Digital Forensics & eDiscovery Overview prepared for Charlotte ARMA Chapter September 20, 2007 Copyright © 2007 Document Technologies, Inc.

Digital Forensics & eDiscovery Overview

prepared for

Charlotte ARMA Chapter

September 20, 2007

Copyright © 2007 Document Technologies, Inc.

DTI | Discovery Solutions | Confidential 2

The Post 12/1/06 World

• New Federal rules governing discovery and production codified existing case law and changed the face of ‘document discovery’

• Shortened timeline for planning, discovery and production

• Significantly impacted ESI collection, processing, review and production

• Confirmed expansion of the scope of discovery and, consequently, reinforced significance of developing and adhering to comprehensive corporate record retention policies


Sources of Electronic Data


New Sources of ESI

• IM• VOIP• MP3 Storage Devices (iPods)• Memory sticks and flash drives• Global positioning systems • Blogs


EDD Page Counts

• 1 Megabyte (MB) will average around 75 pages• 1 Gigabyte (GB) will average around 75,000 pages• 1 Terabyte (TB) will average around 75,000,000 pages

• Email average 1-2 pages per each• Word Processing File average 5-8 pages per each• Spreadsheets average 15-30 pages per each• Presentation average 12-24 pages per each• Graphic average 1 page per each• Adobe PDF File average 35 pages per each

• Diskette 1.44 MB if full 50-150 pgs• Zip Disk 100 MB or 250 MB if full 7,500-18,750 pgs• CD 640 MB - 800 MB if full 48,000-64,000 pgs• DVD 4.7 GB - 17 GB if full 350,000 - 1.3 million• Tape Drive 2 GB - 360 GB if full 150,000 - 27 million• Hard Drive 20 GB and over if full 1.5 million and up


• Treat an attorney review like a production process– Predict cost & time– Cost of attorney review is always more than

document processing costs

• Have forensically defensible processes in place

• Rolling deliverables of data from vendor• Linear review vs. Non-Linear Review

EDD Workflow Best Practices


Think of document review…

as a manufacturing process

– Require progress reporting and production statistics

• How many documents per hour reviewed?• How long will it take to complete?• Which attorneys are reviewing above average

rates?

– Manage audit and quality control processes


• Adoption of the long-awaited federal rule changes

• Managing parent-child relationships

• Clarification on the role of metadata in litigation

• Communicating effectively with opposing parties

• Proper evidence handling procedures

• Processing volume is increasing

2007 EDD Trends


• Save Time and Money– De-Duplication Reduces File Review Time– Obtain Full Data Fields Without Coding Expense– 100% Accurate Text– Rapid Filtering and Searching– Produce and Share Tremendous Volumes of Information

Quickly

• Learn More– Extensive Meta-Data – Uncover Hidden Data and Comments – Show Tracked Changes

• Find Critical Information Early and Make Better Strategic Decisions

EDD Advantages


Small• Convert all• TIFF for blowback

• TIFF and data for online review

Large• Consulting and

collection• Multiple locations for

acquiring data• National, multi-party

review• Thorough plan in

place long before we see any data

Medium• Multi-pass review• Data only with

native files• Hosting• Searching /

filtering, production sets, etc.

Data Processing Scenarios


1. Prevent Spoliation2. Formulate Discovery Plan3. Limit Scope of Discovery Request4. Seek Cost Shifting5. Collect Documents6. Process Documents7. Review Documents8. Produce Documents

Responding to EDD Requests


• Develop a discovery response plan and standard spoliation letters to opposing party and to client in advance

• Implement spoliation plan upon occurrence or anticipation of litigation (suspend backup recycling and archive deletion, etc.)

