô6mfÔÝ‚¼›fÔÝÔÿÔóóÝ  ÝÔ7ê?¯fÔóó€Ð YY ÐÔÌÌÌÔ[2.6]€ÔÌÌÌ,gÔC€is€one€of€the€more€popular€computer€programming€languages.€C€has€the€advantage,€toÏprogrammers€at€least,€of€shielding€the€programmer€from€having€to€understand€the€technicalÏaspects€of€the€computer€system€upon€which€the€final€program€will€run.€The€C€language€does€thisÏby€creating€a€world€in€which€the€programmer€can€operate€in€ignorance€of€the€technical€details.ÏThe€secret€is€in€the€translation€program,€the€compiler,€which€generates€the€correct€code€for€theÏcomputer.ÌÔÌÌÌÔ[2.7]€ÔÌÌÌ/iÔFor€the€previous€restaurant€example,€the€program€would€need€to€declare€a€òòvariableóó€(aÐ ŒŒ  Ðworking€storage€location€akin€to€a€note€pad€upon€which€temporary€results€are€jotted)€for€the€bill'sÏtotal.€The€next€step€would€be€to€set€the€contents€of€this€variable€to€its€initial€value€of€zero€(a€stepÏcalled€initializing€the€variable).ÌÔÌÌÌÔ[2.8]€ÔÌÌ̸jÔIn€C,€this€might€appear€as:€òòÔ4‚oê?ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(7)Ô6kÔÝ‚¼›kÔÝÔÿÔóóÝ  ÝÔ7ê?DkÔóó€Ð  Ðfloat€bill_total;Ð Ðbill_total€=€0.0;Ð ÐThis€fragment€of€C€source€code€illustrates€several€aspects€of€program€source€code.€The€wordÏ"float"€indicates€to€the€C€compiler€that€it€should€set€aside€an€area€of€memory€that€will€contain€aÏòòfloating€point€number.€óóA€floating€point€number€is€expressed€in€the€form€123.456€x€10òònóó,€where€"n"Ð ½½ Ðis€chosen€to€represent€the€number€with€appropriate€accuracy,€ranging€from€very€small€numbers€toÏvery€large€numbers.€One€important€point€to€note€is€that€the€programmer€can,€like€a€brattish€child,Ïsimply€state€"I€want€that!"€and€let€the€C€compiler€take€care€of€the€details.€A€secondary€point€isÏthat€"float€bill_total;"€does€not€cause€any€òòexecutableóó€instructions€to€be€created€in€the€resultingÐ qq Ðprogram€--€it€merely€requests€that€the€compiler€set€aside€some€memory€for€storing€this€value€andÏassociates€the€name€"bill_total"€with€this€location€in€memory.ÌÔÌÌÌÔ[2.9]€ÔÌÌÌ‚oÔThe€name€"bill_total"€is€created€from€whole€cloth.€If€the€programmer€complies€with€theÏgrammatical€rules€of€the€C€language€(which€are€specified€in€excruciating€detail€in€referenceÏbooks),€the€programmer€can€call€this€variable€òòanythingóó€he€or€she€wants,€ranging€from€"x,"Ð î î  Ð"Wayne_Newton,"€to€"This_Is_Where_I_Want_To_Put_The_Bill_Total."€The€underscore€is€usedÏto€comply€with€C's€grammar,€which€states€that€òòsymbolic€variable€namesóó€such€as€these€will€beÐ È"È"  Ðterminated€by€a€space€character€(among€other€things).€The€underscore€therefore€serves€to€breakÏup€a€long€name€without€terminating€it.€Programmers€learn€(the€hard€way)€that€meaningful€namesÏthat€òòhintóó€at€the€purpose€of€the€data€stored€therein€are€much€better€than€those€that€either€give€noÐ %%# Ðinformation€or€tend€to€mislead.€Programmers€usually€abbreviate€symbolic€variable€names€andÏthere€are€different€styles€of€òònaming€conventionsóó:€"bt,"€"total,"€"tot_bill,"€"sum,"€"tot_no_tip"Ð i'i'% Ðwould€all€be€valid€names.€These€naming€conventions€are€part€of€an€individual€programmer'sÏòòcoding€style.óó€Ð C)C)' ÐÔÌÌÌÔ[2.10]€ÔÌÌÌ6tÔThe€semicolon€shows€the€C€compiler€that€the€programmer€has€made€a€completeÏutterance,€similar€to€the€use€of€the€period€in€English.€The€period€cannot€be€used€in€C€for€thisÏpurpose,€because€it€represents€the€decimal€point.ÌÔÌÌÌÔ[2.11]€ÔÌÌÌ?uÔThe€second€line,€"bill_total€=€0.0";€òòassignsóó€a€value€of€0.0€to€the€area€in€memory€(assignedÐ ¯.¯.+ Ðby€the€compiler)€to€correspond€to€"bill_total."€To€mathematicians€this€is€a€curious€use€of€theÏequal€sign;€in€contrast€to€mathematical€notation,€this€is€not€an€assertion€that€"bill_total"€òòisóó€equalÐ ‰0‰0- Ðto€0.0.€Instead,€it€states€that€"bill_total"€òòwill€become€equal€toóó€0.0.€In€the€mind€of€the€programmer,Ð v1v1. Ðthe€value€on€the€right€of€the€equal€sign€is€copied€into€the€symbolic€variable€name€on€the€left.Ð c2c2/ ÐÔ% ‡p ÔÔ%†p´wԀРÐò òCommentsó ó€Ð ÉÉ ÐÔÌÌÌÔ[2.12]€ÔÌÌÌxÔAn€important€part€of€source€code,€though€not€used€by€the€computer€itself,€is€the€òòcommentsóóÐ ¹¹ Ðadded€by€the€programmer.€These€are€textual€annotations€intermixed€with€the€actual€programmingÏstatements€that€are€discarded€during€the€òòcompilationóó€of€C€code€into€object€code.Ð ““ ÐÔÌÌÌÔ[2.13]€ÔÌÌÌoyÔIn€C,€comments€are€delineated€by€two€special€character€sequences,€/*€and€*/,€which€serveÏas€parentheses.€For€example,€here€are€the€previous€two€lines€of€code€with€comments€added:Ì/*ÌThis€is€an€example€of€a€coment.Ð ÐBlock€comments€typically€precede€the€code€they€describeÐ Ðand€consist€of€several€contiguous€lines€of€comments€like€this.Ð Ð*/Ð Ðfloat€bill_total;€/*€Declare€variable€for€the€total€*/Ð Ðbill_total€=€0.0;€/*€Initialized€variable€to€zero€*/ÌÔÌÌÌÔ[2.14]€ÔÌÌ̘{ÔNote€the€deliberate€spelling€error€of€the€word€"coment."€It€is€not€at€all€unusual€to€seeÏspelling€errors€in€source€code.€In€comments€they€do€not€matter,€and€in€the€active€source€code,Ïproviding€the€programmer€is€consistent,€they€have€no€effect.€These€spelling€errors,€and€the€actualÏwriting€style€that€programmers€use€in€comments,€can€give€good€clues€to€authorship.€Even€theÏstyle€of€òòblock€commentsóó€at€the€top€of€the€example€above€gives€stylistic€hints.€The€physicalÐ ùù Ðformatting€of€the€comment€lines,€their€indentations,€and€their€spacing€may€provide€clues€toÏsoftware€authorship.ÌÔ% ‡q ÔÔ%†q"~ԀРÐò òSymbolic€Constantsó ó€Ð ‰‰ ÐÔÌÌÌÔ[2.15]€ÔÌÌÌ~~ÔIn€most€of€the€examples€of€source€code€thus€far,€when€a€numeric€value€has€been€requiredÏit€has€been€written€in€the€actual€code.€This€is€a€very€bad€practice.€It€is€much€harder€to€maintainÏprograms€because€the€same€number€may€be€scattered€throughout€a€larger€program,€but€not€all€ofÏthe€instances€where€it€occurs€might€have€the€same€meaning.€Any€attempt€to€change€this€numberÏwill€almost€certainly€create€a€bug€of€major€proportions.ÌÔÌÌÌÔ[2.16]€ÔÌÌÌY€ÔTherefore,€most€programming€languages€support€the€use€of€òòsymbolicóó€òòconstantsóó.€ForÐ öö Ðexample,€in€C,€one€could€write:Ì#define€MAX_ITEMS€20€/*€The€maximum€number€of€items€*/Ì:Ìfloat€item[MAX_ITEMS];€/*€Declare€array€of€floating€point€numbers€*/Ì:Ìwhile€(count€<€MAX_ITEMS)Ìð8ð€and€so€onð8ðÌÔÌÌÌÔ[2.17]€ÔÌÌÌÃÔThe€C€compiler€automatically€substitutes€the€value€20€from€the€"#define"€line€in€allÏinstances€where€"MAX_ITEMS"€appears.€This€means€that€only€a€single€line€of€code€(theÏ"#define"€line)€need€be€changed€to€alter€the€total€number€of€items.ÌÔ% ‡r ÔÔ%†r݂ԀРÐò òObject€Codeó ó€Ð ò1ò1( ÐÔÌÌÌÔ[2.18]€ÔÌÌÌ2ƒÔObject€code€is€the€product€of€compiling€source€code€and€linking€it€with€other€object€codeÏto€form€an€òòexecutable€binaryóó€version€of€the€program.€Object€code€is€lacking€much€of€theÐ ÉÉ Ðinformation€in€the€original€source€code:Ìa)€All€of€the€comments€have€been€removed€during€the€compilation€process.Ìb)€All€of€the€symbolic€variable€names€and€symbolic€constants€have€been€replaced€by€memoryÏlocations€(as€numbers)€and€the€constant€values.€The€one€exception€is€symbolic€names€of€certainÏparts€of€the€computer€program.€The€linker€(the€program€that€links€the€object€code)€needs€these€asÏit€connects€discrete€chunks€of€object€code€together€to€form€the€finished€program.Ìc)€The€symbolic€names€are€normally€removed€from€òòproduction€object€codeóó€sent€out€into€theÐ Ø Ø  Ðmarket.There€is€almost€no€information€of€high-level€abstraction€in€the€resulting€executableÏbinaries.€That€factor€becomes€very€relevant€when€considering€the€topic€of€òòreverse€engineeringóóÐ ² ²  Ðsoftware€(studying€the€object€code€to€learn€how€it€works).€The€only€immediately€comprehensibleÏinformation€in€the€object€code€is€the€òòembedded€character€stringsóó€that€are€created€when€theÐ ŒŒ  Ðprogrammer€needs€to€reference€an€error€message€or€to€display€information€on€the€screen.ÌÔÌÌÌÔ[2.19]€ÔÌÌÌ|ˆÔOne€can€see€these€embedded€fragments€of€text€if€one€examines€object€code€using€specificÏprogramming€utility€programs.€These€embedded€fragments€of€text€have€a€certain€forensic€value:Ïfor€example,€they€can€be€used€to€relate€certain€object€code€back€to€the€source€code€from€which€itÏmay€have€been€compiled.€However,€unless€the€embedded€fragments€contain€unusually€bizarreÏtext,€this€is€a€rather€approximate€method€that€can€be€misleading.€It€is€akin€to€recognizing€peopleÏby€the€shadow€they€cast.ÌÔ% ‡s ÔÔ%†s•ŠÔ€Ð Ðò òSoftware€Production€Phasesó ó€Ð ™™ ÐÔÌÌÌÔ[2.20]€ÔÌÌÌùŠÔDiscovery€of€computer€software€is€greatly€aided€if€one€understands€the€phases€in€which€itÏis€produced.€Knowing€òòhowóó€it€is€produced€leads€to€understanding€òòwhatóó€work€product€will€beÐ vv Ðcreated,€and€what€information€and€documentation€may€exist€and€be€discoverable.ÌÔÌÌÌÔ[2.21]€ÔÌÌÌGŒÔThere€are€several€very€discrete€phases€in€the€journey€from€idea€to€retail€shelf.€SomeÏphases€may€be€omitted€depending€upon€the€task,€the€experience€levels€of€the€programmers,€andÏthe€size€(and€budget)€of€the€company€doing€the€work.The€phases€described€below€haveÏsignificant€overlap:€writing€the€source€code€often€starts€before€all€of€the€programs€have€beenÏspecified,€and€testing€starts€before€all€of€the€program's€source€code€has€been€written.