Robocopy

When you copy data from a hard drive on to a flash drive or other storage device, normally you'll notice the meta data for the file is altered. Instead of the date created on the source, you end up with the current time & date at the point of transfer. For the purposes of data collection you want to preserve the original meta data values intact. In order accomplish this, make use of the Robocopy command in Windows.

You just need to go to the folder you want to copy data from, press SHFT + CTRL + Right click and choose 'Open Command Window Here' , and then enter the file path of the folder from which data is to be collected (use quotes if the path has spaces), the path of the destination, and forward slash 'E'. See for example this command:

I:\Litigation Support\Electronic Discovery\EDRM>Robocopy "I:\Litigation Support\ Electronic Discovery\EDRM" H:\ /E

So when we collect data from a folder like this:

. . . and run the Robocopy command - 'Robust File Copy for Windows' . . . the data is copied in a special fashion

. . . so the Date Created field is not altered.

#Datacollection #Robocopy

Junction Points

Certain folders in Windows can't be accessed even through you have full administrative rights to them. These may be junction points. Junction points differ from ordinary link (.lnk) shortcut files in that they only allow for a folder to point to a local file, not a shared network folder, and clicking on them won't bring you to a different location. You will just get an access denied message, and there will be a small lock on the folder icon.

One of the purposes of junction points is to make older software work in Windows, after the folder struture has changed. Windows 7 contains a junction point at, C:\Documents and Settings that points points to C:\Users. Don't be thrown off by junction points when performing data collection.

#junctionpoints #litigationsupport #datacollection #cdocumentsandsettings