Storage media is a common term found throughout both forensic and eDiscovery matters. It is generally used to describe devices that store electronic documents, application data or user information. Modern computers and laptops typically have an internal hard drive (HDD) or solid state drive (SSD). These drives are used by the computer to store the operating system, installed applications, user data and anything the user saves to the computer. Another common storage media type is removable media such as thumb drives, external hard drives, CDs and DVDs. This type of storage media is generally used when data needs to be transferred from one system to another. They commonly store electronic documents, archives, and system backups.
How is storage media relevant to a forensic investigation?
Removable storage devices are frequently a primary point of interest in forensic investigations pertaining to departed employees and suspected data theft. Computers maintain a record of storage media that has been connected to them. Forensic investigations can determine if storage media has been connected to the computer, timing of the connection and what specific device was connected. In addition, forensic experts can review what data was accessed while the removable storage device was attached. Analysis of these records commonly leads to the conclusion that the removable storage media should be investigated as well, to determine if data relevant to the litigation was indeed transferred to that device.