€SoftwareÏdevelopment€has€been€described€as€a€process€of€òòstep-wise€refinementóó.Ð Í!Í! ÐÔ% ‡t ÔÔ%†t™ŽÔ€Ð Ðò òSpecification€Phaseó ó€Ð ƒ$ƒ$  ÐÔÌÌÌÔ[2.22]€ÔÌÌÌöŽÔThe€initial€stage€is€to€create€documents€describing€the€intended€product.€Various€types€ofÏspecifications€can€be€produced€consistent€with€the€practices€used€by€each€development€company.ÏUsually€each€successive€specification€is€more€detailed€in€the€level€of€technical€detail€it€includes.ÏSpecifications€include:ÌÓC€ g ‡û##gCÓa)€Marketing€Requirements:€The€perceived€requirements€of€the€marketplace€as€to€the€particularÏfeatures€a€new€product€should€have€to€be€desirable€to€users,€particular€performance€requirementsÏsuch€as€speed€and€upon€what€computers€it€should€run,€and€so€on.Ìb)€Design€Requirements:€The€specific€design€requirements€for€the€program€at€a€more€detailedÏlevel.€For€example,€it€might€describe€that€the€product€must€be€written€in€C,€using€particularÏsupporting€third-party€object€code€libraries.€These€would€not€be€matters€of€concern€to€theÏmarketing€of€the€program.Ìc)€Functional€Specification:€A€description€of€what€a€program€or€group€of€programs€must€do.€AtÐ 6262, Ðthis€level,€overall€functionality€is€apportioned€to€specific€programs€with€a€description€of€howÏthese€programs€will€inter€operate€and€exchange€information.Ìd)€Detailed€Design:€A€more€detailed€description€of€the€input€information,€processing,€and€outputÏinformation€that€will€be€produced€by€each€program€in€the€system.€This€level€of€specification€isÏintended€to€guide€the€programmer€who€will€create€the€source€code.€This€level€therefore€usuallyÏincludes€descriptions€of€data€structures,€the€major€functionality€within€each€program,€algorithmsÏto€be€used€to€compute€results,€and€other€detailed€programming€notes.€Where€necessary,Ïalgorithms€will€be€described€using€logic€flow€diagrams€(that€show€the€decisions€and€processingÏto€be€performed€depending€on€the€outcomes€of€those€decisions)€or€pseudo-code€(source€codeÏwritten€in€part€English€and€part€programming€language€so€that€the€underlying€algorithm€is€visibleÏto€the€programmer€even€though,€as€source€code,€it€is€not€grammatically€correct).Ìe)€Test€Plan:€Describes€how€the€program(s)€will€be€tested€before€being€made€available€on€theÏmarket.€Often€this€involves€both€general€testing€strategies€and€specific€òòscriptsóó€that€will€guideÐ ° °  Ðsomeone€through€the€specific€interaction€with€the€program.€Testing€is€a€particularly€thorny€issue,Ïyet€test€plans€are€quite€rare€in€the€software€industry.€Testing€can€never€confirm€an€absence€ofÏerrors;€testing€can€only€reveal€the€presence€of€errors.Ô% ‡u ÔÔ%†uî˜Ô€Ð Ðò òImplementation,€Or€Coding,€Phaseó ó€Ð dd ÐÔÌÌÌÔ[2.23]€ÔÌÌÌX™ÔThis€is€the€phase€where€programmers€systematically€convert€the€detailed€designÏspecifications€into€working€programs.€A€modern€approach€often€used€by€smaller€softwareÏdevelopment€companies€where,€for€time€and€cost€reasons,€the€detailed€design€specification€mayÏnot€be€produced,€is€to€perform€òòrapid€application€developmentóó€(RAD).€In€RAD,€workingÐ  Ðprototypes€of€programs€are€created€to€serve€as€the€specification.€Prototypes€have€an€advantage€inÏexposing€users€to€real,€but€minimally€functional,€programs€early,€and€in€providing€reaction€to€theÏdesign€and€functionality€early€enough€to€affect€the€design€of€the€finished€product.ÌÔ% ‡v ÔÔ%†vœÔ€Ð Ðò òInitial€Testingó ó€Ð ˜˜ ÐÔÌÌÌÔ[2.24]€ÔÌÌÌiœÔThe€coding€phases€consist€of€creating€the€human€readable€source€code,€converting€it€intoÏobject€code,€and€linking€object€code€modules€to€form€executable€programs€to€be€tested€usingÏspecimen€data€files.€This€testing€of€individual€programs€is€often€called€òòunit€testingóó.Ð bb ÐÔÌÌÌÔ[2.25]€ÔÌÌÌ»ÔAny€mistakes€found€in€testing€must€be€investigated€(sometimes,€just€getting€the€mistakeÏto€happen€again€is€the€hardest€part).€Once€the€programmer€understands€what€went€wrong,€theÏsource€code€must€be€changed€and€the€modified€program€must€be€re-tested€to€ensure€that€theÏchange€corrects€the€original€problem€but€does€not€introduce€any€additional€errors.ÌÔ% ‡w ÔÔ%†wGŸÔ€Ð Ðò òRevision€Controló ó€Ð ¨$¨$" ÐÔÌÌÌÔ[2.26]€ÔÌÌÌ¡ŸÔSource€code€for€a€given€program€undergoes€many€changes€from€the€very€first€versionÏcreated€to€the€final€version.€More€complex€programs€require€several€programmers€workingÏcollaboratively€on€the€source€code,€and€this€creates€an€additional€problem€of€coordinating€all€ofÏthe€changes€within€the€programming€team.ÌÔÌÌÌÔ[2.27]€ÔÌÌÌ¡ÔSpecialized€òòrevision€control€programsóó€are€used€to€manage€and€coordinate€these€changesÐ (*(*' Ðby€automating€the€job€of€a€source€code€librarian.€Revision€control€programs€record€every€changeÏmade€by€all€programmers€to€all€source€code€files€as€the€source€code€evolves.€The€most€popularÏof€these€are€Microsoft's€SourceSafe,€the€Polytron€Version€Control€System€(€PVCS),€the€UnixÏstandards€Source€Code€Control€System€(SCCS),€and€Revision€Control€System€(€RCS).€RevisionÏcontrol€programs€work€by€creating€òòcumulative€history€filesóó€for€every€source€code€file€under€theirÐ É.É., Ðmanagement.€These€history€files€contain€details€of€every€version€of€every€source€code€file€thatÏhas€ever€existed€from€the€time€the€source€code€was€first€put€under€version€control.ÌÔ% ‡x ÔÔ%†xB¤Ô€Ð l2l2/ Ðò òProduction€Documentationó ó€Ð ÜÜ ÐÔÌÌÌÔ[2.28]€ÔÌÌ̬¤ÔThere€are€two€general€classes€of€documentation€that€are€created€as€part€of€softwareÏproduction:ÌÓC€ g ‡û##gCÓa)€User€documentation€to€tell€users€how€to€install€the€software,€how€to€set€it€up€for€productionÏuse,€and€how€to€use€all€the€features€of€the€software.Ìb)€Maintenance€documentation€to€tell€the€software€developer's€own€personnel€how€the€programÏworks€so€the€developer€can€make€changes€to€the€program.€In€some€cases,€this€documentation€isÏembedded€in€the€source€code€itself€in€the€form€of€comments.ÔÌÌÌÔ[2.29]€ÔÌÌ̧ÔDocumentation€can€also€beÏmanaged€by€revision€control€systems€or€document€management€systems€similar€to€those€used€inÏlaw€firms.ÌÔ% ‡y ÔÔ%†y³§Ô€Ð Ðò òTesting€Phaseó ó€Ð ¢ ¢  ÐÔÌÌÌÔ[2.30]€ÔÌÌÌ ¨ÔAs€more€and€more€of€the€programs€in€a€system€become€ready,€they€can€be€tested€inÏcombination€to€ensure€that€the€output€of€one€program€can€be€accepted€correctly€by€the€next.€TheÏprocess€is€called€òòstring€testingóó€(the€programs€are€"strung€together").€String€testing€usuallyÐ ll Ðrequires€more€complex€test€data€files€and€more€complex€testing€scripts.€String€testing€is€usuallyÏfollowed€by€òòsystem€tests,óó€in€which€all€of€the€programs€in€the€system€are€run€as€though€in€theÐ FF Ðfinished€product.ÌÔÌÌÌÔ[2.31]€ÔÌÌÌKªÔOnce€all€of€the€programs€are€believed€to€be€working,€they€will€be€òòstress€testedóó.€This€is€aÐ üü Ðprocess€whereby€the€system€is€pushed€to€its€limits.€Huge€data€files€are€created€and€manipulated,Ïand€massive€numbers€of€different€operations€are€performed.€The€intent€is€to€flush€out€anyÏmistakes€that€may€be€revealed€only€when€the€programs€have€to€perform€many€operations€on€largeÏamounts€of€data.ÌÔÌÌÌÔ[2.32]€ÔÌÌ̬ÔWhen€programs€are€deemed€to€be€ready,€they€will€be€released€to€a€small€number€ofÏtrusted€clients€for€òòalpha€testingóó.€This€is€the€first€testing€by€actual€users€in€the€marketplace€andÐ ff Ðusually€generates€many€reports€of€problems€that€slipped€through€the€in-house€testing.ÌÔÌÌÌÔ[2.33]€ÔÌÌÌg­ÔOnce€all€relevant€errors€are€corrected,€the€revised€programs€are€released€to€selected€usersÏfor€òòbeta-testingóó,€and€the€cycle€of€testing,€problem€reporting€and€correcting€the€programs€isÐ    Ðrepeated.€Some€organizations€even€resort€to€òògamma-testingóó€to€ensure€more€reliable€software.Ð öö ÐÔ% ‡z ÔÔ%†zܮԀРÐò òMaintenance€Phaseó ó€Ð ¬"¬" ÐÔÌÌÌÔ[2.34]€ÔÌÌÌ7¯ÔThere€are€two€types€of€maintenance:òò€adaptive€maintenanceóó€and€òòcorrective€maintenanceóó.Ð œ#œ# ÐTaken€together€over€the€useful€life€of€the€programs,€adaptive€maintenance€and€correctiveÏmaintenance€may€cost€tens€or€hundreds€of€times€more€than€the€original€development€cost.ÌÔ% ‡{ ÔÔ%†{‰°Ô€Ð Ðò òComputer€Programs€in€Firmwareó ó€Ð ,(,(# ÐÔÌÌÌÔ[2.35]€ÔÌÌÌð°ÔWhen€a€computer€program€is€stored€directly€in€a€computer€chip€so€that€it€remains€thereÏeven€when€the€power€to€the€chip€is€switched€off,€then€it€is€called€òòfirmwareóó€rather€than€software.Ð  * *% ÐÔÌÌÌÔ[2.36]€ÔÌÌÌï±ÔFirmware€exists€in€every€modern€computer.€It€is€used€to€perform€the€initial€self-test€of€theÏcomputer€when€it€is€first€switched€on,€and€it€is€also€responsible€for€loading€the€operating€systemÏòòsoftwareóó€that€will€then€take€overall€supervisory€control€of€the€computer€until€it€is€switched€off.Ð ¬-¬-( ÐFirmware€exists€in€every€device€that€claims€to€be€microcomputer€controlled,€from€wristwatchesÏto€electric€toasters,€microwave€ovens,€cellular€phones€and€automobiles.ÌÔÌÌÌÔ[2.37]€ÔÌÌÌþ³ÔFirmware€differs€from€software€only€in€its€embodiment.€All€of€the€above€narrativeÏregarding€the€production€of€computer€software€also€applies€to€the€production€of€firmware.