Former Litigation Support Manager and Industry Veteran, Jeff Steve, Boosts eClaris’ Internal Electronic Discovery Expertise

eClaris, Inc.today announced the addition of Jeff Steve to its eDiscovery team.  Steve joins eClaris as a Senior eDiscovery Consultant in its Los Angeles office and has 18 years of experience in litigation technology.  Litigation support managers will benefit directly from Steve’s seasoned experience helping AmLaw 200 law firms and Fortune 500 companies effectively manage the discovery of electronically stored information.    

As Senior eDiscovery Consultant, Steve is responsible for the growth and service of eClaris' network of customers and partners. He will promote the company's consulting and data management practices while providing essential input in shaping eClaris’ strategy in the eDiscovery marketplace. In Steve, litigation support personnel now have one of their own who understands their challenges and knows how to drive down the costs and risks associated with eDiscovery.

Prior to joining eClaris Steve worked extensively in litigation technology, most recently as West Coast Litigation Support Analyst at Seyfath Shaw.  In that capacity Steve consulted attorneys, staff and clients on current eDiscovery litigation technologies, project management and cost analysis.  Steve was also responsible for helping to design and implement firmwide support and infrastructure and managing vendors. 

Before Seyfarth Shaw Steve contributed to Sedgwick Detert Moran & Arnold in Los Angeles as Litigation Support Manager.  He was charged with setting up the firm-wide litigation support infrastructure and creating a Litigation Support Group of analysts.  As a member of the IT department, Steve helped design the network infrastructure to implement all of the litigation support applications that the firm adopted.  Steve has also acted as a private consultant for various law firms helping to set up electronic litigation support systems for review, production and trial support. 

“Jeff has a strong background in litigation and discovery that will serve our clientele, particularly litigation support managers, quite well as they leverage eClaris to manage their case load.  His litigation experience, technology expertise and eDiscovery acumen will be instrumental to eClaris’ success in broadening its reach and market share,” said Jacques Nack Ngue, CISA, Founder and President of eClaris, Inc. “We are delighted to welcome him to our team.”

"I am thrilled to develop and implement eClaris' new business development efforts and believe that my familiarity with this industry will indeed benefit our customer base," said Steve upon accepting the position. "In particular, I look forward to maximizing our innovative technologies and our consulting expertise to meet the evolving needs of our clients."

Steve is an active member of the Association of Litigation Support Professionals.

eClaris is pleased to be attending the 3rd annual eDiscovery Summit organized by the COALSP.  The symposium will take place on October 30, 2009 at the Grand Hyatt Hotel in Denver, Colorado.  eClaris looks forward to participating in this exciting educational seminar on electronic discovery and evidence with its dynamic set of speakers which include leading judges, attorneys and litigation support personnel.  To schedule a time to meet with eClaris at this conference please email service@eclaris.com and for more on the Colorado Association of Litigation Support Professionals eDiscovery Summit see http://www.coalsm.org/Ediscovery_Summit_2009.html 

The Seventh Circuit has adopted an ediscovery pilot program.  It's report is available here:  http://www.ca7.uscourts.gov/7thCircuit_ElectronicDiscovery.pdf and is well worth studying for guidance on how to handle ediscovery.  What makes this program unique is that it is actually being tested in trials:

"Individual district court judges,magistrate judges, and bankruptcy judges in the Seventh Circuit have agreed to adopt the Principles and implement them in selected cases during the Phase One period. This will be done through entry of the [Proposed] Standing Order by the participating judges in the selected cases.  Once adopted as standing orders, the Principles will serve as supplemental procedural guidelines to be followed by litigants. The Principles' efficacy will then be evaluated and refined. Phase One of the pilot project will occur from October 2009 to May 2010. The Institute for the Advancement of the American Legal System at the University of Denver is developing questionnaires to assess the efficacy of the Principles. Questionnaires will be completed by the participating judges and by the lawyers who practice before the judges. The results of the IAALS's questionnaires will be presented at the 7th Circuit Annual Meeting in  May 2010. In May 2010, the E-Discovery Committee will also evaluate the efficacy of the Principles and refine them as appropriate. Phase Two will then proceed from June 2010 to May 2011. In May 2011,the E-Discovery Committee will then formally present its findings and issue its final Principles." p. 12

 Identifying the problem with ediscovery the report note:

"Too often these exchanges begin with unhelpful demands for the preservation of all data, which often are followed by exhaustive lists of types of storage devices. Such generic demands lead to generic objections that similarly fail to identify specific issues concerning evidence preservation and discovery that could productively be discussed and resolved early in the case by agreement or order of the court. As a result, the parties often fail to focus on identifying specific sources of evidence that are likely to be sought in discovery but that may be problematic or unduly burdensome or costly to preserve or produce." p.9.

