At the end of the day, but before advising attorneys and staff on the best solutions to handle their discovery demands, the ultimate question is, “How much will this cost?” Litigation has always been a cost/risk assessment question. Attorneys look at the claims and the facts of the case presented in order to make a determination of how much money it is worth spending defending the matter before them. The level of risk dictates every aspect of the case.

If a claimant is seeking $10,000 in damages, the cost an attorney is willing to spend defending the claim is going to be rather small; in most cases. If a claimant is seeking $1,000,000 in damages with the possibility of punitive damages on top of that and if the case looks very favorable in light of the risk assessment, then the budget to defend will increase. If the facts present a poor case for the defense, then the budget for the $1,000,000 case is going to shrink.

This is an important backdrop to understand for the Litigation Support Manager before advising their attorneys and staff on the best solutions for litigation support for a given case especially when the case involves electronically stored information (ESI). Understanding this leads to better communication. Better communication leads to better budgeting.

Discussion will often times center on the discovery demand itself and the budget gets lost in the talk. When the budget gets lost and the monthly cost bill is being prepared, all too often the Litigation Support Department gets called into question. Why? Internal law firm litigation support costs are not always accepted as a legitimate cost that can be passed on to the client and equally important is that attorneys are in the dark as to how much it costs to handle the electronic discovery portion of the case.

In my early career, I would all too often be brought into a discussion to answer, “What should we do?”, or “How should we best handle this request?” I would give my advice, proceed to perform the tasks agreed upon, and then present the outside vendor bill and my hours to the attorneys. Sometimes my hours would be written off to the client and the vendor bill would languish forever on someone’s desk and I would have to answer the vendor’s request for payment. Other times, I would be called in to explain the bill. I would say, “You asked me to perform this task and I did.” The attorneys would answer back with, “I had no idea how much this was going to cost.” Why? Budget was not brought up during the discussions.

After these type of experiences, I have made it a point when asked to handle the processing of ESI to run initial cost analysis even if I am not asked to. I do this, because I know that the issue is too important to ignore and unless I raise it, it may never be asked until it is too late. There are other times where I have had experiences, as many of us have, where I hear about a partner or associate calling up a vendor, independent of talking to me, to print out all the emails from a 1 GB PST file so they could review the documents in hard copy. One month and 100 billable hours later, I find out about it. I explain to the attorney that had they sought my advice in the beginning they could have saved about $2,500 in upfront processing costs and about 90 billable hours to the client in review time. I would get sheepish grins, or sometimes very red faces.

Today, many Litigation Support Managers use a formula-based spreadsheet to calculate the cost of handling ESI and other litigation support tasks. This has grown into a very powerful tool to help communicate the cost impacts of pursuing a certain line of litigation support to attorneys. It is also a very powerful tool that Litigation Support Managers can use to evaluate offerings among a variety of support vendors. Whether it’s formulae in spreadsheets, or budgeting software, the goal is to provide information to the litigation team early on so they can factor in the price of handling ESI into the cost analysis of defending their case.

There are several ways that Litigation Support Managers can better interface with the litigation team to ensure that budgeting goals are achieved when a case involves ESI.

1. Integrate the Litigation Support department with the legal department rather than have it stand as a separate entity. Often times, Litigation Support exists as a separate department just as IT. The role of Litigation Support spans across both legal and IT, but in practical terms Litigation Support serves to increase the ability to effectively handle the discovery and trial presentation aspects of the case; a legal function. Bringing Litigation Support directly into the legal department immediately enhances the quality of communication.

2. Initiate discussions early on concerning cost with the litigation team handling the case. All too often a case team meets with Litigation Support weeks after receiving a case and about half way through the discovery process to discuss budget. This is often too late in the process to be helpful and often ends up costing the client more. Early talk about costs can have a profound impact on early case negotiations depending on the volume of data to be processed.

3. Use budget tools to help calculate costs. Formulae based spreadsheets, or budgeting software can drastically increase the accuracy of the electronic discovery budget for Litigation Support. It is important to factor in not only the amount of data to process, but also the impact that amount of data has on the review time. The greater the amount of data to review, the greater the cost to review is going to be. Budgetary tools also force the entire team to get to know that data.

4. Immediately notify the litigation team anything that might affect the budget throughout the lifecycle of the case. Often the volume of data or the complexity of the data will increase the cost of the case. Litigation budgets are based on assumptions. As the case proceeds, hard facts gathered through the discovery process impact these assumptions.

In conclusion, the best defense is the best offense. Start the communication on cost of e-Discovery as early as possible with your case team. This will trigger a more thorough discussion of risk assessment of engaging in defense of a case. Your input on the budgetary considerations of e-Discovery can have a dramatic influence how the case is litigated.

Jeff Steve, Esq., is based on Los Angeles, California where he works for eClairs, Inc., an e-Discovery and computer forensic consultancy and service provider dedicated to helping law firms and corporations classify, process and review electronically stored data. Jeff has over 18 years of experience in litigation technology. He can be reached at +1.213.270.1465, jsteve@eclaris.com or through www.eclaris.com.