Ð <2<2, ÐFirmware,€in€the€context€of€litigation,€differs€from€software€only€in€that€its€analysis€is€likely€toÏrequire€extraction€of€the€actual€zeroes€and€ones€from€the€physical€chip€in€which€it€is€contained.ÌÔ% ‡| ÔÔ%†|±µÔ€Ð Ðò ò3€What€Might€Exist€to€Be€Discovered?ó ó€Ð  ÐÔÌÌÌÔ[3.1]€ÔÌÌ̶ÔCreating€a€computer€program€leaves€a€broad€wake€of€evidence€as€the€developmentÏproceeds.€During€discovery,€it€is€important€to€be€aware€of€what€relevant€evidence€might€exist,Ïand€the€form€in€which€each€type€of€evidence€might€be€embodied.ÌÔ% ‡} ÔÔ%†}7·Ô€Ð Ðò òDesign€and€Specification€Documentationó ó€Ð ÿ ÿ  ÐÔÌÌÌÔ[3.2]€ÔÌÌ̧·ÔIt€is€perhaps€true€that€the€larger€the€organization€creating€computer€software,€the€greaterÏthe€amount€of€design€and€specification€documentation€that€will€be€created.€Larger€companies€areÏmore€prone€to€regimentation€and€standardization,€and€this€tends€to€spawn€more€formalÏapproaches.€A€one€person€programming€shop€may€be€a€much€more€òòad€hocóó€affair.€Countering€thisÐ ¶ ¶  Ðthesis€is€the€fact€that€programmer€education€is€improving,€the€need€for€documentation€isÏbecoming€more€widely€known,€and€there€is€greater€pressure€to€produce€it.€There€is,€therefore,€noÏpredictability€as€to€the€amount,€quality,€or€type€of€documentation€that€may€exist€for€a€givenÏproject.ÌÔÌÌÌÔ[3.3]€ÔÌÌÌzºÔMost€formal€design€and€specification€documentation€will€exist€as€some€kind€ofÏcomputer-based€evidence,€and€it€will€usually€exist€in€multiple€versions€in€multiple€places.€It€isÏnot€unusual€to€find€that€what€would,€in€an€earlier€era,€have€been€handwritten€marginaliaÏscribbled€on€specification€documents€has€been€replaced€by€word€processing€documentsÏcontaining€embedded€annotations,€or€even€digitized€audio.ÌÔÌÌÌÔ[3.4]€ÔÌÌÌ<¼ÔThere€is€an€increasing€trend€to€create€graphical€representations€of€computer€software,€beÏthey€computer-based€versions€of€flowcharts€or€more€modern€dataflow€diagrams€or€otherÏrepresentations€of€the€required€program€logic.€All€these€representations€serve€the€same€purpose:Ïtranslation€of€thought€into€the€sequential€steps€to€be€performed€by€a€computer€program.ÌÔ% ‡~ ÔÔ%†~ϽԀРÐò òSource€Code€Documentationó ó€Ð -- ÐÔÌÌÌÔ[3.5]€ÔÌÌÌ2¾ÔUsually€source€code€exists€as€hundreds,€sometimes€thousands,€of€computer€files€containingÏtext.€Certain€programming€regimes,òòÔ4‚aps€ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(8)Ô6ܾÔÝ‚¼›ð¾es€wÝÔÿÔóóÝ  ÝÔ7hang¿Ôóó€such€as€Microsoft's€Visual€Basic,€keep€the€source€code€in€aÐ   Ðquasi-textual€form€in€association€with€other€computer€data€that€prevents€the€source€code€fromÏbeing€read€directly.€Whatever€the€specific€form,€the€most€important€single€fact€about€source€codeÏdiscovery€is€that€a€printed€listing€of€the€source€code€is€demonstrably€a€redacted€version€of€theÏinformation€available€in€the€computer-based€source€code.ÌÔÌÌÌÔ[3.6]€ÔÌÌÌ0ÁÔApart€from€the€redaction€that€occurs€when€source€code€is€printed€out,€a€printed€listing€is€aÏmaximally€inconvenient€form€in€which€to€receive€source€code.€One€of€the€most€frequent€analysesÏof€source€code€is€to€search€for€the€place€where€a€particular€symbolic€variable€is€defined€or€set€toÏsome€value.€A€search€of€a€million€text€lines€of€computer€source€code€will€take€a€few€seconds€ifÏthat€source€code€is€on€a€computer's€hard€disk,€but€it€will€take€several€hours€if€that€source€code€isÏprinted€out.€The€risk€of€error€is€far€higher€with€analysis€of€the€printed€source€code€than€withÏanalysis€of€a€source€code€on€a€computer's€hard€disk.ÌÔÌÌÌÔ[3.7]€ÔÌÌÌÕÃÔThere€are€also€specialized€source€code€analysis€tools€that,€provided€one€has€the€sourceÏcode€on€computer€media,€can€build€òòcalling€treesóó€that€show€how€one€part€of€the€program€invokesÐ Ë-Ë-* Ðanother€part,€which€in€turn€invokes€another.€The€calling€tree€is€like€a€street€map.€Special€textÏediting€programs€can€be€used€to€move€within€the€source€code€rapidly,€following€cross-referencesÏto€other€parts€of€the€program.€None€of€these€tools€are€available€if€all€one€has€is€the€source€codeÏâ âon€paper.Ð 11. ÐÔÌÌÌÔ[3.8]€ÔÌÌÌÆÔFurthermore,€if€the€source€code€has€been€placed€under€the€aegis€of€a€revision€controlÏâ âsystem,€there€is€a€wealth€of€forensic€information€contained€within€the€computer-based€form€ofÏthe€source€code€that€is€almost€entirely€absent€from€the€printed€version.€The€revision€controlÏsystem's€cumulative€history€file€may€reveal€which€programmers€changed€which€lines€of€sourceÏcode,€the€specific€changes,€the€date€and€time€each€change€was€made,€and€additional€annotationsÏabout€why€the€changes€were€made.€Revision€control€software€acts€as€a€time€machine,€windingÏthe€clock€back€so€that€one€can€see€earlier€versions€of€the€computer€software.ÌÔ% ‡€ ÔÔ%†€ÇÈԀРÐò òHeader€Filesó ó€Ð   ÐÔÌÌÌÔ[3.9]€ÔÌÌÌÉÔOne€often€overlooked€aspect€of€source€code€is€the€so-called€òòheaderóó€or€òòcopybookóó€files.€(TheÐ    Ðname€used€varies€according€to€the€programming€language€in€question;€header€file€is€a€term€in€CÏand€C++,€copybook€is€a€term€used€in€COBOL).€These€are€separate€source€code€files€that€containÏdefinitional€material.€Rather€than€being€repeated€in€hundreds€of€different€source€code€files,€theÏdefinitional€information€is€merely€included€during€compilation€from€a€single€file.ÌÔÌÌÌÔ[3.10]€ÔÌÌÌ5ËÔHeader/copybook€files€are€often€stored€in€separate€directories€on€the€computer€system.ÏWhen€source€code€is€gathered€for€production€in€litigation,€header/copybook€files€are€easy€toÏoverlook.€However,€because€of€their€definitional€content,€they€are€vital€to€understanding€aÏprogram.ÌÔÌÌÌÔ[3.11]€ÔÌÌÌzÌÔFor€example,€one€might€find€a€source€code€file€containing€the€lines:Ìif€(status€==€ALLDONE)€exit;ÌÔÌÌÌÔ[3.12]€ÔÌÌÌÍÔAbsent€knowledge€of€the€significance€of€the€symbol€"ALLDONE"€(and€knowledge€thatÏthe€use€of€capital€letters€is€a€convention€to€imply€that€this€is€a€symbolic€constant€definedÏelsewhere),€this€code€is€meaningless.€However,€earlier€in€the€source€code€file,€one€might€find€aÏsource€code€line€that€reads:Ì#include€ÌÔÌÌÌÔ[3.13]€ÔÌÌ̉ÎÔThis€is€an€instruction€to€the€compiler€that,€at€compile€time,€it€is€to€read€in€the€entireÏsource€code€contained€in€file€STATDEFS.H€that€can€be€found€in€the€"includes"€directory€in€theÏ"projectX"€subdirectory.ÌÔÌÌÌÔ[3.14]€ÔÌÌ̆ÏÔOn€examination€of€this€included€file,€STATDEFS.X,€one€might€find€the€source€code€line:Ì#define€ALLDONE€43ÌÔÌÌÌÔ[3.15]€ÔÌÌÌÐÔArmed€with€this€knowledge€one€can€determine€that€the€original€source€code€line,€inÏeffect,€reads,€by€substituting€the€value€of€43€in€place€of€the€symbol€ALLDONE:Ìif€(status€==€43)€exit;ÌIn€this€example,€'STATDEFS.X"€is€a€header/copybook€file.ÌÔ% ‡ ÔÔ%†;ÑԀРÐò òObject€Codeó ó€Ð r,r,# ÐÔÌÌÌÔ[3.16]€ÔÌÌÌÑÔCertain€computer€languages€do€not€result€in€object€code€being€created€for€a€program;Ïthese€òòinterpretedóó€languages€control€a€computer€by€means€of€an€òòinterpreteróó€reading€in€each€line€ofÐ O.O.% Ðthe€computer€program,€and€"executing"€each€line.€In€this€sense,€WordPerfect€"interprets"€theÏembedded€codes€in€a€document,€modifying€the€appearance€of€the€text€in€response€to€theÏ"instructions"€given€by€these€codes.€Microsoft€Word,€and€all€of€the€current€Microsoft€OfficeÏproducts,€are€built€upon€Microsoft's€Visual€Basic€for€Applications.€They€all€"interpret"Ð 22) Ðinstructions€in€the€documents€they€create€and€manage.ÌÔÌÌÌÔ[3.17]€ÔÌÌÌFÔÔDespite€interpretive€languages€such€as€Basic€and€Lisp€(which€is€used€in€association€withÏthe€computer-aided€design€program,€AutoCAD),€compiled€languages€do€require€object€code€withÏwhich€to€control€the€behavior€of€the€computer.òòÔ4‚‚hangÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(9)Ô6XÕÔÝ‚¼›lÕes€wÝÔÿÔóóÝ  ÝÔ7hangšÕÔóó€As€each€source€code€file€is€compiled,€aÐ  Ðcorresponding€object€code€file€is€created.€These€object€code€files€must€then€be€òòlinkedóó€together,Ð ll Ðalong€with€any€previously€compiled€object€code,€to€form€the€complete€executable€form€of€theÏprogram.ÌÔÌÌÌÔ[3.18]€ÔÌÌÌ×ÔDuring€the€process€of€compilation,€all€symbolic€variable€names€and€source€codeÏcomments€are€discarded.€However,€the€names€of€particular€functions€(a€word€used€to€describeÏspecific€òòsubroutinesóó€within€a€program)€often€survive€in€the€object€code€as€a€byproduct€of€theÐ é é  Ðlinking€process€and,€as€such,€can€provide€some€forensic€insights€into€the€origins€of€the€objectÏcode.€By€matching€the€symbolic€names€found€in€the€object€code€back€to€the€symbolic€variableÏnames€declared€in€the€source€code,€it€may€be€possible€to€establish€a€link,€and€thereby€to€establishÏan€association€between€source€code€and€object€code.ÌÔ% ‡ƒ ÔÔ%†ƒÁÙԀРÐò òFirmwareó ó€Ð SS ÐÔÌÌÌÔ[3.19]€ÔÌÌÌÚÔIf€the€object€code€to€prior€versions€of€the€firmware€program€no€longer€exists,€it€may€beÏpossible€to€discover€prior€versions€of€the€firmware€"burned"€into€hardware€chips.€It€is€usual€forÏthese€chips€to€be€kept€by€a€firmware€developer€either€for€technical€support€reasons€(an€earlierÏversion€can€be€tested€to€see€if€it€exhibits€a€reported€problem),€or€because€certain€chips,€onceÏburned,€cannot€be€reused,€and€the€technician€keeps€them€rather€than€discarding€them.