Common procedures call for full backups to be made weekly, with the last tape of the month saved as a monthly backup. While weekly backups are normally rotated, monthly backups are saved anywhere from six months to several years. When collecting backup tapes in discovery, make sure to gather information on how the tapes were made. This inquiry must include both the procedures followed and the specific hardware and software used to make the backups. Data that has been selectively saved by users to diskettes or other portable media is another fertile, but often overlooked, source of evidence.
Users save data to diskettes for any number of reasons.
Finally, users will use diskettes to save data they do not want to keep on company computers. Diskettes are kept indefinitely by the users who create them. Collecting and examining all diskettes created by key witnesses is an essential step in a thorough examination of all electronic evidence. Ask every witness about computer usage. In addition to the discovery directed at the computer system, each witness must be questioned about his or her computer use.