NB: This article appears in the January 2010 issue of the Association of Litigation Support Professionals

 

The Federal Courts adopted amendments to the Federal Rules of Civil Procedure in 2006.  Among the reasons for adoption of the Federal Amendments was that “[w]ithout national rules adequate to address the issues raised by electronic discovery, a patchwork of rules and requirements is likely to develop. See Report of May 27, 2005, as revised July 25, 2005 (the “Advisory Committee Report), at 23, available at http://www.uscourts.gov/rules/Reports/ST09-2005.pdf.  Yet, while the Federal Rules approach to ediscovery does provide guidance, there remains a patchwork of requirements and in many cases an absence of requirements at the state level.  As of September 2009, 23 states have enacted state ediscovery rules. ( Alaska, Arizona, California, Idaho, Indiana, Iowa, Kansas, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Montana, Nebraska, New Hampshire, New Jersey, North Dakota, Ohio, Tennessee, Texas, Utah and Virginia. See, Allman, Thomas Y., State E-Discovery Rulemaking after the 2006 Federal Amendments: An Update (as of September 2, 2009) Available at http://www.ediscoverylaw.com/uploads/file/State%20Rulemaking%20-%20Allman.pdf.  Each of those states takes a slightly different approach; some follow the Federal Rules almost verbatim and others, like California, follow the federal structure but in quite different terms.

There have also been attempts to develop uniform rules for ediscovery.  In August of 2007, the National Conference of Commissioners of Uniform State Laws ("NCCUSL"), best known as the author of the Uniform Commercial Code, approved the Uniform Rules Relating to the Discovery of Electronically Available information.  Available at http://www.law.upenn.edu/bll/archives/ulc/udoera/2007_final.htm. The result is that there are federal rules, various state rules, court guidelines and proposed uniform rules.  Thus in practice, there is a patchwork which is further complicated by the presence of many specific local rules.  In those states which lack explicit electronic discovery rules, attorneys are often left searching for guidance because so few discovery issues become the subject of printed appellate decisions.  Attorneys who become familiar with the federal rules are often perplexed about how to approach ediscovery in the state trial courts.  This article will provide some practical suggestions for handling ediscovery at the state level, particularly in those jurisdictions where rules are absent.  In essence it will conclude that the procedures which have become best practices at the federal level follow logically from the nature of the evidence itself, and the principles apply to all electronic discovery at the federal and state level.

Identifying Electronically Stored information (“ESI”).  ESI is essentially any information created or stored in digital form.  Some state rules, such as those in California, provide specific definitions, but as a general way to identify ESI, anything that is on a computer, or storage drive, or cell phone, or hard drive, or an mp3 player for example is ESI.  ESI presents unique challenges for several reasons: it is dynamic (constantly changing), voluminous, requires special software and tools to render it meaningful, and ESI contains metadata (data about the data). 

The first challenge for the attorney is identifying the locations of the ESI, and determining if there are any special challenges with respect to their evidence.  Is it so voluminous that some tool is required to cull the volume?  Is it in a form, such as backup tapes, that may be difficult and costly to process?  Is there metadata that is relevant to this case that may need to be preserved?  The attorney will find it useful to interview the client, communicate with the IT staff, and possibly to retain an outside ediscovery expert to prepare a data map. 

Communicate with Opposing Counsel.  The Federal Rules take an approach that attorneys should “meet and confer” to discuss the handling of ESI.  Not all states specifically require “meet and confer” with respect to ESI, and many states do not include a formal “meet and confer” for discovery generally.  Attorneys need to check the specific requirements of the local rules.  Regardless of the specific requirements resolution of a few questions between opposing counsel early in the litigation will potentially keep the ediscovery process and costs under control.  These issues are reaching agreement on the form of production and handling inadvertent production of privileged or confidential information. 

Form of production refers to whether the discovery will be made in the form of native files, quasi-paper– such as Tiff images, or paper form.  This can make a big difference in the ease and cost of review.  If an attorney wants to review in Concordance or Summation, the attorney will probably prefer Concordance or Summation load files, or at least to get the information in some electronic format.  Each attorney needs to understand the implications of the format for his or her case, and both parties need to be clear that each understands the other’s expectations.  These simple decisions, when made at the beginning of a case, can be instrumental in keeping discovery manageable.

Handling inadvertent production comes from the sheer volume of documents.  When there is a high volume case, much of the culling and first round of document elimination needs to be automated.  Sometimes, even when great care is taken, documents slip through.  It’s important to understand the state rules regarding quick peek, claw back or other methods that might allow some protection in the event of inadvertent production.  Many issues can be avoided by counsel agreeing, within the discovery rules applicable in their state, to a procedure for handling inadvertent production.

Consider Witnesses and Witness Preparation for Document Production.  One aspect of ediscovery cases that has led to many spoliation claims is a poor showing by a 30(b) (6) witness testifying about the document production.  Even where state rules do not specifically provide for an electronic discovery witness, there will still be provision for a “keeper of records” or “person most knowledgeable” witness.  Consider while collecting the documents who from the company, or if necessary which consultant, can best speak to the process.  When deposing the opposition witness, take the time to prepare with an IT person or consultant to get the best understanding of the electronic record preservation process.

Preservation of Evidence.  Once litigation is reasonably anticipated, often with the filing of a complaint, parties have an obligation to preserve evidence.  Usually counsel identifies potential custodians and sends a litigation hold letter.  Sometimes, and often advisably, key information is collected at the outset as collection can be the best method of preservation.  Counsel also needs to be aware of document retention and destruction policies that a client may have, and to suspend the operation of those policies for the duration of the litigation if necessary to preserve evidence.

Cost Shifting.  In those instances where ESI is deemed “inaccessible” the cases have allowed for some shifting of the cost of locating, collecting and processing the documents.  The standards actually vary some from state to state.  The most frequently cited precedent is of the Zubulake cases.

In Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 317-18 (S.D.N.Y. 2003) (Zubulake I), Judge Scheindlin suggested a seven-factor test for determining whether cost-shifting should occur:

(1) The extent to which the request is specifically tailored to discover relevant information;

(2) The availability of such information from other sources;

(3) The total cost of production compared to the amount in controversy;

(4) The total cost of production compared to the resources available to each party;

(5) The relative ability of each party to control costs and its incentive to do so;

(6) The importance of the issue at stake in the litigation and;

(7) The relative benefits to the parties of obtaining the information.

These are very fact specific and in Zubulake III, Zubulake v. UBS Warburg, 217 F.R.D. 309 (S.D.N.Y. 2003) Judge Scheindlin applied these factors to the facts in that case.  After there had first been a sampling of some of the backup tapes to determine their relevance, the defendant had asserted that plaintiff should pay for restoration of the backup tapes.  The court ruled, under the circumstances of the case, that defendant should pay 75% and plaintiff 25% of the cost of restoration.

Electronic Discovery Reference Model (“EDRM”) Best Practices.  Ultimately, the need to address ediscovery according to its unique requirements arises from the very nature of the digital information itself.  The EDRM available at http://www.edrm.net attempts to lay out a process for the handling of ESI.  The recommendations of the EDRM model are meant as an analytical framework for conducting ediscovery.  While they were developed within the context of the federal rules, that framework stands as a reference for how to approach ediscovery regardless of specific court rules. 

The basic framework is to start with good information management, have good document retention policies and follow them.  Then identify the information needed in the context of the particular case.  Preserve the information so that it is not lost or damaged, not spoliated in any way.  Collect the information so that it can be processed and used; this may involve forensic collection methods. Process the information to reduce it in volume and convert it into formats for review.  Review for relevance and privilege. Analyze the data for context and content.  Produce it in an appropriate form using an appropriate delivery method, and finally present the evidence as needed at trial.

Sanctions.  One of the big concerns in ediscovery cases is the imposition of sanctions.  Every state has rules regarding the obligation to preserve evidence.  In the absence of specific ediscovery rules, a court will look to its general discovery rules regarding preservation and spoliation when evaluating sanctions.

Resources.    There are a number of resources available for assistance with an ediscovery issue.  At http://www.applieddiscovery.com/ws_display.asp?filter=State%20Courts is a list of the status of ediscovery rules in every state, including whether the state has no specific rules.  At http://www.ediscoverylaw.com/articles/resources/  is a list of local federal court rules for every Federal District Court.  At http://www.ediscoverylaw.com/articles/ediscovery-case-database/ is a regularly updated database for discovery cases.  Also useful at the state court level are the previously cited proposed Uniform Rules and the Conference of Chief Justices Guidelines For

State Trial Courts Regarding Discovery of Electronically-Stored Information available at http://www.ncsconline.org/images/EDiscCCJGuidelinesFinal.pdf. Another excellent resource for best practices is the Sedona Conference web site http://www.thesedonaconference.org/.

Conclusion. Since slightly fewer than half of the states have explicit rules for handling electronic discovery, and since each state has slightly different rules, counsel are often challenged by questions regarding the handling of ESI at the state court level.  Although the federal rules were partially intended to avoid this patchwork of rules, they do not apply in every state.  However, the Federal Rules and the best practices that have been devised to deal with them, such as the EDRM, address the physical realities of ESI, its dynamic nature, volume, need for special tools and meta data.  Even in the states where guidance is lacking, best practices like the EDRM provide a significant degree of guidance.  

*Sheryl Katz, Esq., EnCE, is based on Los Angeles, California where she works for eClaris, Inc., an e-discovery and computer forensic consultancy and service provider dedicated to helping law firms and corporations classify process and review electronically stored data.  She can be reached at 213.784.4142, slkatz@eclaris.com or through www.eclaris.com.

 

NB: This article is scheduled to appear in the upcomming issue of the Women's Law Journal which is put out by the National Association of Women Lawyers. 

For most attorneys, embarking into the world of electronic discovery (e-discovery) and confronting the costs associated with it represent the single biggest challenge—and headache—in conducting litigation or alternative dispute resolution. The recent proliferation of federal and state laws dealing with electronically stored information (ESI) has exacerbated these hurdles. Against this backdrop of growing legislation and case law, counsel engaged in arbitration are tasked with making sense of how ESI will be approached and harnessed to its most effective use and presentation in an alternative dispute resolution setting without imposing all the courtroom expectations and sensibilities inherent in the traditional litigation setting.

Common Hurdles

For the past decade, ESI has surfaced as the foremost and most popular medium for data communication and storage. Although ESI is perhaps most recognizably represented by electronic mail messages, it may be found in a myriad of other formats and comprises enormous amounts of digital data. Some experts estimate that as many as 161 billion gigabytes of digital data were created solely in the year 2007.[1] A paper document containing an equivalent amount of information would stretch over 92 million miles!

To make matters even more complex, the sheer size of ESI is not the sole issue that must be confronted. After all, digital data can just as easily be duplicated and moved across an array of network systems with a few simple commands. As a result, it has become increasingly complicated to pinpoint the sources and locations of particular pieces of ESI. Indeed, the ESI sleuth will need to navigate through complicated servers, email systems, detachable media, voicemail, and even iPhones, to name a few. Each of these resources may contain information that is pertinent to legal discovery.

In contemplating and integrating ESI into an admissible form with a proper evidentiary foundation, counsel begin to confront an additional series of hurdles—namely, increased expenses and added risk. The combination of these two, and the fear of the unknown that they engender for the uninitiated, has led numerous cases to mistakenly settle prematurely. The arbitration attorney must therefore ensure that expense and risk are eliminated or minimized in tackling these evidentiary legal issues outside the courtroom setting.