€(TheÏpractice€of€òòdumpster€divingóó€--€the€searching€of€dumpsters€outside€offices€--€has€been€known€toÐ ää Ðreveal€developmental€copies€of€a€company's€firmware€in€discarded€chips.)ÌÔ% ‡„ ÔÔ%†„ÖÜԀРÐò ò"Make"€Filesó ó€Ð ‡‡ ÐÔÌÌÌÔ[3.20]€ÔÌÌÌ,ÝÔEven€moderate-sized€programs€can€become€quite€complex€because€of€the€number€ofÏdifferent€source€code€files€that€must€be€compiled€into€object€code.€It€would€be€grossly€inefficientÏand€time-consuming€if€a€single€change€to€one€source€code€file€were€to€require€that€all€sourceÏcode€files€be€recompiled.€Therefore,€it€is€ususal€to€use€another€specialized€program€to€determineÏwhich€source€code€files€must€be€recompiled€and€to€automate€the€entire€process€of€compilationÏand€linking.€Recompilation€can€be€quite€complex€if€an€"include"€file€is€changed€because€allÏsource€code€files€that€contain€this€file€must€be€recompiled.€This€system,€first€popularized€underÏthe€Unix€operating€system,€is€called€"make."€The€files€that€define€the€interdependencies€betweenÏthe€source€code€files,€and€contain€directives€to€control€the€compilation€and€linking,€are€calledÏòòmakefilesóó€(usually€written€as€a€single€word).Ð Ì#Ì#" ÐÔÌÌÌÔ[3.21]€ÔÌÌÌðàÔUnless€a€makefile€is€provided,€it€is€almost€impossible€to€rebuild€a€modern€computerÏprogram's€object€code€from€its€underlying€source€code.€There€is€simply€not€enough€informationÏin€the€source€code€from€which€to€infer€how€the€process€must€be€done.ÌÔ% ‡… ÔÔ%†…âԀРÐò òLibrariesó ó€Ð %*%*' ÐÔÌÌÌÔ[3.22]€ÔÌÌÌfâÔMany€software€developers,€in€the€interests€of€completing€a€working€program€sooner,€willÏpurchase€prefabricated€libraries€to€provide€prefabricated€solutions€for€specific€tasks.€ExamplesÏof€these€include€telecommunications€libraries,€database€management€libraries,€and€digitizedÏimage€manipulation€libraries.€These€libraries€are€licensed€either€as€source€code€files€that€are€toÏbe€compiled€and€linked€with€the€developer's€own€object€code,€or€as€precompiled€libraries€thatÏonly€require€linking.ÌÔÌÌÌÔ[3.23]€ÔÌÌÌ~äÔGiven€the€finished€object€code€for€a€developer's€program,€apart€from€an€embedded€textualÏcopyright€message,€it€may€be€impossible€to€tell€that€one€or€more€components€of€the€program€wasÐ l2l2/ Ðcreated€by€the€inclusion€of€third€party€source€or€object€code.ÌÔ% ‡† ÔÔ%††µåԀРÐò òDevelopment€Documentationó ó€Ð ’’ ÐÔÌÌÌÔ[3.24]€ÔÌÌÌæÔDeveloping€today's€software€is€a€complex,€time-consuming€and€expensive€task.ÏTherefore,€in€all€but€the€smallest€development€companies,€the€software€development€òòprocessóó€hasÐ oo Ðto€be€managed€carefully.€While€separate€from€the€technical€aspects€of€the€actual€softwareÏdevelopment,€documentation€of€the€commercial€aspects€of€software€development€often€includesÏuseful€forensic€information€relating€to€programmers€who€worked€on€the€project€and€the€overallÏschedule€under€which€the€software€was€developed.ÌÔÌÌÌÔ[3.25]€ÔÌÌÌOèÔAssociated€with€the€management€of€the€technical€development€process€is€another€wake€ofÏforensic€evidence€that€will€include€budgetary€estimates,€schedules€showing€milestone€dates,€andÏproject€reporting€information€revealing€development€schedules€and€milestones.ÌÔÌÌÌÔ[3.26]€ÔÌÌÌ€éÔAlthough€the€quantity,€quality€and€nature€of€design€and€specification€material€will€varyÏwildly€from€one€software€developer€to€another,€there€is€usually€òòsomeóó€kind€of€developmentÐ ||  Ðdocumentation.€It€may€range€from€early€prototypical€versions€of€the€source€code,€to€handwrittenÏnotes€in€a€programmer's€notebook,€to€a€series€of€different€versions€of€specification€materials.ÌÔÌÌÌÔ[3.27]€ÔÌÌÌ8ëÔElectronic€mail€is€very€commonly€used€in€the€software€development€industry.ÏProgrammers€have€been€sending€email€messages€to€each€other€since€the€early€1970's,€long€beforeÏthe€Internet€became€known€to€the€public.€It€is€quite€common€for€employees€in€softwareÏdevelopment€companies,€or€in€software€development€groups€of€large€companies,€to€communicateÏextensively€by€email€among€themselves.€It€is€also€quite€common€for€software€developmentÏemployees€to€communicate€by€email€to€the€marketing€and€sales€departments,€and€even€to€endÏusers€of€the€computer€software.ÌÔÌÌÌÔ[3.28]€ÔÌÌÌ“íÔSoftware€development€is€a€demanding€art.€Computers€are€notorious€for€doing€whatÏprogrammers€ask€them€to€do€rather€than€what€programmers€meant€them€to€do.€The€maintenanceÏphase€of€a€computer€program€can€cost€more€than€ten€times€the€original€development€cost,€as€theÏnext€generation€of€programmers€struggles€to€understand€what€was€going€on€the€in€the€minds€ofÏtheir€programming€forebears.ÌÔÌÌÌÔ[3.29]€ÔÌÌÌBïÔTo€combat€these€problems,€and€to€reduce€the€cost€of€developing€and€maintainingÏsoftware,€companies€usually€try€to€impose€some€level€of€uniformity€in€the€thinking€and€writingÏof€their€programmers.€This€uniformity€will€be€documented€as€requirements€for€standardizedÏways€of€designing,€coding€and€testing€software.€That€documentation€can€be€a€useful€source€ofÏunderstanding€of€the€software€itself€and€of€forensic€information€about€the€development€process.ÌÔ% ‡‡ ÔÔ%†‡3ñԀРÐò ò4€Unique€Characteristics€of€Computer-Based€Evidenceó ó€Ð ]&]&" ÐÔÌÌÌÔ[4.1]€ÔÌḬ̀ñÔFrom€an€evidentiary€point€of€view€(and€to€the€delight€of€forensic€software€analysts€such€asÏthis€author),€computer-based€evidence€has€characteristics€that,€if€not€understood€and€anticipated,Ïmay€cause€a€requesting€party€to€fail€to€discover€relevant€evidence€and€a€producing€party€to€fail€toÏpreserve€or€produce€it.€These€characteristics€are:ÌÓC€ g ‡û##gCÓa)€Even€small€companies€and€individuals€usually€keep€a€vast€amount€of€information€onÏcomputers€(or€make€redundant€copies€for€safekeeping).Ìb)€Computer-based€evidence€is€usually€stored€in€a€less€organized€manner€than€is€paper€evidence.Ï(It€does€not€matter€what€sequence€documents€are€stored€in,€for€example,€if€the€computer€onlyÏtakes€three€seconds€to€find€any€one€of€them.)Ìc)€Documents€can€be€easily€stored€on€the€computer€in€a€form€that€makes€it€extremely€tedious€toÐ 6262, Ðsearch€for€particular€documents€before€production.€This€is€especially€true€for€digitized€images,Ïmotion€pictures€and€audio€recordings.Ìd)€Redundant€copies€made€deliberately€for€safekeeping€(called€'backup€copies')€are€rarelyÏmanaged€appropriately€and€end€up€being€scattered€around€an€office€or€at€employees'€homes.Ìe)€Inadvertent€copies€of€documents€are€often€made€during€customary€computer€usage;€these€areÏrarely€managed€appropriately€and€tend€to€propagate€from€one€computer€to€another.Ìf)€Backup€copies€of€documents€can€be€imperfect€copies€of€the€originals,€sometimes€omittingÏinformation,€and€sometimes€including€more€than€is€required.Ìg)€Electronic€networks€(both€in€the€office€and€around€the€world)€make€it€easier€and€quicker€toÏtransmit€several€copies€of€400€page€documents€to€other€computers€around€the€world€than€to€walkÏto€the€nearest€coffee€pot.Ìh)€Electronic€mail,€because€of€its€informal€nature,€encourages€its€authors€to€write€unwise€andÏinappropriate€things€that€they€might€never€say€to€a€recipient€directly,€and€might€regret€writing€inÏa€letter€or€facsimile.ÔÌÌÌÔ[4.2]€ÔÌÌÌùÔThese€characteristics€demand€that€extraordinary€steps€be€taken€duringÏthe€early€stages€of€litigation,€perhaps€before€filing,€if€relevant€evidence€is€to€be€preserved.ÏIgnorance€of€these€characteristics€may€mean€a€requesting€party€will€fail€to€obtain€appropriateÏevidence,€and€a€producing€party€may€inadvertently€waive€privilege€or€produce€documents€inÏignorance€of€their€significance€to€the€case.ÌÔÌÌÌÔ[4.3]€ÔÌÌÌFûÔTo€optimize€its€litigation€position,€a€requesting€party€must:ÌÓC€ g ‡û##gCÓa)€Take€early€and€aggressive€action€to€ensure€that€computer-based€evidence€is€properly€preservedÏby€the€opposing€party.€This€may€include€putting€the€opposing€party€on€notice€to€preserve€allÏrelevant€evidence€by€making€immediate€backup€copies€of€computer€hard€disks€and€by€cessationÏof€reuse€of€tapes€during€customary€backup€cycles.€Retaining€a€competent€computer€expert€toÏhelp€convince€a€magistrate€judge€why€such€early€and€forceful€action€must€be€taken€may€beÏadvantageous.Ìb)€Formulate€discovery€requests€that€demand€the€production€of€all€relevant€forms€ofÏcomputer-based€evidence.€The€requesting€party€must€insist€on€a€complete€examination€ofÏrelevant€computer-based€evidence.Ìc)€Retain€a€competent€expert€to€help€sift€through€the€computer-based€evidence€produced€byÏdefendant.€An€expert€can€often€find€'smoking€guns'€that€the€opposing€party€unwittinglyÏproduced.ÔÌÌÌÔ[4.4]€ÔÌÌÌUÿÔTo€optimize€its€litigation€position,€a€producing€party€must:ÌÓC€ g ‡û##gCÓa)€Take€early€action€to€ensure€that€the€client€(probably€with€the€assistance€of€an€expert)€òòpreservesóóÐ '&'& Ðexisting€evidence,€including,€if€necessary,€disabling€any€automated€procedures€on€the€computerÏthat€will€destroy€such€evidence€as€part€of€a€routine€janitorial€function€on€the€computer's€storage.ÏIt€is€most€unusual€for€commercial€backup€software€to€preserve€a€òòcompleteóó€backup€of€aÐ î(î(" Ðcomputer's€storage€media€suitable€for€evidentiary€analysis.€Backup€software€only€preservesÏòòactiveóó€files,€and€not€those€recently€deleted.