eDiscovery Daily Blog
You Don’t Have to Be Rich to Use Richcopy – eDiscovery Best Practices
A couple of weeks ago, we discussed the pitfalls of using drag and drop for collecting files for eDiscovery and illustrated an example using a blog post that I wrote about a month ago in a Word document for the post Five Common Myths About Predictive Coding. If you followed the steps along with one of your own files, you noticed that the resulting file appeared to have been modified before it was created, which reflects spoliation of the metadata during the copy process.
Last week, we discussed the benefits of Robocopy, how to access it via the command line prompt (if you have Windows Vista or later) and how to get it (if you don’t). Then, we performed an example copy (using an Excel script I use to create the copy) and took a look at the results to show how the date metadata was preserved during the copy. If you’d still like a copy of the Excel Robocopy script, feel free to request it by emailing me at daustin@cloudnincloudnine.comm.
If you want to be able to perform a forensically sound targeted collection, but would prefer a GUI based tool for performing the copy (instead of a command-line tool like Robocopy), then perhaps you should consider Richcopy. RichCopy is a free computer utility program developed by Ken Tamaru of Microsoft to copy file directories. It has some advantages, but also some pitfalls, to consider as a targeted copy and collection tool.
One of the benefits of Richcopy (in addition to the GUI interface) is that it copies several files simultaneously (“multi-threaded”), which can drastically reduce the time required for multi-gigabyte file copy operations (earlier versions of Robocopy didn’t support multi-threaded copying, but the current one does, with the /MT[:n] command).
Unfortunately, Richcopy has not been updated in nearly four years by the developer, so you may run into issues (for example, it apparently doesn’t handle file names longer than 255 characters) and, as a free utility, it’s not supported by Microsoft. Also, Help doesn’t open up throughout much of the application, so getting additional information from the help file is not always easy. Consider yourself warned.
You can download a copy of Richcopy from the link in this TechNet magazine article. I did so, and performed the same copy of the Word document for the post Five Common Myths About Predictive Coding that I performed in the other cases. Let’s see how Richcopy handled that file copy.
You’ll see below that the main form of Richcopy provides the ability to select the source and destination paths, and specify options (as indicated by the red box). Once you have the parameters set, click the green “Go” button (as indicated by the red circle) to perform the copy. Progress and logging information will appear in the two status windows below.
The Options button opens a dialog for specifying a variety of options, including copy parameters, thread counts, file attributes and error handling, files to be included and/or excluded (by name, extension or attributes, such as excluding system files) and logging. As you’ll see below, I set the “files to be included” option to copy the example file I’ve been using in the other tests.
The result? I did get a copy of the selected file which contained preserved file metadata (i.e., the Created date and the Accessed date reflect the original date and time when the file was created and last accessed). However, it also copied empty folder for all of the folders underneath the source folder. I couldn’t figure out how to turn it off and the aforementioned Help file issues didn’t enable me to identify a workaround.
If you absolutely require a GUI interface for free targeted file collection, Richcopy may be a better alternative than Robocopy, but not necessarily the best alternative. Next week, we’ll begin discussing another free GUI alternative that not only supports targeted collection of files, but also supports bit-by-bit imaging to capture deleted files and slack space data!
So, what do you think? Have you used Richcopy as a mechanism for eDiscovery collection? Please share any comments you might have or if you’d like to know more about a particular topic.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.