Back-Up Tapes - are you sitting on a ticking time bomb?

Ben Fielding is the Compuer Forensics Manager - Business Development at Kroll Ontrack's office in London

When delving into the tricky field of tapes, it’s first important to understand the purpose they serve. In the simplest terms, a backup tape is created for business continuity purposes, a means of keeping the business running should access to live systems be lost. An archive is created for the long-term preservation of data.

Yet many people have little idea of what a backup tape actually looks like. With a range of different names and colours indicating varying capacities, it goes far beyond the typical C90 audio cassette tape or the VHS video tapes which generally spring to mind. In fact, most tapes used for the purposes of backing up or archiving a business system are surprisingly small, approximately one inch deep and not much bigger than a coaster.

Where an individual has meticulously attempted to cover their tracks, one area that they perhaps haven’t considered, let alone been aware of, are the organisations’ backup tapes.

However, regardless of what they look like, the capacity of backup tapes (up to 1.5 Terabytes) enables them to hold a potential wealth of information. This is why, when any investigation, litigation or regulatory matter occurs which requires the accessing and examination of historical data, tapes really come into their own.

At the beginning of any legal matter, determining the potential sources of digital evidence is key and while the more obvious sources of evidence are usually considered (laptops, desktops, mobile phones, USB memory sticks etc), it is the evidence to be found on tapes that is constantly overlooked.

Where an individual has meticulously attempted to cover their tracks by manipulating or deleting potentially incriminating evidence such as e-mail from live systems, one area that they perhaps haven’t considered, let alone been aware of, are the organisations’ backup tapes. These tapes act as a snapshot in time and may contain ‘smoking gun’ evidence that can paint an accurate and contemporaneous picture in spite of any attempts made to cover tracks by deleting or wiping the company laptop.

On saying that, getting the relevant data from the tapes is often easier said than done. When you consider the potential volumes of current and legacy tapes a client stores as part of their disaster recovery or archiving strategy, a request to access key data is often a very burdensome task, and one which usually falls on the desk of the IT team. Even if the team has the manpower and necessary software and hardware to do this, trawling through volumes of tapes can have a huge impact on day-to-day business requirements, particularly if compelled to meet demanding deadlines.

When responding to a regulator or complying with disclosure duties, it is imperative that organisations dutifully search for relevant data that is pertinent to the matter. It is also well recognised that the rules of civil litigation in the UK require a proportionate response to the disclosure of relevant documents. Adverse inferences will likely be made if the reason given for not doing this is:

1. The data hasn’t been adequately preserved, or
2. It is considered too onerous and complex to access the key data

In order to comply with these duties, businesses are increasingly seeking assistance in identifying the potentially relevant legacy tapes that have been kept in storage for the last 10 years, gathering dust and incurring substantial storage costs. It is certainly not unheard of to come across archived tapes that date back so far that the organisation no longer has the hardware or software to understand what data the tapes contain.

Having a better understanding of what data exactly the organisation is holding can help reduce the risk of legal exposure and can also reduce costs. Sensible data retention policies can help organisations balance their legal requirements to store particular data for certain time periods, while destroying data that it is no longer required to keep or which no longer has value to the business.

In summary, tapes can be a crucial source of evidence to an internal investigation and can provide large numbers of relevant documents for a large scale review. As such, finding the best way to understand what data you have in your possession is vital. Partnering with a trusted expert to ensure you target only the most relevant tape sets – without the need to recreate the original environment they were backed up on – can ultimately save a lot of time and money, enabling the access and review of key data to happen quickly and efficiently.

Ben Fielding is the Compuer Forensics Manager - Business Development at Kroll Ontrack's office in London

Disclaimer
This document is neither designed nor intended to provide legal or other professional advice but is intended merely to be a starting point for research and information on the subject of legal technology. While every attempt has been made to ensure accuracy of this information, no responsibility can be accepted for errors or omissions. Recipients of information or services provided by Kroll Ontrack shall maintain full, professional, and direct responsibility to their clients for any information or services rendered by Kroll Ontrack.

Copyright 2011 Kroll Ontrack, Inc & Kroll Ontrack Legal Technologies Ltd.