€It€may€be€a€separate€question€whether€deleted€filesÐ È*È*$ Ðthat€still€exist€on€hard€disks€and€tapes€are€discoverable.€Some€might€assert€that€deleted€files€areÏanalogous€to€paper€documents€that€have€been€discarded.Ìb)€Retain€a€competent€expert€to€sift€through€any€computer€storage€media€that€is€to€be€produced.ÏIf€one€produces€a€magnetic€tape€to€an€opponent,€and€the€magnetic€tape€contains€informationÏprotected€by€privilege€or€by€the€attorney€work€product€doctrine,€one€may€thereby€waive€privilegeÏon€entire€classes€of€evidence.Ô% ‡ˆ ÔÔ%†ˆ]ԀРÐò ò5€Redundant€Copies€of€Computer-Based€Evidenceó ó€Ð 22+ ÐÔ% ‡‰ ÔÔ%†‰ÔÔò òGlobal€Distribution€of€Computer-Based€Documentsó ó€Ð ÜÜ ÐÔÌÌÌÔ[5.1]€ÔÌÌÌ>ÔLitigation€attorneys€routinely€recognize€that€multiple€copies€of€every€conventional€businessÏrecord€may€exist€in€many€locations€and€in€different€embodiments.€Similarly,€multiple€copies€ofÏevery€item€of€computer-based€evidence€may€exist€on€some€or€all€of€the€parties'€computers,€andÏpossibly€on€computers€under€the€control€of€third€parties.ÌÔÌÌÌÔ[5.2]€ÔÌÌ̽ÔIt€is€usual€for€a€modern€company€to€have€a€personal€computer€for€each€employee;€moreÏsophisticated€companies€will€network€these€computers€together,€with€'server'€computersÏproviding€a€central€repository€for€computer€software€and€documents,€accessible€from€all€otherÏcomputers€on€the€'local€area€network'€(LAN)€or€'wide€area€network'€(WAN).€Such€networks,Ïaugmented€by€worldwide€networks€like€the€Internet,€make€it€inevitable€that€computer-basedÏevidence€will€travel€widely.€In€contrast€to€paper€documents,€which€require€a€certain€amount€ofÏeffort€to€distribute,€computer-based€versions€of€documents€can€be€propagated€around€the€worldÏalmost€effortlessly.€For€example,€assuming€that€this€author€had€access€to€the€source€code€forÏMicrosoft€Windows€and€the€Internet,€here€is€the€command€that€could€send€hundreds€of€copiesÏ(depending€on€the€number€of€addressees)€of€Microsoft's€'crown€jewels'€around€the€world€in€a€fewÏseconds:Ìmail€mailing-list€<€msw.src.tar.uuÌÔÌÌÌÔ[5.3]€ÔÌÌ̧ ÔThis€command€would€complete€its€function€within€five€to€ten€seconds.€The€command€isÏirrevocable€without€highly€specialized€software€knowledge,€but€even€that€would€not€stop€theÏcommand€unless€remedial€action€were€taken€within€a€few€seconds€of€the€command's€execution.ÌÔÌÌÌÔ[5.4]€ÔÌÌÌÝ ÔEven€a€sole€proprietor€with€a€single€personal€computer€can€connect€to€worldwide€networksÏand€can€create€evidence€relevant€to€litigation€on€the€hard€disks€of€computers€many€miles€away.ÏModern€computer€networks€render€geographic€distance€irrelevant;€evidence€created€on€aÏcomputer€5,000€miles€away€is€logically€as€close€as€the€hard€disk€inside€your€own€computer.€It€isÏtherefore€vital€for€both€defendants'€and€plaintiffs'€attorneys€to€consider€all€possible€locationsÏwhere€relevant€evidence€might€be€stored€and€to€not€limit€their€consideration€merely€to€theÏgeographical€locations€where€the€parties€happen€to€have€their€offices.ÌÔ% ‡Š ÔÔ%†Š{ԀРÐò òDeliberate€Backup€Copiesó ó€Ð  ÐÔÌÌÌÔ[5.5]€ÔÌÌÌÝÔBackups€are€redundant€copies€of€information€resident€on€the€computer€at€the€time€theÏbackup€copy€was€made.€If€(or€when)€the€computer€hardware€fails,€a€backup€copy€can€be€used€toÏrecreate€the€information€that€otherwise€would€be€lost.€Backup€copies€are€best€made€at€frequentÏand€regular€intervals.€Larger€companies€typically€employ€individuals€whose€responsibility€it€is€toÏensure€that€central€computers,€be€they€local€area€network€servers€or€central€mainframeÏcomputers,€are€backed€up€on€a€daily€schedule.ÌÔÌÌÌÔ[5.6]€ÔÌÌÌÔMost€organizations€use€a€backup€òòcycleóó€as€a€compromise€between€spending€too€much€timeÐ q&q&# Ðmaking€backups€copies€and€failing€to€backup€all€relevant€information.€An€example€of€a€simple,Ïbut€frequently€used,€backup€cycle€illustrates€its€evidentiary€significance:ÌÓC€ g ‡û##gCÓa)€Every€Friday€a€complete€backup€copy€is€made€of€every€file€on€the€computer€system€(exceptÏthose€files€that€have€been€deleted€or€remnants€of€old€files€not€completely€overwritten€by€newÏfiles).Ìb)€Every€day€other€than€Friday,€only€those€active€files€that€have€been€changed€are€backed€up.ÏEach€day€uses€a€different€set€of€backup€media.ÔÌÌÌÔ[5.7]€ÔÌÌÌÖÔWhen€this€backup€cycle€is€used,€if€theÏcomputer€system€fails€on€Tuesday,€all€of€the€data€files€can€be€restored€to€their€most€recent€stateÏby€reloading€the€computer€from€the€previous€Friday's€backup,€followed€by€the€Saturday,€Sunday,Ïâ âand€Monday€backups.Ð k1k1- ÐÔÌÌÌÔ[5.8]€ÔÌÌÌÔTo€give€greater€disaster-recovery€capability,€many€organizations€use€additional€strategies:Ìâ âÓC€ g ‡û##gCÓa)€Each€Friday's€backup€is€written€to€one€of€four€sets€of€backup€media,€using€these€Friday€sets€inÏrotation.€If€a€computer-based€file€is€found€to€have€been€corrupted€three€weeks€ago,€with€a€littleÏeffort€it€can€be€restored€by€using€the€appropriate€Friday€tape.Ìb)€Every€fourth€Friday,€a€new€set€of€Friday€backup€media€is€used€to€replace€the€set€that€wouldÏotherwise€be€used.€The€set€removed€from€use€can€then€be€stored€in€a€vault€for€some€number€ofÏmonths,€or€perhaps€in€perpetuity.ÔÌÌÌÔ[5.9]€ÔÌÌÌÒÔThus,€a€complete€set€of€backup€media€acts€as€a€timeÏmachine;€restoring€a€backup€copy€on€to€the€computer€winds€the€clock€back€to€the€moment€inÏtime€when€the€backup€was€made,€be€that€earlier€that€same€day€or€several€months€or€even€yearsÏearlier.€In€patent€infringement€cases,€prior€versions€of€a€computer€program€may€be€relevant€toÏissues€of€willfulness.€In€trade€secret€cases,€prior€versions€of€computer€programs€may€show€use€ofÏtrade€secrets.€In€copyright€cases,€prior€versions€of€computer€programs€may€be€relevant€to€issuesÏof€derivation.ÌÔÌÌÌÔ[5.10]€ÔÌÌÌÔThe€cost€of€magnetic€media€has€dropped€dramatically,€and€it€is€now€usually€moreÏcost-effective€to€use€different€media€for€each€successive€backup€copy,€or€at€least€to€have€multipleÏsets€of€media€that€are€used€in€rotation.€At€any€instant€in€time,€most€organizations€have€redundantÏcopies€of€their€computer-based€pre-litigation€evidence€for€preceding€days,€weeks,€months€orÏyears.ÌÔ% ‡‹ ÔÔ%†‹¿Ô€Ð Ðò òInadvertent€Backup€Copiesó ó€Ð ãã ÐÔÌÌÌÔ[5.11]€ÔÌÌÌ"ÔPreservation€of€deliberate€backup€copies€is€a€sound€business€practice.€Even€withoutÏformal€procedures€(or€their€enforcement),€many€inadvertent€backup€copies€of€computer-basedÏevidence€are€made€by€individual€computer€users,€either€to€protect€their€own€data€files€created€byÏprograms€such€as€word€processors,òòÔ4‚Œ€verÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(10)Ô6ƒÔÝ‚¼›—janiÝÔÿÔóóÝ  ÝÔ7ine€ÅÔóó€or€because€of€giving€copies€of€data€files€on€diskettes€toÐ šš Ðcolleagues.€In€smaller€companies€where€there€is€no€central€server,€each€computer€user€will€beÏresponsible€for€maintaining€his€or€her€own€backup€copies€in€case€a€computer€fails.€However,€it€isÏusual€for€users€in€this€context€to€maintain€less€than€complete€backup€copies.€Many€users€learnÏthe€hard€way€(when€their€computer€fails€or€when€they€inadvertently€delete€a€file)€the€perils€ofÏfailing€to€keep€adequate€backups.€Similarly,€users€learn€the€peril€of€overwriting€the€media€usedÏfor€the€previous€backup€with€the€current€backup;€a€data€file€that€is€corrupt€now,€might€not€haveÏbeen€corrupt€the€previous€time€a€backup€copy€was€made,€but€reusing€the€media€obliterates€theÏlast€good€version€of€the€data€file.ÌÔÌÌÌÔ[5.12]€ÔÌÌÌ>!ÔBecause€of€private€backups,€application€program€backups,€or€data€file€sharing,€almostÏevery€computer€user€has€many€floppy€diskettes€or€small€tape€cartridges€(depending€on€theÏbackup€device€on€their€computer)€in€his€or€her€possession,€and€those€diskettes€or€cartridgesÏtypically€contain€a€hodgepodge€of€data€files.€Much€computer-based€evidence€is€backed€up€almostÏinadvertently,€swept€along€with€other€data€files€as€they€are€copied€to€a€backup.€It€is€easier€toÏbackup€all€active€files(11)€from€the€hard€disk€to€a€tape€cartridge€than€it€is€to€choose€individualÏfiles.€Most€users€take€the€path€of€least€resistance€and,€if€they€make€backups€at€all,€will€backupÏentire€disks€or€directories.ÌÔ% ‡ ÔÔ%†$ԀРÐò òOff-site€Backup€Copiesó ó€Ð ü+ü+) ÐÔÌÌÌÔ[5.13]€ÔÌÌÌx$ÔTo€guard€against€dramatic€catastrophes€such€as€fire€or€flood,€many€companies€eitherÏencourage€or€require€the€storage€of€backups€off-site,€away€from€their€offices.€This€off-siteÏstorage€might€be€in€the€vault€of€another€company€specializing€in€the€safekeeping€of€backupÏmedia€or€could€be€at€the€homes€of€senior€management.€If€a€company€permits€employees€to€useÏtheir€home€computers€outside€of€office€hours,€or€if€it€employs€telecommuters€who€routinely€workÏat€home€during€the€day,€off-site€backups€will€be€created€on€these€home€computers€as€anÏinevitable€by-product.€However,€these€informal€or€inadvertent€backups€are€unlikely€to€be€asÐ z2z20 Ðcomplete€as€intentional€corporate€backups.ÌÔ% ‡Ž ÔÔ%†Ž]'ԀРÐò òSource€Code€Escrowó ó€Ð ’’ ÐÔÌÌÌÔ[5.14]€ÔÌÌ̹'ÔSoftware€companies€that€license€their€software€are€often€required€by€their€licensees€toÏdeposit€computer-based€copies€of€their€human€readable€source€code€and€machine€readable€objectÏcode€in€escrow€to€guard€against€the€possibility€that€a€licensee€will€be€unable€to€continue€to€useÏthe€software€if€the€licensor€goes€out€of€business.