Litigation Support Tip of the Night

October 18, 2019

Windows 10 and earlier versions of Windows include Windows File Protection, which helps to prevent the corruption of system files.  When protected files change directories, Windows File Protection (working in the background) will check the file against a file signature catalog.   A cache of backup files is kept at C:\Windows\System32\dllcache.   Bad system files will be replaced. 

If you run the command: 

sfc /scannow

 . . . in the System32 folder, the utility System File Checker will perform a comprehensive search for any corrupted system files and replace any it finds with the backups stored in the cache folder. 

September 1, 2019

Microsoft has a free application for Windows which you can use to test your network speed.  Network Speed Test can be downloaded for free here

The application will calculate both the download and the upload speeds.   It will give you information on the network delay as well.   This is how long it takes data to travel across a network.  It may also be called the ping value.  It is a measurement of how long it takes for feedback from a web server to be sent back to a computer.   High network delay will cause online software to function slowly.  If you have network delay of less than 20 milliseconds actions taken in an online application should appear instantaneous.  With ping values of higher than 200 milliseconds, there will be a lag between keystrokes and mouse movements, and when a result is shown on the screen. 

August 24, 2019

Microsoft has posted some information about the usefulness of data deduplication on Windows servers.   Data deduplication is particularly useful for file shares; virtual desktops; ISO images (disk image of optical discs); and backup snapshots.   Microsoft estimates that an average of almost 50% of storage space can be saved on servers using data deduplication.   

An admin can select a simple option for data deduplication in Server Manager: 

After deduplication is performed, users and their applications will not have any notice that duplicate files have been removed.   The deduplication process works by breaking files into chunks and identifying which of those chunks are unique.   

In optimization  original 'file streams' are replaced with reparse points that indicate which file chunks should be used. 

The garbage collection process removes chunks that are no longer needed after files have been modified or deleted.   Integrity scrubbing can be employed when files are corrupted in the chunk store.  Backup copies are made of chunks which are used more than 100 times. 

August 15, 2019

In Windows 10, if inking and typing personalization is selected under privacy settings, words added to a spelling dictionary will be saved in a file located in the AppData folder. 

The file path should be  C:\Users\[UserName]\AppData\Roaming\Microsoft\Spelling\en-US

The file named 'default.dic' will contain words the user adds.  The file named 'default.exc' lists the words that have been excluded from the dictionary.   'default.acl' is an autocorrect list. 

These files work with modern apps and Internet Explorer, but not the standard MS Office suite.  

August 13, 2019

You can still upgrade to Windows 10 for free.  Windows will end support for Windows 7 on January 14, 2020.  See the 'Download' link on this page for Media Creation Tool.   You can save this tool to the computer you're upgrading, or save it on a removable drive to use on a different device. 

The files saved on and the software installed with a Windows 7 or Windows 8 operating system will not necessarily be removed, but third party programs may be uninstalled without notice.  Drivers may also be eliminated, and will have to be updated for Windows 10.   An upgrade from Windows Vista or Windows XP will delete any old files or programs.  

An installation wizard will guide you through the upgrade process

You will be prompted to indicate if you want to keep your personal files and applications. 

I’m performing the upgrade tonight.  It requires several reboots. I’ll let you know if it’s successful. 

You may wish to use a service like Zinstall to perform the ugrade and ensure that none of your files are lost. 

July 28, 2019

Dump files, with the extension .dmp, are often created when an application crashes and can contain information about why the crash occurred and what programs were running at the time of the crash.   A memory dump file can hold all of the data in physical memory at the time of crash in Windows.  The Debug Diagnostic Analysis tool comes installed with Windows.  It can help you analyze .dmp files.   

You can select individual dump files and run a memory or performance analysis on the files. 

The tool will generate a report as a .mht file that can be viewed in a web browser.   

July 3, 2019

In Windows,  the System File Check utility may generate multiple log files of 1 GB or more that can run down the free space on your hard drive.  These System File Check log files are generated by repair operations, and are useful for reviewing corruptions to Windows system files.  If you need to free up space, you can safely delete these files.  Look for them at C:\Windows\Logs\CBS.   

CBS stands for Compression Based Servicing. 

The views expressed in these posts are those of the owner and do not reflect the views or opinions of the owner’s employer. All content provided on this page is for informational purposes only. The owner makes no representations as to the accuracy or completeness of any information on this site or found by following any link on this site. The owner will not be liable for any errors or omissions in this information nor for the availability of this information. The owner will not be liable for any losses, injuries, or damages from the display or use of this information. This policy is subject to change at any time. The owner is not an attorney, and nothing posted on this site should be construed as legal advice. Litigation Support Tip of the Night does not provide confirmation that any e-discovery technique or conduct is compliant with legal, regulatory, contractual or ethical requirements.  

June 25, 2019

You can set Windows to permanently delete files by selecting an option in the Recycle Bin properties. 

June 19, 2019

Windows 10 includes an enhanced clipboard that allows users to store a history of multiple text strings or photos copied to the clipboard.  If this feature is enabled it can be an important consideration in a forensic examination of a computer.   

June 11, 2019

In Explorer in Windows 10, if you add 'Copy path' to the Quick Access toolbar, you will be able to copy the full file path of any selected file  to the clipboard by pressing ALT + 3. 

Please reload

Please reload

Sean O'Shea has more than 15 years of experience in the litigation support field with major law firms in New York and San Francisco.   He is an ACEDS Certified eDiscovery Specialist and a Relativity Certified Administrator.

The views expressed in this blog are those of the owner and do not reflect the views or opinions of the owner’s employer.

 

All content provided on this blog is for informational purposes only. The owner of this blog makes no representations as to the accuracy or completeness of any information on this site or found by following any link on this site. The owner will not be liable for any errors or omissions in this information nor for the availability of this information. The owner will not be liable for any losses, injuries, or damages from the display or use of this information.

 

This policy is subject to change at any time.