Whither Arbitration?

At its inception, arbitration was articulated as a relatively relaxed alternative to complex litigation. The concept was thus born of the idea of giving both sides a straightforward, swift, and cost-effective arena to sort out their differences. Although the myriad rules of evidence generally did not apply, the arbitrator was granted authority to demand production of data, both electronic and not. Parties, however, did not believe that the arbitrator’s mandate was robust enough to accomplish complete discovery. This understanding has transformed arbitration into an expensive and lengthy expedition in which each side is left with the often unsatisfactory results of, at best, a partial discovery process.

Nonetheless, arbitration may be favored by parties because, if nothing else, it is still viewed as being less costly than traditional litigation. This perception is based on the greater latitude granted by state and federal courts for expansive and expensive discovery requests in response to motions to compel discovery. In litigation, this outcome is particularly discouraging when strict deadlines must be confronted and enormous amounts of ESI must be accounted for as part of the discovery process. Thus, arbitration, as flawed as it may be, is preferable from a cost-savings perspective because it allows for additional limitations as to the scope of ESI that will be admitted into evidence.

There are other benefits as well. Arbitration offers a secure, proven forum for airing and managing controversial pre-hearing dilemmas. In addition, the traditional rules of evidence do not fully govern in an arbitrational setting, and the perceived procedural shackles of litigation are therefore less restrictive in arbitration. These advantages dovetail quite well when supervising large-scale and specific ESI requisites in an arbitrational setting.

When Worlds Collide

Many have been baffled as to how e-discovery should be conducted in practical terms once ESI becomes pertinent to an arbitration. This is perhaps due to the enormous amount of possibly discoverable ESI and the expenses associated with producing it to the other side. In these and other arbitrational settings, the arbitrator should take the lead by setting up a case management conference to be attended by both parties. The conference should be of substance in terms of time and content and be attended, preferably, by the parties in person. In addition, it is recommended that the parties’ information technology representatives be present as well to review, explain, and query the ESI in question.

During the case management conference, the arbitrator should mandate a litigation hold on all pieces of relevant ESI. If the parties have previously agreed to a litigation hold, the terms of the litigation hold should be scrutinized at the case management conference for all permutations of ESI along with any pertinent retention or deletion timetables to ensure that no ESI is manipulated. In addition to a methodical march through the many ESI options that may exist, including third-party and legacy systems, it is recommended that the parties review at this time the production formats and search terms to be employed thereafter.In intricate cases, arbitrators have become accustomed to ordering sampling as a form of search term verification. Sampling can be imposed by an arbitrator when the parties may be dealing with an enormous number of ESI search terms. In doing so, the arbitrator crafts less invasive and more limited ESI searches to evaluate the helpfulness of repeating the partial sample searches more extensively. While this method may not yield consistent results, it is a practical substitute to sanctioning an indiscriminate search, which would be likely to increase the time and costs associated with interrogating the ESI.

Conclusion

E-discovery and arbitration need not be incompatible. Indeed, the fact that arbitration is the forum for resolving the parties' dispute can play a vital role in determining a party's ESI interests in a manner that is both swift and equitable. Consequently, arbitrators must be familiar with the workings of ESI to better manage the e-discovery likely to appear in their next case, so that the perceived advantages of arbitration are not lost in the process of handling ESI in the arbitrational setting.

Really?  I’ve spoken with many attorneys even in today’s tech savvy environment and this response is still common when I ask them if the cases they litigate involve eDiscovery.  In fact, over 95% of all cases involve some form of electronically stored information or ESI.  Even if an attorney says they only deal in paper, the content that is printed out on that paper, in all likelihood, was generated on a computer somewhere.   From the smallest of cases to the largest, “We all do eDiscovery.”  The question should not be, “Is eDiscovery relevant in my case,” but “How can I better manage my case by using eDiscovery.”

Is the existence of ESI a burden or a blessing?  Many litigants who say they don’t do eDiscovery often are the litigants who position themselves nearest the door during a CLE presentation on eDiscovery, or they avoid talking about the subject all together.  The main reason given is that, “I don’t want to engage in eDiscovery because it’s too expense and complicated.  I’d rather stay with paper.”  They believe that it is a burden to handle discovery information in an electronic format.  This belief system actually creates more of a burden than avoids one.  When ESI is reduced to paper form a number of things happen: 1) the document becomes static and unsearchable except to the human eye; 2) paper often becomes lost during the course of litigation and new copies have to be printed; 3) paper is difficult to organize into separate categories without multiple copies being made; 4) the ability to electronically search aspects of the document are not available such as author, sent date, subject line, etc.

On the contrary, when ESI is maintained in an electronic format a number of advantages arise: 1) the documents can be maintained in a database for easy access; 2) the document never gets lost since it is electronically stored and is regularly backed up; 3) the content of the document can be searched electronically and even thousands of records can be searched simultaneously in a fraction of the time it would take to search an equal amount of paper; 4) document characteristics can be searched such as author, date created, date sent, subject line, etc.  The actual cost of handling litigation, no matter what the size of information involved in discovery, is actually less expensive in today’s world and much more efficient if one “Does eDiscovery.”

I served as a litigation support manager and analyst in two AMLAW 100 firms as well as litigation technology consultant to other law firms spanning 15 years and nowhere did I see a situation where handling a case “electronically” or “digitally” was more costly or more burdensome.  On the contrary, the opposite was true and still is.  Prior to the new Rules of Civil Procedure concerning ESI, the specter of electronically stored information and how do deal with it long scared litigants to “minimize” the scope of discovery.  “I won’t ask for your Pandora’s box if you won’t ask for mine.”  In such cases, I was told personally by the litigants that they are only going to ask for paper as if they could freely pick and choose what evidence to build a case with.  Not only did this mindset do injustice to their own clients’ interests, it also put them at a disadvantage.