€There€are€companies€that€specialize€in€sourceÏcode€escrow.€Escrow€copies€also€act€as€backup€copies.€Most€escrow€agreements€call€for€eachÏsuccessive€version€of€the€source€and€object€code€to€be€placed€into€escrow,€but€few€agreementsÏrequire€earlier€versions€to€be€destroyed€or€returned€to€the€software€company.ÌÔ% ‡ ÔÔ%†e*ԀРÐò òSource€Code€Licenseesó ó€Ð Æ Æ  ÐÔÌÌÌÔ[5.13]€ÔÌÌÌÄ*ÔOften€software€companies€will€license€their€source€code€to€their€customers€and€willÏdeliver€this€software€in€computer-based€form.€This€is€a€more€common€practice€among€companiesÏdeveloping€software€for€mainframe€computers€than€among€those€who€produce€products€for€theÏmass€personal€computer€market.€Each€source€code€licensee,€in€effect,€becomes€an€off-siteÏbackup€site€and€usually€retains€many€versions€of€the€vendor's€source€and€object€code.€Often,€theÏlicensor's€source€or€object€code€melds€with€the€licensee's€computer-based€information€and€isÏswept€along€with€whatever€intentional€and€incidental€backups€are€created.ÌÔ% ‡ ÔÔ%†\-ԀРÐò ò6€Backup€Copies€Are€Incompleteó ó€Ð úú ÐÔÌÌÌÔ[6.1]€ÔÌÌÌÄ-ÔThe€preceding€section€implies€that€with€adequate€backups,€computer-based€evidence€canÏbe€adequately€preserved.€While€this€is€true€from€a€typical€computer€user's€point€of€view,€it€fallsÏvery€short€from€the€forensic€software€analyst's€point€of€view.€Most€commercial€backup€softwareÏmakes€backup€copies€only€of€active€documents€and€data€files€on€the€computer's€hard€disks,€andÏexcludes€deleted€files€and€remnants€of€old€files€partially€overwritten€by€new€ones.€There€isÏusually€no€purpose€to€be€served€by€preserving€this€excluded€information,€so€there€is€noÏmotivation€for€the€backup€software€vendors€to€provide€this€capability.€òòMost€typical€backup€orÐ xx Ðcopy€programs€can€be€irrefutably€shown€not€to€preserve€all€of€the€computer-based€evidence€thatÏis€available€on€the€original€storage€device.óó€Fortunately,€there€are€now€special€backup€programsÐ RR Ðthat€preserve€an€entire€image€of€a€hard€disk€on€tape,€and€special€hard€disk€duplication€programsÏthat€make€a€complete€copy€of€one€hard€disk€onto€another.ÌÔÌÌÌÔ[6.2]€ÔÌÌÌÿ1ÔThe€knowledge€of€the€inadequacies€of€common€commercial€backup€software€provides€aÏstrong€impetus€for€a€requesting€party€to€demand€access€to€the€producing€party's€actual€computerÏsystems€to€inspect€or€preserve€(using€special€'mirror€image'€backup€software)€the€original€disks,Ïdiskettes€and€tapes.€A€party€who,€using€a€commercial€backup€program,€knowingly€makes€anÏincomplete€backup€copy€for€production€to€the€adverse€party,€might€expose€itself€to€Rule€34Ïsanctions€for€destruction€of€(or€failure€to€preserve)€computer-based€evidence.ÌÔ% ‡‘ ÔÔ%†‘@4ԀРÐò òMagnetic€Tapesó ó€Ð L)L)' ÐÔÌÌÌÔ[6.3]€ÔÌÌ̘4ÔMagnetic€tapes€of€various€sizes€are€often€used€for€backup€copies,€as€they€can€store€a€largeÏamount€of€data€in€a€relatively€small€space.€Like€home€audio€and€video€tapes,€information€isÏwritten€from€the€beginning€of€the€magnetic€tape€sequentially€toward€the€end€of€the€tape.€LikeÏhome€audio€and€video€tapes,€computer€tapes€are€usually€reused€when€the€data€recorded€on€themÏbecomes€outdated.ÌÔÌÌÌÔ[6.4]€ÔÌÌÌH6ÔThe€key€evidentiary€question€is€whether€any€prior€residual€information€that€has€not€beenÏoverwritten€by€new€information€continues€to€exist.€This€is€analogous€to€a€two-hour€video€tapeÏthat€originally€contained€two€hours€of€òòGone€With€The€Windóó,€but€was€reused€to€record€a€one€hourÐ “1“1/ Ðepisode€of€òòMasterpiece€Theater.€óóDoes€the€second€hour€of€òòGone€With€The€Windóó€still€exist€on€theÐ €2€20 Ðtape?€From€the€technical€point€of€view,€residual€information€on€a€tape€that€has€not€beenÏoverwritten€continues€to€exist.€It€takes€very€little€effort€to€access€this€residual€information€"offÏthe€end"€of€the€active€information.ÌÔÌÌÌÔ[6.5]€ÔÌÌÌ9ÔThough€this€could€be€key€evidence,€in€this€author's€experience,€standard€commercial€tapeÏduplicating€software€fails€to€copy€"off€the€end"€information,€and€most€counsel€are€unaware€of€itsÏpossible€existence.ÌÔ% ‡’ ÔÔ%†’ý9ԀРÐò òComputer-Based€Evidence€Must€Be€Preserved€Immediatelyó ó€Ð    ÐÔÌÌÌÔ[6.6]€ÔÌÌÌ|:ÔIt€is€important€to€note€that€remnants€of€documents€and€data€files€residing€on€computerÏmedia€have€no€guaranteed€life-span;€they€could€be€overwritten€from€a€few€seconds€of€using€theÏcomputer,€or€could€remain€for€months€or€years.€The€òòonlyóó€sure€preservative€method€is€to€make€aÐ Ù Ù  Ðcomplete€òòimageóó€backupòòÔ4‚“ine€ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(12)Ô6ò;ÔÝ‚¼›<janiÝÔÿÔóóÝ  ÝÔ7ine€4<Ôóó€of€hard€disks€before€the€computer€system€is€used€for€anything€else€andÐ Æ Æ  Ðto€make€complete€image€backups€of€entire€diskettes€and€tapes€before€they€are€reused.€In€thisÏauthor's€experience,€companies€do€not€do€this.€When€litigation€is€filed,€a€producing€party€mayÏmake€a€diligent€effort€to€preserve€paper€versions€of€documents€but,€because€of€lack€of€technicalÏknowledge,€the€producing€party€is€extremely€lackadaisical€in€preserving€computer-basedÏevidence.ÌÔ% ‡” ÔÔ%†”v>ԀРÐò ò7€The€Vast€Quantity€of€Computer-Based€Evidenceó ó€Ð  ÐÔÌÌÌÔ[7.1]€ÔÌÌÌî>ÔA€typical€company€has€many€computers,€each€with€one€or€more€hard€disk€drives.€The€costÏof€high-capacity€hard€disks€has€dropped€dramatically€in€the€last€decade,òòÔ4‚•ine€ÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  Ô(13)Ô6»?ÔÝ‚¼›Ï?es€tÝÔÿÔóóÝ  ÝÔ7eratý?Ôóó€and€even€portableÐ úú Ðlaptop€computers€are€available€with€hard€disks€that€can€store€3,000,000,000€characters€ofÏinformation€(approximately€1,000,000€pages€of€typewritten€material,€or€a€stack€of€paper€350€feetÏhigh).ÌÔÌÌÌÔ[7.2]€ÔÌÌÌNAÔTo€appreciate€the€enormousness€of€computer-based€information,€consider€a€hypotheticalÏsmall€software€company,€SmallSoft€Inc.,€with€50€employees.€Assume€40€programmers€haveÏcomputers€and€that€ten€senior€managers€and€salespersons€also€have€laptop€computers.€FurtherÏassume€that€ten€employees€have€home€computers€they€use€to€tap€into€the€company's€computersÏwhen€they€work€from€home.€Finally,€assume€that€the€company€uses€a€local€area€network€and€soÏhas€a€server€computer€acting€as€a€central€repository€for€in-house€documents€and€as€a€switchingÏyard€for€electronic€mail€messages.€SmallSoft€Inc.,€has€a€total€of€60€computers€used€byÏindividuals,€and€a€central€server€computer.ÌÔÌÌÌÔ[7.3]€ÔÌÌÌDÔIndividual€computers,€and€even€laptop€computers,€are€likely€to€have€hard€disks€of€two€orÏthree€gigabytes€or€larger.€Central€network€computers€usually€have€at€least€five€or€ten€gigabytes€orÏmore€of€disk€storage.€The€total€disk€storage€space€of€SmallSoft€Inc.€is€likely€to€be,€at€a€minimum,Ï130€gigabytes€of€information.€That€is€the€equivalent€of€4,300,000€pages€of€typewritten€material.ÏOf€course,€this€is€the€maximum€and€assumes€100%€of€all€disks€are€used€for€data€storage.€Add€toÏthis€the€number€of€diskettes€and€tape€cartridges€that€might€be€used€for€backup€copies€and€theÏequivalent€of€typewritten€pages€is€likely€to€double€or€triple.€If€SmallSoft€Inc.€enforces€rigorousÏbackup€procedures,€the€total€storage€may€even€quadruple,€reaching€a€stunning€12,000,000€pagesÏof€typewritten€information.ÌÔÌÌÌÔ[7.4]€ÔÌÌÌaGÔIn€paper€form,€these€vast€volumes€of€evidence€would€require€hundreds€of€storage€boxes,Ïbut€today's€technology€permits€five€gigabytes€of€information€to€be€stored€on€an€8-mm€camcorderÏtape.€A€handful€of€these€tapes€could€easily€store€25€gigabytes€of€information.€New€devices€willÏstore€up€to€25€gigabytes€on€a€single€camcorder€cassette;€all€of€SmallSoft€Inc.'s€evidence€could€beÏheld€in€a€jacket€pocket.€Absent€adequate€computer€security,€a€disgruntled€employee€could€walkÏpast€a€security€guard€with€all€of€SmallSoft's€intellectual€property,€and€all€computer-basedÏâ âinformation,€in€a€purse€or€a€shirt-pocket.Ð 11/ ÐÔ% ‡– ÔÔ%†–JԀРÐâ âò ò8€The€Disorganized€State€of€Computer-Based€Evidenceó ó€Ð ÉÉ ÐÔÌÌÌÔ[8.1]€ÔÌÌÌJÔAlthough€computer€diskettes€and€tapes€are€readily€organized€in€desk€drawers€or€storageÏcabinets,€and€hard€disks€are€tidily€hidden€inside€personal€computers,€the€evidence€they€contain€isÏrarely€organized€coherently.€Most€computer€users€settle€for€just€getting€useful€work€done,€ratherÏthan€attempting€to€maintain€a€neat€and€tidy€hard€disk.€In€fact,€many€computer€users€do€not€evenÏorganize€their€data€files€into€subdirectories€to€impose€an€organizational€hierarchy€on€their€files.ÏSince€the€disorganized€state€of€a€computer's€hard€disk€is€not€visible€externally,€there€is€littleÏmotivation€for€tidiness.ÌÔÌÌÌÔ[8.2]€ÔÌÌÌMÔIndividual€backup€media€are€rarely€catalogued.€In€testament€to€the€general€reliability€ofÏmodern€personal€computers,€backup€copies€are€rarely€used€once€created.€Usually€only€the€mostÏrecent€backup€copy€is€relevant€to€disaster€recovery.€Off-site€backups,€copies€of€materials€inÏescrow,€and€copies€sent€to€licensees€are€rarely€accounted€for.