 The report attempts to clarify the specific steps to be taken to get cooperation from the attorneys, better define "inaccessible" data, apply a standard of proportionality, require appointment of an ediscovery liaison, and give specific suggestions for education of attorneys.

When I was a General Counsel, we started a policy in my company of retaining the hard drive of the employee.  In some cases we would also copy the email store from the server and the network share to a DVD and keep a copy.  This isn't something we started out doing, we had a couple of employees leave to work for competitors who we were pretty certain had taken our proprietary data when they left.  Once we experienced that, we realized that we would have been better off to have the original hard drive.  Forensic tools can capture whether data was copied onto an external drive, whether data was deleted, and can often recover deleted data.  If we had kept the hard drive, we would have been more able to substantiate our case that our intellectual property had been stolen.  Subsequently we kept the hard drives, and there were several instances over the next few years when referring back to them was useful, not just for purposes of potential litigation, but also to find records that were otherwise unavailable. 

If I were still the General Counsel I would change this policy slightly and instead of just keeping the hard drive I would keep a forensic image which I would store on a server in an archive.  I would do this for two reasons (a) hard drives can fail too easily if just put in storage, and (b) once an image is made I can review information from the image without damaging metadata or deleted data on the files. 

If a company does this, it also is smart to have the image made forensically, using forensic recordkeeping, write blockers and software in case it needs to be used in litigation.  That way there is less concern about authenticity or spoliation. 

Frequently when disputes arise with employees, one of the first things that happens is that IT looks at the computer.  This is a bull in a China shop approach that makes alterations to the data, and causes it to be looked at by technicians who are not trained in finding data.  It also could put the internal staff at risk of being called as witnesses.  Not all employees may be likely to steal data or bring lawsuits, so some companies may adopt a policy of imaging drives only for employees who have had access to critical data or who are likely to sue.  In my experience, the cost of keeping the data was small, and there were many times we were glad to have kept it.

What Attorneys Can Learn These Treacherous Topics to Strategically Prepare For Electronic Discovery

 

Electronic discovery (“eDiscovery”) is often perceived as a proverbial bottomless pit since the quantity and intricacy of electronic stored information (“ESI”) tends to be exponentially greater than paper records.  To compound matters further, with modern technologies the restoration of backup tapes are frequently deemed necessary to the ESI equation when preparing for litigation.  Although more often than not essential, backup tape restoration can be a thorny, costly and time-consuming portion of any case if not conducted properly.

 

Whatever could the complications be? 

 

Perhaps one’s client spent numerous years developing a plethora of backup tapes and counsel has a mere few days to pinpoint them and have them restored.  Or, once acquired, the restoration (gasp!) does not go as seamlessly as planned when some of the tapes are not labeled. Moreover, perchance and to further muddle matters, say the original hardware and software used to create the backup tapes is unavailable, since the client is now using a new, and purportedly better, backup technology.

 

The list goes on and on and….

 

Nevertheless, counsel can and must take stock when it comes to backup tapes, for if one exists and is relevant and accessible it may need to be restored and produced to the dreaded other side, if requested.   

 

Determining The Universe: What, Exactly, Does The Business Have?

 

Depending on the magnitude of the business, it may have personnel dedicated to the formation, restoration and oversight of its backup tapes. These staff members are an invaluable resource to begin obtaining key data about the company’s backup tape processes and a good resource to start with to find first-hand information about the backup-tape inventory.  They perhaps will be able, in addition, to procure some of the company’s historical backup tape dealings.  Most poignantly, however, these individuals would possibly be aware of any exceptions to the businesses backup tape protocols, both institutionalized and informal. 