With the adoption of the new FRCP concerning electronically stored information, the luxury of picking and choosing evidence is going away as well it should.  Advances in technology have lessened the risk of opening that Pandora’s Box and actually enhanced the discovery process itself.  Information can be processed exponentially faster than ever before and searched with greater clarity.  As the volume of information that is drawn into the discovery net increases, the tools to fish have become more sophisticated and efficient and arguments that eDiscovery requests are over burdensome are getting less and less traction in the courts.

It’s actually a good time to admit that you “Do eDiscovery” and to seek the expertise of those who have walked in your shoes before.  An eDiscovery expert can 1) give early direction to limit the scope of how much ESI is needed to collect through the Meet and Confer process; 2) provide best practices to cull the collected data down; 3) provide tools for early analysis of the data; 4) design searches to identify key records, or group-tag potentially relevant or privileged records; 5) design review criteria to increase review rates and reduce time in review; and 6) help plan the production of evidence.  The result will be greater control over the evidence and more efficient handling of your case.

In conclusion, eDiscovery should be embraced rather than avoided.  While many litigants in large firms understand the benefits of eDiscovery and who are aware of the changes to the FRCP as well as state versions of the same, there is a large pool of attorneys in these large as well as mid-size and smaller firms who do not.  This article invites you to explore the option of your first question in discovery being, “Where is the ESI?” rather than it being your last question.

*Jeff Steve, Esq. is based on Los Angeles, California where he works for eClaris, Inc., an e-discovery and computer forensic consultancy and service provider dedicated to helping law firms and corporations classify process and review electronically stored data.  He can be reached at 213.270.1465, jsteve@eclaris.com or through www.eclaris.com.

 

In "EDD Tale: Caught in the Middle" Computer forensic examiners can find themselves the scapegoats in discovery battles" an article posted on November 23, 2009, Jason Krause discusses a case in which an ediscovery vendor found itself defending against a motion for sanctions.

http://www.law.com/jsp/lawtechnologynews/PubArticleLTN.jsp?id=1202435729989&EDD_Tale__Caught_in_the_Middle. 

 The article refers to the case Technical Sales Assocs., Inc. v. Ohio Star Forge Co., Nos. 07-11745, 08-13365 (E.D. Mich. May 1, 2009).  In that case Midwest Data Group was retained to search for certain terms in email.  When conducting its search, the company found no responsive email, but it also found evidence that 70,000 email had been deleted immediately after the court discovery order.  The vendor was supposed to produce its findings to the defendant, and it did report that it found nothing.  It then reported to the plaintiff, that it had found evidence of spoliation in the 70,000 deleted files.  This led to the defedant's counsel seeking sanctions against the vendor.  One problem is that the vendor had no instructions regarding what to do in such a circumstance.  Vendors need clear, understandable instructions and that it may advisable for them to participate in early conferences with counsel.  Another problem is that the vendor jumped to a conclusion - while the destruction of 70,000 emails immediately after a court order is suspicious, and best practices would have had the client suspend normal operation of its document destruction policy pending discovery, that destruction is not in and of itself proof of spoliation.  The vendor was also in an unclear situation regarding to whom it owed a duty - the court or the defendant that was its immediate client. 

This situation can create quite an ethical thicket, not just for the vendor but for counsel as well.  An attorney has an ethical obligation to disclose a fraud that its client perpetrates on the court.  Disclosure at some point may have been necessary, but before the vendor jumped the gun and reported a conclusion that spoliation had occurred, the vendor should have brought the evidence of destruction to its own client. 

 In the Law.com article, Krause argues that the case is support for the need for better training in forensics.  This doesn't seem like a lack of forensics knowledge on the part of the vendor.  It's pretty basic to know whether or not email was deleted.  Whether that deletion amounts to spoliation is a legal question.  While forensics experts should be expected to know rules about evidence preservation, chain of custody and evidence handling, they should not have to be lawyers.  To me this case is a good lesson that the ediscovery or forensics vendor needs to be clear what it is being asked to do.  There are also a number of ethical questions that need to have clearer guidelines within the nascent forensics profession.  The attorneys who retain the experts also need to make sure that their instructions are adequate. 

Most litigation support staff understand the basic challenges of electronic discovery. However, while many forensic methods are used in e-Discovery, computer forensics is a unique discipline.

“[F]orensic science is the application of a scientific discipline to the law, the essence of all forensic disciplines concerns the principles applied to the detection, collection, preservation, and analysis of evidence to ensure its admissibility in legal proceedings. Computer forensics refers to the tools and techniques to recover, preserve, and examine data stored or transmitted in binary form.” 
— Kenneally, Erin, “Computer Forensics,” The Magazine of Usenix& Sage, August 2002 Volume 27-number 4

This article will focus on practical issues faced by litigation support professionals when the use of computer forensics techniques and analysis are required. The potential of computer forensics has been almost always confined to criminal cases, but it can be very useful in civil cases as well. The biggest mistake litigation support personnel make in evaluating their need for forensics is looking to their internal IT departments for forensic support.