€If€they€are,€only€the€most€recentÏmaterial€is€usually€of€interest€to€the€computer€user.€The€true€chaos€of€a€company's€organizationÏof€computer-based€evidence€becomes€apparent€only€when€litigation€is€filed.€Both€parties€areÏconfronted€with€the€challenges€of:€(a)€finding€all€relevant€evidence,€and€(b)€sifting€through€thatÏevidence€to€discard€irrelevant€or€privileged€information.ÌÔÌÌÌÔ[8.3]€ÔÌÌÌPÔFor€the€defendant,€it€is€easy€to€take€a€lazy€approach€and€claim€that€much€computer-basedÏevidence€was€never€created,€no€longer€exists,€or€cannot€be€found.€In€this€author's€experience,Ïsome€companies€assert:ÌÓC€ g ‡û##gCÓa)€They€do€not€keep€more€than€30€days'€worth€of€electronic€mail€messages.€Centralized€backupÏcopies€of€email€for€only€30€days€is€plausible,€but€it€is€almost€certain€that€individual€computerÏusers€preserve€their€own€private€copies€of€email€correspondence€for€far€longer€than€this€in€eitherÏprinted€form€or€magnetic€media.Ìb)€They€do€not€keep€more€than€one€or€two€prior€versions€of€their€software€products.€This€begsÏthe€question€of€whether€these€companies€provide€user€support€for€earlier€versions€of€theirÏproducts.€If€they€do,€then€it€would€be€reasonable€that€they€keep€both€the€source€code€and€objectÏcode€for€these€products.€Absent€the€source€and€object€code,€it€would€be€almost€impossible€for€aÏcompany€to€meet€its€customer€support€obligations.€To€fix€a€problem,€or€to€help€a€user€around€it,Ïdemands€the€recreation€of€the€problem€to€diagnose€and€correct€it.ÔÌÌÌÔ[8.4]€ÔÌÌÌ«TÔTaking€the€lazy€way€isÏalso€extremely€risky€because€a€typical€company€leaves€a€wide€swath€of€evidence€(paper,Ïcomputer-based€or€anecdotal)€regarding€its€procedures.€One€set€of€backup€disks€or€tapes€usuallyÏcontains€telltales€that€speak€of€specific€policies€or€procedures,€or€hints€of€the€existence€of,€orÏcross€references€to,€particular€documents€or€versions€of€source€code.€The€court€(and€opposingÏcounsel)€may€be€skeptical€if€an€otherwise€well-organized€company€appears€to€have€only€recentlyÏdeveloped€patchy€backup€procedures.ÌÔ% ‡— ÔÔ%†—èVԀРÐò ò9€Drafting€Document€Requestsó ó€Ð l'l'% ÐÔÌÌÌÔ[9.1]€ÔÌÌÌNWÔThis€section€offers€some€technical€suggestions€for€crafting€precise€document€requests,Ïalthough€it€is€worded€colloquially€rather€than€in€the€style€one€normally€finds€in€such€requests.ÌÔÌÌÌÔ[9.2]€ÔÌÌÌ1XÔA€document€request€should€demand€production€of€the€following€information:ÌÓC€ g ‡û##gCÓa)€All€relevant€computer€source€code.€If€the€source€code€is€managed€by€revision€control€software,Ïthe€revision€control€version€of€the€source€code€must€be€requested,€rather€than€specific€versions€ofÏthe€source€code€òòderivedóó€from€the€revision€control€software.€The€software€requested€must€includeÐ µ.µ.+ Ðall€makefiles€and€other€control€files€used€to€create€the€finished€object€code€from€source€code,Ïalong€with€any€source€code€header€or€copybook€files€that€are€included€by€reference€into€otherÏâ âsource€code€files.Ð |1|1. Ðb)€If€the€documentation€is€managed€by€a€document€control€system€(such€as€many€law€firms€use),Ïâ âthe€actual€document€files€(and€perhaps€the€document€control€software,€as€well)€must€beÏrequested€if€all€forensic€information€is€to€be€produced.Ìc)€If€third€party€software€products€are€required€to€unlock€or€gain€access€to€the€source€code,Ïcopies€of€these€products€must€be€requested€unless€the€same€versions€of€these€products€are€stillÏcurrently€available€on€the€market.Ìd)€If€any€information€is€encrypted€or€protected€by€security€access€software,€then€the€securityÏaccess€software€and€appropriate€decryption€keys€and€passwords€must€be€provided.ÔÌÌÌÔ[9.3]€ÔÌÌÌŸ]ÔTheÏproduction€of€third€party€software,€either€for€revision€control,€document€management,€or€asÏsoftware€components€used€by€the€producing€party,€is€almost€always€a€disputed€issue.€TheÏproducing€party€usually€takes€the€position€that€production€of€this€software€would€be€an€act€ofÏcopyright€infringement.€On€the€other€hand,€unless€the€particular€òòversionóó€of€the€software€is€stillÐ à à  Ðcurrently€available,€the€lack€of€this€software€will€almost€certainly€deny€the€requesting€partyÏaccess€to€relevant€information.€In€the€case€of€the€revision€control€and€document€managementÏsoftware,€the€requesting€party€will€be€denied€highly€relevant€forensic€information.€In€the€case€ofÏthe€third€party€products,€the€requesting€party€may€be€unable€to€access€all€of€the€source€codeÏproduced.ÌÔÌÌÌÔ[9.4]€ÔÌÌÌã`ÔAt€first€blush,€a€reasonable€approach€might€be€to€simply€purchase€current€versions€of€theÏthird€party€products.€However,€by€the€time€a€dispute's€discovery€phase€has€begun,€it€is€moreÏlikely€than€not€that€any€relevant€third€party€product€will€be€unavailable€on€the€market.ÌÔÌÌÌÔ[9.5]€ÔÌÌÌbÔThe€principal€issue€is€whether€a€producing€party€is€obligated€to€produce€copies€of€thirdÏparty€materials€used€in€the€production€of€the€computer€software.€This€might€at€first€appear€to€beÏa€clear€example€of€copyright€infringement,€but€there€are€often€extenuating€circumstancesÏ(beyond€the€fact€that€the€copying€is€being€done€in€connection€with€litigation),€the€most€usual€ofÏwhich€is€that€the€third€party€software€used€in€the€creation€of€the€software€is€no€longer€available.ÏUnless€the€producing€party€makes€a€copy€of€this€third€party€material,€the€requesting€party€will€notÏhave€a€complete€copy€of€the€software.ÌÔÌÌÌÔ[9.6]€ÔÌÌÌ­dÔIn€certain€cases,€most€notably€with€Microsoft's€Visual€Basic€products,€third€partyÏextensions€("VBX")€must€be€present€for€the€Visual€Basic€program€to€present€the€producingÏparty's€source€code.€The€third€party,€VBX,€acts€as€a€lock€that€will€block€access€to€the€producingÏparty's€source€code€,€or€at€least€to€that€part€of€it€that€interoperates€with€the€third€party€VBX.ÌÔ% ‡˜ ÔÔ%†˜HfԀРÐò òEmbodiment€of€Documents€Producedó ó€Ð ¤#¤#  ÐÔÌÌÌÔ[9.7]€ÔÌÌ̲fÔA€document€request€should€make€it€clear€that,€where€any€information€(be€it€source€code,Ïdocuments€or€other€information,€exists€on€computer€media)€it€must€be€produced€as€computerÏmedia€rather€than€being€printed€out.€The€only€condition€under€which€a€printed€document€mightÏbe€acceptable€is€if€the€producing€party€does€not€have€a€copy€of€that€document€on€computerÏmedia.ÌÔ% ‡™ ÔÔ%†™MhԀРÐò òInformation€Necessary€to€Access€Information€Producedó ó€Ð þ*þ*' ÐÔÌÌÌÔ[9.8]€ÔÌÌÌËhÔTo€recover€and€analyze€the€information€produced,€one€needs€to€understand€some€importantÏtechnical€details€about€the€information's€original€habitat,€and€details€about€the€particularÏembodiment€in€which€it€has€been€produced.€Concerning€the€information's€original€habitat€--theÏenvironment€in€which€the€information€was€created€and€managed€--€one€needs€to€know:ÌÓC€ g ‡û##gCÓa)€The€manufacturer,€model€and€configuration€of€the€computer€system€upon€which€theÏinformation€was€created€and€managed€(for€example,€a€Toshiba€Tecra€730€CDT€with€64€MB€ofÏRAM).Ð X2X2. Ðb)€The€manufacturer,€name€and€version€number€under€which€the€information€was€created€andÏmanaged€(for€example,€Windows€95,€Release€950A€with€Service€Pack€1€installed).Ìc)€The€manufacturer,€program€name€and€version€number€of€the€software€used€to€create€andÏmanage€the€information.€An€example€response€for€source€code€might€be€Microsoft€Visual€C++,Ïversion€5,€or,€for€word€processing€documents,€WordPerfect€6.1.€The€response€to€this€questionÏmight€bifurcate€if€the€information€in€question€is€source€code€that€is€maintained€under€revisionÏcontrol€software.€Then,€besides€the€details€about€the€source€code€itself,€one€also€needs€to€knowÏthe€manufacturer,€program€name€and€version€number€of€the€revision€control€software€itself.ÔÌÌÌÔ[9.9]ÏÔÌÌÌ7nÔRegarding€the€embodiment€in€which€the€information€is€being€produced,€one€needs€to€know:ÌÓC€ g ‡û##gCÓa)€The€manufacturer€and€model€number€of€the€hardware€device€in€which€the€media€was€placed€toÏwrite€the€information€being€produced.€This€is€particularly€important€for€magnetic€tapes,€or€forÏany€device€other€than€a€standard€IBM€PC€compatible€floppy€diskette€(which€is€one€of€the€fewÏtrue€standards€in€the€industry).€An€example€response€would€be€a€WangDAT€3400DX€4mm€tapeÏdrive.Ìb)€The€manufacturer,€program€name,€version€number€and€specific€operational€parameters€usedÏwith€the€software€that€was€employed€to€write€the€information€to€the€media€being€produced.€ForÏexample,€this€might€be€Arcada€Backup€version€2.0.ÔÌÌÌÔ[9.10]€ÔÌÌÌ_qÔThis€embodiment-related€data€isÏparticularly€critical€for€minicomputers€such€as€the€IBM€AS/400,€for€mainframe€computers,€or€forÏthose€running€the€Unix€operating€system.€Without€this€data,€the€information€produced€will€be,Ïfor€all€practical€purposes,€inaccessible.ÌÔ% ‡š ÔÔ%†š“rԀРÐò òEnsuring€a€Complete€Productionó ó€Ð ½½ ÐÔÌÌÌÔ[9.11]€ÔÌÌÌûrÔThough€one€of€the€first€tasks€for€a€forensic€expert€is€to€determine€whether€a€documentÏproduction€is€complete,€it€is€quite€rare€to€see€a€document€production€request€that€defines€a€meansÏby€which€both€parties€can€know€whether€all€relevant€computer€software€files€have€beenÏproduced.