• Make all parties aware of possible sanctions– Penalties– Adverse inferences– Preclusion from arguing issues

1. Prevent Spoliation


• Evaluate universe of media• Monitor and enhance spoliation prevention

measures• Determine method of review• Determine production format• Select parties to assist with process• Establish schedule for production process

2. Formulate a Discovery Plan


• Determine whether argument can be made that request is overbroad

• Determine whether argument can be made that request is unduly burdensome

• Suggest narrower/less burdensome alternative or alternatives to request

• Negotiate search protocol

3. Limit Scope of Production Request


• Analyze facts based on relevant case law– Rowe, UBS, Sedona Principles

• Availability from other resources

• Total cost vs. total at stake

• Resources of the parties

• Ability of and incentives for the parties to control costs

• Relative potential benefits

• Move for shift/share to requesting party • Argue in the alternative for narrowing the

request

4. Request Cost Shifting/Sharing


• Begin early

• Consider all relevant media & don’t forget the hard copy documents

• Maintain chain of custody and record of recovery procedures

• Never Conduct a “Home-Made” Review– Why approach electronic files differently than hard copies– Potential conflicts of interest– Lack of consistency or understanding of process– Risk of damage to data or documents– Don’t give opposing counsel a reason to put them on the stand– You don’t want to lose the case over this process

5. Collect Responsive Data / Documents


• Use litigation specific conversion software

• De-duplicate files

• Extract hidden information

• Cull Results by date and search terms

• Create combined database of hard copy and e-files for more powerful review

• Consider manual coding or auto-coding of paper document, particularly if present in volume

6. Process Electronic & Paper Documents


• Never work with original electronic document

• Use litigation-specific software to review– Ability to efficiently view native documents– Ability to easily tag issues, relevancy– Ability to redact privileged and confidential information– Ability to annotate important documents– Ability to share access with co-counsel

• Methodically track “review production”

• Electronically bates number production sets, not necessarily originals

7. Review Data and Documents


8. Produce Data and Documents

• Produce in the appropriate format– Closely monitor production to avoid unintended

disclosure of meta-data– TIFF or PDF images are preferable– Avoid producing native documents unless it provides

a substantial economic benefit

• Produce in timely manner

• Maintain comprehensive production history– What was produced, to whom and in response to

what


• Identify all potential data sources within the organization

• Issue notice to all appropriate employees to preserve all documents, including e-mail, relating to the matter after consulting with counsel on scope of litigation hold communications

• Identify someone to locate and gather the data in a manner that is forensically defensible!

• Inventory the resulting media and maintain chain-of-custody documentation

• Restore the data from backup media only after consulting counsel

• Convert, dedupe and cull the data prior to release for relevancy review by counsel

• Load the resulting data to a system specifically tailored for litigation-related document reviews

ESI Collection Checklist


1. Failing to Have a Data Collection Plan

2. Failing to Prioritize the Data

3. Neglecting to Conduct Thorough Interviews

4. Ignoring Key Data Locations & Important File Types

5. Conducting Do-It-Yourself Data Collection

6. Performing Ad Hoc Desk-side Collection

7. Failing to Mirror Image v. Imaging Excessively

8. Limiting Names

9. Assuming IT Can Manage on Their Own

10. Failing to Maintain Proper Chain of Custody

TOP 10 DATA COLLECTION PITFALLS


• Morgan Stanley Case

– “Failure to produce all e-mail attachments was negligent”

– Discovered & revealed by 3rd party vendor

– Led to jury awarding plaintiff over $1.45 billion

• Attachment handling procedures subject to increasing scrutiny

• Dynamic links between host email and attachments vital to effective document review and production

Dealing with Attachments to E-mail


• You cannot impose the paper practices on the ESI

• Redactions can’t be done to e-data except via images (TIFFs, PDFs)

• Document production are much more complicated with ESI-sourced documents. Plan, test and verify agreed upon production methodology

• Best Practice Tip: Rolling deliverables to manage the volume

Paper Versus Electronic Documents


eDiscovery Response Team


eDiscovery Workflow Plan - simplified


In Conclusion…

• Stick to your discovery response plan but be flexible

– Maximize planning and assessment

– Consider variety of options

– Apply proportionality assessment

• Continuing education– Track current technology trends

– Stay on top of legal developments

• Utilize technology and resources effectively– In-house resources (IT, legal staff, etc.)

– Vendors


• Courts are not afraid and, in fact, increasingly prone, to hold companies accountable for deficient discovery practices

• Courts consider electronic data a part of mainstream discovery & are unwilling to tolerate destruction of relevant information

• Counsel, organizations & individuals must take affirmative steps to prevent intentional and negligent spoliation

• Spoliation as a result of document mismanagement is now seldom, if ever, excused

And Remember ….