Understanding Where Forensics Will Be Useful

(a) Collections. In the context of civil litigation, computer forensics are most frequently used in the collection of evidence. Forensics experts are trained in acquisition methods that ensure the authenticity of evidence. The mere act of turning on a computer causes information to be written to the computer’s hard drive. The forensics expert will gather the information from the computer using special hardware and software tools that will ensure no changes to the data stored on the computer. In many litigation matters, evidence is collected by in-house IT staff, and not by forensics experts. This method of collection always results in the loss of some metadata. This metadata is not always material to the lawsuit; however, the best way to ensure that evidence collected is forensically sound and admissible in court is to have evidence collected by forensics experts or technicians trained in forensic acquisition methods. The EDRM model does not specifically require forensic collection, but forensic collection – whether of a full hard drive or simply logical files – works well for the collection phase of the EDRM.

(b) Analysis. Forensic analysis can obtain considerable information from a hard drive. It is often possible to recover deleted files, and in many cases even deleted and reformatted partitions. The date that a file was created, by whom, when it was changed, if it was copied off to an external drive, if it was sent in email are all possibly recoverable. Forensic techniques can often identify and break encryption or find information that was hidden deliberately with tools like steganography (hiding documents in pictures). In addition to criminal cases, forensic analysis can be useful in a number of civil cases, particularly if there are issues of fraud, if timing is critical, or if lost documents are needed. Forensic analysis can be very useful in cases of intellectual property theft, and in actions for wrongful termination.

Finding Forensic Experts

Most litigation support personnel are very familiar with methods for finding experts. One additional consideration for forensics are forensic specific certifications. There are a number of certifications, both third party and from vendors. The Computer Forensics Certified Examiner (CFCE) for law enforcement personnel and Computer Certified Examiner (CCE) (the CFCE for non-law enforcement personnel) are respected vendor neutral certifications. Another frequent certification is the Global Information Assurance Certification Certified Forensics Analyst (GIAC-GCFA) which is primarily connected to the SANS Institute programs. The Encase Certified Forensic Examiner (“ENCE”) is a vendor certification, but well-regarded because it involves both a written a practical exam and because Encase is the most frequently used forensic acquisition and analysis software.

Understanding the Limitations of Computer Forensics

Many forensics experts fear the “CSI Effect”. This is the belief that many people get from watching CSI on TV that forensics is infallible and instantaneous. On CSI the forensic analyst turns on the computer, guesses the password as the suspects daughter’s name and magically all data on the computer is easily accessible. Computer forensics is incredibly powerful in its own way, but it is often painstaking and tedious. The analyst often must spend hours studying a hard drive, looking at hexadecimal code, counting the bits and bytes forward and back, in order to find the hidden information. If a password is involved and it is cracked, that is usually just a starting point for investigation.

Understanding That IT is Not Computer Forensics

Due to the uniqueness of forensics as a discipline, the IT staff is not likely to be forensically trained. Many times the IT staff will want to look at a hard disk with data recovery tools, but they are not forensics analysts. One of the ways in which evidence is often damaged is when IT staff start poking through disks without using write blockers. IT staff lack the training to get the information while leaving the original intact, and they lack the training to do in depth analysis. They may know quite a bit about file systems, but they are unlikely to have had the in depth training into all the virtual crevices on a hard drive that would be the province of a forensic analyst.

Conclusion

Whether using it as part of e-Discovery, or as a key tool in proving a case, computer forensics can be extremely valuable in litigation. The key is to use forensic collection methods, be aware of what forensic analysis can provide, be aware of what it cannot provide and make use of the right experts.

The Seventh Circuit has adopted an ediscovery pilot program.  It's report is available here:  http://www.ca7.uscourts.gov/7thCircuit_ElectronicDiscovery.pdf and is well worth studying for guidance on how to handle ediscovery.  What makes this program unique is that it is actually being tested in trials:

"Individual district court judges,magistrate judges, and bankruptcy judges in the Seventh Circuit have agreed to adopt the Principles and implement them in selected cases during the Phase One period. This will be done through entry of the [Proposed] Standing Order by the participating judges in the selected cases.  Once adopted as standing orders, the Principles will serve as supplemental procedural guidelines to be followed by litigants. The Principles' efficacy will then be evaluated and refined. Phase One of the pilot project will occur from October 2009 to May 2010. The Institute for the Advancement of the American Legal System at the University of Denver is developing questionnaires to assess the efficacy of the Principles. Questionnaires will be completed by the participating judges and by the lawyers who practice before the judges. The results of the IAALS's questionnaires will be presented at the 7th Circuit Annual Meeting in  May 2010. In May 2010, the E-Discovery Committee will also evaluate the efficacy of the Principles and refine them as appropriate. Phase Two will then proceed from June 2010 to May 2011. In May 2011,the E-Discovery Committee will then formally present its findings and issue its final Principles." p. 12

 Identifying the problem with ediscovery the report note:

"Too often these exchanges begin with unhelpful demands for the preservation of all data, which often are followed by exhaustive lists of types of storage devices. Such generic demands lead to generic objections that similarly fail to identify specific issues concerning evidence preservation and discovery that could productively be discussed and resolved early in the case by agreement or order of the court. As a result, the parties often fail to focus on identifying specific sources of evidence that are likely to be sought in discovery but that may be problematic or unduly burdensome or costly to preserve or produce." p.9.

 The report attempts to clarify the specific steps to be taken to get cooperation from the attorneys, better define "inaccessible" data, apply a standard of proportionality, require appointment of an ediscovery liaison, and give specific suggestions for education of attorneys.