 

That said, although evaluating backup tape procedure is a fine place to start, protocols will only point to some of the localities where the tapes may be found.  More often than not, there will be exceptions whereby backup tapes were created and maintained ‘outside the scope of the protocols’ for a variety of reasons.  For instance, special projects, firm restructuring, backup tape system upgrades and emergency measures are but a short list of the possible reasons why a business may have separate, distinct on-the-fly backup tape policies.  All ad hoc company backup tape policies are vital precisely since they were conceived beyond the business’ regular protocols and are likely to house exceptions from official company data recycling or deletion procedures.  Furthermore, backup tapes earmarked for destruction or deletion might have been omitted or otherwise misplaced and subsequently located at the business.

 

Next, while engaging company staff, as shown above, can provide fruitful results when locating and interrogating backup tape data, in order to verify any of the data, one must request staff to procure a report from the actual backup systems. Many backup tape systems will contain a recording snapshot of its own contents for archival purposes.  Some also will even contain an actual listing of the data files found on each and every particular backup tape.  Be on the lookout, in this instance, for recycled backup tapes which may or may not be marked with the time and date of the first backup.  Recycled backup tapes tend to merely have a distinct bar code for identifying purposed.  Contrast this inventory against whatever catalog information is provided from the backup tape systems to ascertain whether any inconsistencies arise.

 

An additional resource to confirm what backup tapes the business may own necessitates the engagement of business’ data storage vendor, if one exists. Even though a business might have, at first glance, what seems to be an immaculate inventory of the backup tapes it maintains, the vendor tasked with care for the tapes may have an added level of knowledge to contribute to the conversation.  An actual accounting of where the vendor’s storage facilities are located and how it conducts the backups is recommended.

 

Naturally, the time and wherewithal to take on the issues noted above will fluctuate from time to time.  Businesses must review each and every ounce of the backup tape data, as is possible.  However many sources interrogated, one should strive to contrast each source of backup tape data against the other to lessen the risk of losing valuable pieces of the puzzle. 

 

Establishing Backup Tape Date Ranges

 

A company’s technical personnel may backup information daily, weekly, monthly or even yearly.  The task here, to ensure consistency and data security, is determining how to verify the time periods noted on specific backup tapes.  To do so, one must ascertain the kind of server used to conduct the backups, any business protocols on point and how employees interpret them.  

 

What practical differences exist vis a vis company time records and particular backup tapes?

 

Reflect on the following.  Assume the business maintains that it conducts its tape backups on a yearly basis.  This does not necessarily mean it has on hand the entire year’s backup tape information on one tape, neither does a weekly tape backup scheme correlate with a single backup tape containing a month’s worth of data.  On the contrary, the majority of tape backups are merely pictures of the information at the instant the backup actually occurred.  Therefore, the description of a daily, weekly, monthly or even yearly tape is simply a depiction only of the time the backup was created. As an example, a monthly date may only indicate that the backup tape was created on November 30 and contains data that was on the company server as of that precise date.

 

Email is curious as well.  User A might have a practice of erasing all email each day while User B might save emails for a month. Depending on the business’ server used to store company email, only one day’s email may be pinpointed for recovery if the monthly tape is retrieved for User A, but multiple years of email may be refurbished for User B.

 

To help combat this email and other similar conundrums, some businesses set restrictions on their backup tape servers to circumvent running out of available server storage space. Perhaps the two most popular modes for these limitations are date and volume.  The former is most useful in comprehending what date ranges the backup tape actually covers. Should a business have a date limitation in place that will allow it to store company emails only from the preceding seven days then all email from day one may be erased on the eighth day.  Electronic messages from day two are then nixed on day nine and so on and so forth.  This also means that one can deduce that the snapshot of the email messages located on the backup tape contains seven days of email.

 

Tick, Tock -- Time Considerations When Reinstating Backup Tapes

 

While bygone backup tape technologies are naturally sluggish when pitted against modern alternatives, there are a variety of additional factors to ponder when seeking to calibrate the quantity of time needed to refurbish a backup tape.  Painting with a broad brush, one should consider the average file size, the type of the backup tape used, how much capacity the backup tape has and what type of restoration hardware was in play.

