How much data does de-NISTing remove from the C drive?

How much data can you expect de-NISTing to remove from the C drive of a Windows PC? Special Counsel provides e-discovery solutions to firms and helps them recruit attorneys. In 2018, they conducted a test of a PC running Windows 7 and found 38,489 files on the NIST list which totalled 6.9 GB. See the results posted here. Of this total, 6.725 files were Windows 7 system files.

A search of a Windows XP PC, found 25,744 files on the NIST list which came to 4 GB. Of these 4,049 were Windows XP files. This drive had recently been ghosted, with a new operating system installed and user files removed.

Special Counsel's review also targeted pagefile.sys system files which can be several gigabytes. As discussed in the Tip of the Night for May 16, 2016, this file stores memory for applications which have not been used recently.

Note that in Windows 10 you can review a breakdown of the types of files on the C drive in settings under System . . . Storage. It indicates how much data is taken up by Windows operating system files:

The official Reference Data Set (RDS) of the National Institute of Standards and Technology lists digital signatures for 28 million files, but does not include all system files.

When having hard drives processed, if you are being charged per GB for deNISTing, you should be sure to have the reviewer first sort through large files of 5 GBs or more in order to search for video or other files which are clearly irrelevant so your client is not billed unnecessarily.

LabCorp and PHI

LabCorp is one of a few large companies that conduct most of the clinical lab testing in the United States. On its website, it has posted a notice of privacy practices under the Healthcare Insurance Portability and Accountability Act of 1996.

In addition to acknowledging that it may disclose protected health information (PHI) for treatment and healthcare operations, it will also may also disclose PHI to its business associates; to law enforcement for the identification of a suspect or victim of a crime; and to authorities for public health reasons.

LabCorp also reserves the right to anonymize patient information:

"De-identified Information and Limited Data Sets: LabCorp may use and disclose health information that has been 'de-identified' by removing certain identifiers making it unlikely that you could be identified. LabCorp also may disclose limited health information, contained in a 'limited data set'.  The limited data set does not contain any information that can directly identify you.  For example, a limited data set may include your city, county and zip code, but not your name or street address."

LabCorp states that it will consider requests by patients to limit the use and disclosure of their PHI. LabCorp honors requests by patients for a full accounting of all disclosures of their PHI over the past six years.

LabCorp also responds to individuals who ask to update their PHI.

FileNet

IBM's FileNet P8 is a platform for enterprise content management (ECM), which can easily scale to meet an organization's demands.

Lucene is used for indexing and searching. See the Tip of the Night for April 8, 2017. Documents are classified automatically in FileNet. Workplace is the user interface for FileNet.