When I was a General Counsel, we started a policy in my company of retaining the hard drive of the employee.  In some cases we would also copy the email store from the server and the network share to a DVD and keep a copy.  This isn't something we started out doing, we had a couple of employees leave to work for competitors who we were pretty certain had taken our proprietary data when they left.  Once we experienced that, we realized that we would have been better off to have the original hard drive.  Forensic tools can capture whether data was copied onto an external drive, whether data was deleted, and can often recover deleted data.  If we had kept the hard drive, we would have been more able to substantiate our case that our intellectual property had been stolen.  Subsequently we kept the hard drives, and there were several instances over the next few years when referring back to them was useful, not just for purposes of potential litigation, but also to find records that were otherwise unavailable. 

If I were still the General Counsel I would change this policy slightly and instead of just keeping the hard drive I would keep a forensic image which I would store on a server in an archive.  I would do this for two reasons (a) hard drives can fail too easily if just put in storage, and (b) once an image is made I can review information from the image without damaging metadata or deleted data on the files. 

If a company does this, it also is smart to have the image made forensically, using forensic recordkeeping, write blockers and software in case it needs to be used in litigation.  That way there is less concern about authenticity or spoliation. 

Frequently when disputes arise with employees, one of the first things that happens is that IT looks at the computer.  This is a bull in a China shop approach that makes alterations to the data, and causes it to be looked at by technicians who are not trained in finding data.  It also could put the internal staff at risk of being called as witnesses.  Not all employees may be likely to steal data or bring lawsuits, so some companies may adopt a policy of imaging drives only for employees who have had access to critical data or who are likely to sue.  In my experience, the cost of keeping the data was small, and there were many times we were glad to have kept it.

What Attorneys Can Learn These Treacherous Topics to Strategically Prepare For Electronic Discovery

 

Electronic discovery (“eDiscovery”) is often perceived as a proverbial bottomless pit since the quantity and intricacy of electronic stored information (“ESI”) tends to be exponentially greater than paper records.  To compound matters further, with modern technologies the restoration of backup tapes are frequently deemed necessary to the ESI equation when preparing for litigation.  Although more often than not essential, backup tape restoration can be a thorny, costly and time-consuming portion of any case if not conducted properly.

 

Whatever could the complications be? 

 

Perhaps one’s client spent numerous years developing a plethora of backup tapes and counsel has a mere few days to pinpoint them and have them restored.  Or, once acquired, the restoration (gasp!) does not go as seamlessly as planned when some of the tapes are not labeled. Moreover, perchance and to further muddle matters, say the original hardware and software used to create the backup tapes is unavailable, since the client is now using a new, and purportedly better, backup technology.

 

The list goes on and on and….

 

Nevertheless, counsel can and must take stock when it comes to backup tapes, for if one exists and is relevant and accessible it may need to be restored and produced to the dreaded other side, if requested.   

 

Determining The Universe: What, Exactly, Does The Business Have?

 

Depending on the magnitude of the business, it may have personnel dedicated to the formation, restoration and oversight of its backup tapes. These staff members are an invaluable resource to begin obtaining key data about the company’s backup tape processes and a good resource to start with to find first-hand information about the backup-tape inventory.  They perhaps will be able, in addition, to procure some of the company’s historical backup tape dealings.  Most poignantly, however, these individuals would possibly be aware of any exceptions to the businesses backup tape protocols, both institutionalized and informal. 

 

That said, although evaluating backup tape procedure is a fine place to start, protocols will only point to some of the localities where the tapes may be found.  More often than not, there will be exceptions whereby backup tapes were created and maintained ‘outside the scope of the protocols’ for a variety of reasons.  For instance, special projects, firm restructuring, backup tape system upgrades and emergency measures are but a short list of the possible reasons why a business may have separate, distinct on-the-fly backup tape policies.  All ad hoc company backup tape policies are vital precisely since they were conceived beyond the business’ regular protocols and are likely to house exceptions from official company data recycling or deletion procedures.  Furthermore, backup tapes earmarked for destruction or deletion might have been omitted or otherwise misplaced and subsequently located at the business.

 

Next, while engaging company staff, as shown above, can provide fruitful results when locating and interrogating backup tape data, in order to verify any of the data, one must request staff to procure a report from the actual backup systems. Many backup tape systems will contain a recording snapshot of its own contents for archival purposes.  Some also will even contain an actual listing of the data files found on each and every particular backup tape.  Be on the lookout, in this instance, for recycled backup tapes which may or may not be marked with the time and date of the first backup.  Recycled backup tapes tend to merely have a distinct bar code for identifying purposed.  Contrast this inventory against whatever catalog information is provided from the backup tape systems to ascertain whether any inconsistencies arise.

 

An additional resource to confirm what backup tapes the business may own necessitates the engagement of business’ data storage vendor, if one exists. Even though a business might have, at first glance, what seems to be an immaculate inventory of the backup tapes it maintains, the vendor tasked with care for the tapes may have an added level of knowledge to contribute to the conversation.  An actual accounting of where the vendor’s storage facilities are located and how it conducts the backups is recommended.

 

Naturally, the time and wherewithal to take on the issues noted above will fluctuate from time to time.  Businesses must review each and every ounce of the backup tape data, as is possible.  However many sources interrogated, one should strive to contrast each source of backup tape data against the other to lessen the risk of losing valuable pieces of the puzzle. 

 

Establishing Backup Tape Date Ranges

 

A company’s technical personnel may backup information daily, weekly, monthly or even yearly.  The task here, to ensure consistency and data security, is determining how to verify the time periods noted on specific backup tapes.  To do so, one must ascertain the kind of server used to conduct the backups, any business protocols on point and how employees interpret them.  

 

What practical differences exist vis a vis company time records and particular backup tapes?

