<b><i>Product Review:</b></i> Wave Software Enhances Its Trident Suite

Trident Pro's version 4.5 offers de-NISTing and new de-duplicating features. Let's talk about de-NISTing. What is it? De-NISTing is the process whereby an application uses published hash sets to identify system files and other ignorable files. Why is de-NISTing important? More frequently these days, entire hard drives are being forensically collected, preserved and processed. While this approach is a good one because it preserves all the data as it existed during the regular course of business and at a specific period in time, it also preserves all the operating system files. With operating system and other ignorable files often taking up approximately 65%-85% of a hard drive's active data, it is essential to identify and exclude these ignorable files as early into the process as is feasible. The National Institute of Standards and Technology ('NIST') publishes a quarterly update of known system and ignorable file hashes. This quarterly update is the product of the National Software Reference Library ('NSRL') and is freely downloadable from www. nsrl.nist.gov/Downloads.htm. So, why not just tell your electronic discovery vendor to ignore files with a .dll or .exe or other system file extension? It is very easy for a user to hide data by changing the file extension of an incriminating document to .dll or .exe and storing it in a program folder. Unfortunately, in an attempt to save time and money, these system file or program file folders are ignored. Trident Pro version 4.5 now allows the electronic discovery professional to defensibly exclude files based upon MD5 and SHA hashes of known system files, which are published by the NIST.