Chapter 7 - Data Structures and the Anatomy of a File

Abstract

This chapter focuses on different data structures, and it describes data structures and associated file components. Understanding data structures and the anatomy of a file can provide insight regarding the types of questions one should ask during the e-discovery process, and it can provide guidance to team when it is preserving, collecting, processing, or producing data. A critical distinction to make when analyzing files is whether the data contained in the files is in a structured or unstructured format. In a structured data file, a container or template defines how the data within the file is arranged so that a computer can use it efficiently. An unstructured data file lacks this container or template and, thus, this efficient organization of data. Examples of unstructured data files include word processing documents, spreadsheets, presentations, and individual e-mail messages. Although it is common to analyze information residing within a database to determine whether information there has been altered or removed, ultimately the focus of e-discovery is on unstructured data. Files contain two types of information that might be critical in the e-discovery process: external data (the card catalog), and internal data (the book itself). Understanding of the environment in which electronic information exists is a critical first step toward ensuring that file integrity (the preservation of data, and any structure, within a file) is maintained. By ensuring that a file's integrity remains intact, one can reduce the avenues for others to attack his or her work. By understanding the basic principles of file signatures and hashing, encryption, and compression, one is armed with the information necessary to begin working through these complex situations.