 

Time can also be of the essence.  When racing against the clock the restoration of an email server backup tape where all stored information was located in one file may take about five hours to complete. The exact same backup tape configuration with multiple broken up smaller files from a company backup tape file server may take an even longer amount of time to restore.  Why?  Additional granularity is required.  When approximating the amount of time needed to reinstate multiple tapes one should refurbish one tape from each tape subset, and then extrapolate that quantity of time by the overall volume of diverse backup tapes to be reinstated.

 

Backup Tape Disaster Preparedness and Recovery Best Practices

Many law firms and corporations nowadays have legitimate backup tape recovery plans firmly rooted in place.  However, only a select few practically meet the needs of the company, specifically when it comes to delivering on time.  Crafting a backup tape disaster recovery plan that can be implemented at any point of time is of paramount importance since the potential of unknown and unforeseeable natural disaster or criminal activity may be lurking just around the corner for the company to abruptly face.

Vital to any modern backup tape disaster recovery plan is simple timing.  They are the backup itself and precise replication. Backup tape disaster recovery plans, similar to any other tech department endeavor, contend with the myriad of other assignments on any company IT department’s master agenda.  Thus the first step is making the construction of a backup tape system that can serve as a dependable doomsday disaster data repository, a top priority. 

A recurrent pitfall in backup tape disaster recovery planning is the assumption that the responsibility for the construction and implementation of these plans falls squarely, and solely, on the shoulders of the company’s information technology department.  Although disaster recovery is clearly a technology department consideration, in actuality this topic must be classified as a company stability proposition.  This is because disaster recovery measure, which means that while very much a technology concern, it is an issue has the ability to shape the business’ very existence. Therefore, all segments of a company’s upper management must be involved to understand what the plan, and its budgetary implications, means to their specific department and how to appropriately respond and contribute.   

The resources necessary for the construction of backup tape disaster plans used to be something that was reliant upon means unattainable to many companies, such as secondary or even primary backup data centers. Nonetheless, these plans can become more realistic for medium and smaller firms by renting room for its hardware at a reputable network services provider. In addition, further progress has occurred in software that now allows medium and smaller businesses to better maximize their in-house resources to allow for far more vigorous backup tape disaster plans than formerly thought to be possible.

Conclusion

 

With the crippling sanctions imposed by the Zubulake, Wachtel and Morgan Stanley as to abuses of the discovery processes as they relate to creation and handling of backup tapes, there has been renewed emphasis on the necessity to supervise these facets of information management with greater alacrity and zest.  Some businesses are shying away from backup tapes as a model and are opting for newer, quicker data recovery technologies.  Yet, the majority of businesses have marched on with their backup tape systems and disaster recovery protocols with enhanced internal protocols for the inception and handling of the backup tapes. In either case, one thing is for certain.  Businesses - now and in the future - will need to grapple with how to approach their backup tape systems before, during and after litigation hits. 

 

This article was published in the Fall 2009 Technology for the Litigator Newsletter which is put out by the American Bar Association.

A simple but confounding problem with native file productions is the challenge of reading files in formats for which the receiving party does not have the native software.  This can involve extracting word processing documents from old or obsolete programs like DOS Wordstar or obtaining tables from a database created in Oracle or uncovering layers in a picture created in Photoshop.  There are a number of ways in which this information can be reviewed without the necessity of purchasing or finding a copy of the original software.

1.  Software that can Read ASCII

Just about any forensics software (for example Encase or FTK) , or ediscovery processing software (for example Law or Nuix) , or hex editor can interpret ascii text and make it readable as text.  The content of most email messages and word processing documents can be read as ascii text.  The disadvantage of this approach is that the original formatting of the underlying document will be lost, but most of the time the content is where the evidence is located. 

2.  Viewers

There are a number of file viewing applications, examples are Hijaak and Evince.  Hijaak was developed primarily to view various graphic formats.  Evince is an open source program developed to read various document formats.  One of the most powerful viewers is Outside In technology which is available from Oracle as a developer kit and incorporated by software vendors into their products.  Outside In is incorporated into recent versions of Encase.  Thus, a forensic analyst reviewing a document in encase can view and carve out if necessary documents in any of the 500 plus formats supported by Outside In. 