ÌÔÌÌÌÔ[9.12]€ÔÌÌÌAtÔA€complete€production€of€computer€source€code€is€easily€defined€as€production€of€allÏrelevant€source€code,€makefiles,€and€additional€information€(the€details€of€which€were€describedÏabove),€necessary€for€the€requesting€party€to€access€all€files€from€the€media€upon€which€theyÏwere€produced€and€to€recreate€the€entire€executable€program€from€scratch€using€the€source€codeÏprovided.€If€the€computer€software€is€written€in€Microsoft€Visual€Basic,€a€further€condition€isÏrequired:€the€requesting€party€must€be€able€to€access€the€entire€source€code€embedded€within€allÏof€the€Visual€Basic€files€provided€(the€inability€to€do€this€shows€that€not€all€third€party€softwareÏcomponents€have€been€provided).ÌÔÌÌÌÔ[9.13]€ÔÌÌÌ&wÔA€complete€production€of€object€code€can€be€defined€as€all€aspects€of€the€program€usedÏon€a€computer,€where€the€aspects€of€the€program's€capabilities€are€described€in€an€appropriateÏuser€manual.ÌÔ% ‡› ÔÔ%†›xԀРÐò ò10€Drafting€Interrogatoriesó ó€Ð **& ÐÔÌÌÌÔ[10.1]€ÔÌÌÌzxÔWhile€source€code€and€its€associated€design€and€specification€documents€usually€provideÏa€wealth€of€forensic€information€(at€least€when€produced€on€computer€media),€there€is€usually€aÏneed€to€understand€specific€details€of€the€way€in€which€the€software€was€created.€TheseÏquestions€can€be€addressed€through€interrogatories.ÌÔÌÌÌÔ[10.2]€ÔÌÌÌêyÔThe€three€most€important€areas€of€information€required€are€usually:Ìâ âÓC€ g ‡û##gCÓa)€Which€programmers€worked€on€which€parts€of€the€program.Ð Z1Z1, Ðb)€By€what€means€the€document€production€requested€was€compiled.€What€was€searched?€How?Ïâ âBy€whom?Ìc)€Identification€of€the€various€versions€of€the€software€that€were€created.Ô% ‡œ ÔÔ%†œ®{ԀРÐò òSoftware€Authorshipó ó€Ð  ÐÔÌÌÌÔ[10.3]€ÔÌÌÌ |ÔA€given€source€code€file€is€usually€developed€by€a€single€computer€programmer,€at€leastÏduring€the€initial€stages€of€its€creation.€Thereafter,€many€different€hands€and€minds€may€touch€it,Ïchanging€certain€lines€of€text,€inserting€others,€and€deleting€others.ÌÔÌÌÌÔ[10.4]€ÔÌÌÌ:}ÔIf€the€source€code€has€been€placed€under€revision€control,€in€the€ideal€case,€every€changeÏcan€be€related€to€a€specific€human€author€.€More€often€than€not,€there€will€be€questions€ofÏprogram€authorship€that€are€best€determined€before€any€depositions€if€pertinent€questions€are€toÏbe€asked€of€the€appropriate€deponents.ÌÔ% ‡ ÔÔ%†¥~ԀРÐò òMethods€Used€for€Document€Productionó ó€Ð   ÐÔÌÌÌÔ[10.5]€ÔÌÌÌÔBefore€the€computer€revolution,€a€business'€records€were€in€view,€in€filing€cabinets€orÏdesk€drawers,€and€a€physical€search€was€all€that€was€required€to€comply€with€a€documentÏrequest.€Computers€have€changed€that,€providing€ultra-compact€means€for€storing€millions€ofÏpages€of€printed€paper€on€devices€that€can€fit€into€a€pocket.ÌÔÌÌÌÔ[10.6]€ÔÌÌ̉€ÔTherefore,€when€a€producing€party€makes€a€document€production€involvingÏcomputer-based€evidence€and€software,€a€very€relevant€series€of€questions€needs€to€be€asked.ÏThese€questions€should€include€how€the€party€prepared€the€document€production,€on€whatÏcomputers€the€party€searched,€by€what€means€the€party€searched,€what€keywords€were€used€inÏany€keyword€searches,€what€magnetic€tapes€were€searched,€and€whether€the€search€included€anyÏoff-site€vaults€and€storage€facilities.ÌÔ% ‡ž ÔÔ%†ž‘‚ԀРÐò òIdentification€of€Versionsó ó€Ð ff ÐÔÌÌÌÔ[10.7]€ÔÌÌÌõ‚ÔSoftware€evolves€rapidly€in€today's€industry,€and€one€version€may€be€current€for€only€aÏfew€weeks€or€months.€Usually,€a€given€version€of€software€is€identified€by€its€version€numberÏsuch€as€3.11,€or€in€some€cases€by€its€"vintage,"€such€as€Windows€95.€Software€version€numbersÏto€the€left€of€the€decimal€point€are€usually€increased€when€a€new€version€contains€significantÏnew€capabilities,€whereas€the€numbers€to€the€right€of€the€decimal€point€are€increased€to€reflectÏminor€increments.ÌÔÌÌÌÔ[10.8]€ÔÌÌÌ…ÔWhile€a€finished€program€may€have€a€specific€version€number,€such€as€WordPerfect€6.1,Ïthere€can€be€hundreds€of€components,€each€with€their€own€version€number,€none€of€which€is€theÏnumber€6.1.€It€is€therefore€important€to€establish€precisely€which€versions€of€the€software€wereÏreleased€to€the€public€or€put€into€service,€and,€if€possible,€identify€some€means€for€determiningÏthe€individual€components'€version€numbers€included€in€those€specific€releases.€Only€after€thisÏversion€number€history€has€been€ascertained€can€one€determine€the€specific€source€code€used€toÏcreate€each€release€of€the€overall€software.ÌÔ% ‡Ÿ ÔÔ%†Ÿ–‡Ô€Ð Ðò ò11€Analysis€of€Computer€Softwareó ó€Ð ++' ÐÔÌÌÌÔ[11.1]€ÔÌÌ̈ÔOnce€the€producing€party€has€made€a€production,€the€initial€challenges€for€a€forensicÏsoftware€analyst€are:ÌÓC€ g ‡û##gCÓa)€Testing€for€completeness€of€the€production€of€software€and€object€code.Ìb)Identifying€specific€versions€of€the€software€and€the€versions€of€the€individual€components€ofÏâ âwhich€it€is€comprised.Ð `1`1, Ðc)€Correlating€the€specific€versions€of€the€software€with€the€specific€versions€of€the€object€code.Ìâ âd)€Creating€a€chronology€of€the€software's€evolution.ÔÌÌÌÔ[11.2]€ÔÌÌÌ_ŠÔOnly€when€these€importantÏpreparatory€steps€have€been€completed€can€the€analysis€of€the€software€with€respect€to€the€patent,Ïcopyright,€or€trade€secrecy€claims€begin.ÌÔ% ‡  ÔÔ%† 2‹Ô€Ð Ðò ò12€Conclusionó ó€Ð 55 ÐÔÌÌÌÔ[12.1]€ÔÌÌ̉‹ÔThe€computer€geeks€of€the€world€have€effectively€hidden€many€conceptual€nooks€andÏcrannies€that€exist€with€respect€to€computer€software€and€its€associated€computer-basedÏevidence.€The€problems€of€evidence€preservation,€production€and€forensic€analysis€are€furtherÏexacerbated€by€each€quantum€leap€that€occurs€in€computer€storage€and€processing€power.ÌÔÌÌÌÔ[12.2]€ÔÌÌÌÔComputers,€it€could€be€argued,€have€made€life€easier€for€many€who€use€them.€However,Ïnothing€could€be€further€from€the€truth€for€those€who€deal€with€the€preservation,€production€andÏanalysis€of€computer-based€evidence.€ground.Ð ÐßA€¡) °°xdtExÄ0ŒAßÐ ||  ÐÔ% ‡¢ ÔÔ%†¢†ŽÔ€Ð Ð1.€òòIn€this€context,€"computer€media"€includes€a€floppy€disk,€a€hard€disk,€or€some€other€digital€embodiment€that€can€beÐ 55 Ðprocessed€by€a€computer.óó€Ð "" ÐÔ% ‡£ ÔÔ%†£rԀРÐ2.€òò(Vol.€#)€Charles€A.€Wright€&€Arthur€R.€Miller,€Federal€Practice€and€Procedure,€Ý‚¿†·MÝò òò òÝ  ݧÝ‚¿†·Mô€typÝó óó óÝ  Ý2218€(year).óó€Ð ØØ ÐÔ% ‡¤ ÔÔ%†¤iԀРÐ3.€This€was€written€before€the€advent€of€digital€photography€and€digital€motion€pictures,€theÏadvent€of€which€makes€a€complete€mockery€out€of€concepts€that€ððthe€camera€never€lies.'€Today,Ïthe€photograph€and€videotape€can€lie€as€easily€as€the€redacted€or€out€of€context€document.ÌÔ% ‡¥ ÔÔ%†¥°‘ԀРÐ4.òò(Vol.€#)€Charles€A.€Wright€&€Arthur€R.€Miller,€Federal€Practice€and€Procedure,€Ý‚¿†·MÝò òò òÝ  ݧÝ‚¿†·M1’€typÝó óó óÝ  Ý5073€(year).óó€Ð  ÐÔ% ‡¦ ÔÔ%†¦¦’ԀРÐ5òò.€óóA€more€detailed€introduction€to€the€basic€concepts€of€computer€software€is€available€on€theÐ ÔÔ ÐWorld€Wide€Web€at€Ô4‚§s€ofÔÝ‚¼›ÝÔÿÔòòÝ  ÝÔ5  ÔHttp://www.jli.com/papers.htmÔ6^“ÔÝ‚¼›r“€typÝÔÿÔóóÝ  ÝÔ7s€of “Ô€See€Computer€Systems€BasicsÐ Á Á  ÐÔ% ‡¨ ÔÔ%†¨O”ԀРÐ6.òò€óóThe€folklore€is€that€the€language"€C"€was€derived€from€a€language€called€"B."€B€had€beenÐ w#w# Ðdeveloped€at€Bell€Labs,€and€may€have€been€named€for€Bell€Labs.€Do€not€confuse€a€high-levelÏlanguage€with€a€high€level€of€abstraction€.€A€high-level€language€is€a€comparative€term.€EarlyÏcomputer€languages€were€so€low-level€that€they€(and€many€of€their€proponents)€dragged€theirÏintellectual€knuckles€on€the€ground.ÌÔ% ‡© ÔÔ%†©-–ԀРÐ7òò.€óóExperienced€programmers€will€be€quick€to€point€out€that€this€fragment€lacks€the€appropriateÐ á)á)# Ðpre-€and€post-amble€to€be€valid€C;€however,€the€intent€is€to€communicate€the€flavor€of€C,€not€toÏbe€syntactically€correct.ÌÔ% ‡ª ÔÔ%†ªN—ԀРÐ8òò.óó€Formatting€regimes€are€self-contained€source€code€development€environments.€As€an€analogy,Ð q.q.' ÐWordPerfect€would€be€considered€a€self-contained€word€processing€environment.ÌÔ% ‡« ÔÔ%†«A˜Ô€Ð Ð9.A€compiled€language€must€be€translated€into€object€code€before€it€can€control€a€computer.€Ô_ÔAnÐ 22* Ðinterpretive€language€requires€a€special€language€interpreter€(such€as€a€BASIC€interpreter)€that€isÏcapable€of€examining€each€source€code€statement€and€causing€the€appropriate€action€to€takeÏplace.ÌÔ% ‡¬ ÔÔ%†¬·™Ô€Ð Ð10.Word€processors€and€other€application€program€usually€make€a€backup€copy€of€whatever€fileÏis€currently€being€created€or€modified.€In€the€event€of€a€power€failure,€or€inadvertentÏmodifications,€the€user€can€revert€to€the€original€data€file.ÌÔ% ‡­ ÔÔ%†­ÇšÔ€Ð Ð11.Commercial€backup€software€rarely,€if€ever,€has€the€capability€to€backup€ððdeleted€files'€orÏother€remnants€of€prior€documents.ÌÔ% ‡® ÔÔ%†®y›Ô€Ð Ð12.€"Image€backup"€is€a€term€of€art€that€describes€the€entire€contents€of€a€given€hard€disk.€AnÏimage€backup€includes€the€data€contained€in€previously€deleted€files,€unless€the€data€has€beenÏcompletely€obliterated€by€new€files€which€have€overwritten€the€existing€data.ÌÔ% ‡¯ ÔÔ%†¯³œÔ€Ð Ð13.The€current€retail€cost€of€hard€disk€storage€is€about€$150€per€gigabyte€(that€is,€perÏ1,000,000,000€characters€of€storage).