3.      Installs from Original Image

Often people download software and store the original install image somewhere on their hard drive.  Many companies keep their corporate install images located on the corporate servers.  If an analyst obtains the original install image from the server or the original disk, then the software can be installed on the computer being used for review.

4.   Quasi Native Format

Another option is to covert the file into a format that is readable and equivalent as part of the ediscovery processing.  This mostly applies to databases and spreadsheets.  Thus if data is produced in an Oracle format, it may be possible to convert it into an Access database.  Similarly, if data is in spreadsheet format, it may be translatable to a different spreadsheet or convertible into comma delimited format.

5.  Open Source and Freeware Alternatives

There are open source and freeware alternatives to the alternative product.  Open Office is widely known example.  Microsoft Office documents can be read by the Open Office software, which is available for free.  Another very useful open source program is Gimp.  Gimp is a Photoshop clone.  If one needs to review a document created in Adobe Photoshop and needs to unpeel layers in the photo, it isn’t necessary to purchase Photoshop, the photoshop layers can be revealed by opening the document in Gimp.

 

 

 

The question has come up several times recently whether it is necessary to file for a protective order when objecting to the discovery of not inaccessible data.  When I looked at the MCLE presentation that we do from Eclaris, I saw that our presentation on this point is ambiguous. To make clear, the current rule does not require a protective order in order to preserve an objection:

 "2031.210(d) If a party objects to the discovery of electronically stored information on the grounds that it is from a source that is not reasonably accessible because of undue burden or expense and that the responding party will not search the source in the absence of an agreement with the demanding party or court order, the responding party shall identify in its response the types or categories of sources of electronically stored information that it asserts are not reasonably accessible. By objecting and identifying information of a type or category of source or sources that are not reasonably accessible, the responding party preserves any objections it may have relating to that electronically stored information."

The current confusion in California seems to arise because an earlier version of the edisovery law, which was vetoed by Governor Schwarzenegger, would have required a protective order (it was vetoed for unrelated reason when the Governor was vetoing everything due to a budget dispute).  In her blog at FIOS (http://www.discoveryresources.org/library/case-law-and-rules/ca-new-rules-inaccessible-protective-order-gone/), Mary Mack has clarified this point.  The confusion created by the earlier version and subsequent change, seems to be fairly widespread.

 Fortunately, reason (and someone's experience) prevailed in the final bill.  It is now clear that in objecting what is needed is to identify the type or category of source or sources that are asserted to be not reasonably accessible.  This should suffice to preserve the objection.

 

 

 

 

Why does California do things differently?  This is intended as a rhetorical question.  Looking at the California Ediscovery Law reminds me of the California Solid Waste Law and its relationship of the Resource Conservation and Recovery Act (RCRA).  The Federal Government passed a law setting out how to handle solid waste, and virtually every state adopted the federal regulations with minor modifications.  Except for California.  This was a bit of a historical accident in that California's solid waste law preceded RCRA.  However it meant that the cost of complying was more expensive in California, since you needed to learn two regulatory schemes, and I also found that enforcement in California was weak because there were more resources in Sacramento devoted to writing and amending the law than there were to enforcing it.  I have often said, at least somewhat tongue in cheek, that California could balance it's budget if it would conform its laws to the majority of the states.

 Now we get a California ediscovery act that (a) is written in its own terms with its own structure so it doesn't track the federal rules, and (b) appears to make some changes that may or may not be real - maybe or maybe not the definition of electronic media is broader - arguably deleted files or active memory are more likely to be required to be produced in California, (c) follows a different procedure (perhaps) as meet and confer may be required by local courts but form of meet and confer might be different, and (d) seems to shift the burden of proof that data is not reasonably accessible and probably shifts the cost sharing burden.  The result is that in an area of the law where there is already significant confusion and a big learning curve, California has managed to pass a law that will appears to add more confusion.  So why do we have to do things differently?

eClaris' Founder and President to speak on Electronic Discovery at this year's DOCUMENT Strategy Forum Conference at the Hyatt Regency O'Hare.

Our session is scheduled from 12:00-12:45 on Tuesday October 6. 

http://www.documentstrategyforum.com/index.html

We look forward to seeing you in Chicago!