 

Reflect on the following.  Assume the business maintains that it conducts its tape backups on a yearly basis.  This does not necessarily mean it has on hand the entire year’s backup tape information on one tape, neither does a weekly tape backup scheme correlate with a single backup tape containing a month’s worth of data.  On the contrary, the majority of tape backups are merely pictures of the information at the instant the backup actually occurred.  Therefore, the description of a daily, weekly, monthly or even yearly tape is simply a depiction only of the time the backup was created. As an example, a monthly date may only indicate that the backup tape was created on November 30 and contains data that was on the company server as of that precise date.

 

Email is curious as well.  User A might have a practice of erasing all email each day while User B might save emails for a month. Depending on the business’ server used to store company email, only one day’s email may be pinpointed for recovery if the monthly tape is retrieved for User A, but multiple years of email may be refurbished for User B.

 

To help combat this email and other similar conundrums, some businesses set restrictions on their backup tape servers to circumvent running out of available server storage space. Perhaps the two most popular modes for these limitations are date and volume.  The former is most useful in comprehending what date ranges the backup tape actually covers. Should a business have a date limitation in place that will allow it to store company emails only from the preceding seven days then all email from day one may be erased on the eighth day.  Electronic messages from day two are then nixed on day nine and so on and so forth.  This also means that one can deduce that the snapshot of the email messages located on the backup tape contains seven days of email.

 

Tick, Tock -- Time Considerations When Reinstating Backup Tapes

 

While bygone backup tape technologies are naturally sluggish when pitted against modern alternatives, there are a variety of additional factors to ponder when seeking to calibrate the quantity of time needed to refurbish a backup tape.  Painting with a broad brush, one should consider the average file size, the type of the backup tape used, how much capacity the backup tape has and what type of restoration hardware was in play.

 

Time can also be of the essence.  When racing against the clock the restoration of an email server backup tape where all stored information was located in one file may take about five hours to complete. The exact same backup tape configuration with multiple broken up smaller files from a company backup tape file server may take an even longer amount of time to restore.  Why?  Additional granularity is required.  When approximating the amount of time needed to reinstate multiple tapes one should refurbish one tape from each tape subset, and then extrapolate that quantity of time by the overall volume of diverse backup tapes to be reinstated.

 

Backup Tape Disaster Preparedness and Recovery Best Practices

Many law firms and corporations nowadays have legitimate backup tape recovery plans firmly rooted in place.  However, only a select few practically meet the needs of the company, specifically when it comes to delivering on time.  Crafting a backup tape disaster recovery plan that can be implemented at any point of time is of paramount importance since the potential of unknown and unforeseeable natural disaster or criminal activity may be lurking just around the corner for the company to abruptly face.

Vital to any modern backup tape disaster recovery plan is simple timing.  They are the backup itself and precise replication. Backup tape disaster recovery plans, similar to any other tech department endeavor, contend with the myriad of other assignments on any company IT department’s master agenda.  Thus the first step is making the construction of a backup tape system that can serve as a dependable doomsday disaster data repository, a top priority. 

A recurrent pitfall in backup tape disaster recovery planning is the assumption that the responsibility for the construction and implementation of these plans falls squarely, and solely, on the shoulders of the company’s information technology department.  Although disaster recovery is clearly a technology department consideration, in actuality this topic must be classified as a company stability proposition.  This is because disaster recovery measure, which means that while very much a technology concern, it is an issue has the ability to shape the business’ very existence. Therefore, all segments of a company’s upper management must be involved to understand what the plan, and its budgetary implications, means to their specific department and how to appropriately respond and contribute.   

The resources necessary for the construction of backup tape disaster plans used to be something that was reliant upon means unattainable to many companies, such as secondary or even primary backup data centers. Nonetheless, these plans can become more realistic for medium and smaller firms by renting room for its hardware at a reputable network services provider. In addition, further progress has occurred in software that now allows medium and smaller businesses to better maximize their in-house resources to allow for far more vigorous backup tape disaster plans than formerly thought to be possible.

Conclusion

 

With the crippling sanctions imposed by the Zubulake, Wachtel and Morgan Stanley as to abuses of the discovery processes as they relate to creation and handling of backup tapes, there has been renewed emphasis on the necessity to supervise these facets of information management with greater alacrity and zest.  Some businesses are shying away from backup tapes as a model and are opting for newer, quicker data recovery technologies.  Yet, the majority of businesses have marched on with their backup tape systems and disaster recovery protocols with enhanced internal protocols for the inception and handling of the backup tapes. In either case, one thing is for certain.  Businesses - now and in the future - will need to grapple with how to approach their backup tape systems before, during and after litigation hits. 

 

This article was published in the Fall 2009 Technology for the Litigator Newsletter which is put out by the American Bar Association.

A simple but confounding problem with native file productions is the challenge of reading files in formats for which the receiving party does not have the native software.  This can involve extracting word processing documents from old or obsolete programs like DOS Wordstar or obtaining tables from a database created in Oracle or uncovering layers in a picture created in Photoshop.  There are a number of ways in which this information can be reviewed without the necessity of purchasing or finding a copy of the original software.

1.  Software that can Read ASCII

Just about any forensics software (for example Encase or FTK) , or ediscovery processing software (for example Law or Nuix) , or hex editor can interpret ascii text and make it readable as text.  The content of most email messages and word processing documents can be read as ascii text.  The disadvantage of this approach is that the original formatting of the underlying document will be lost, but most of the time the content is where the evidence is located. 

2.  Viewers

There are a number of file viewing applications, examples are Hijaak and Evince.  Hijaak was developed primarily to view various graphic formats.  Evince is an open source program developed to read various document formats.  One of the most powerful viewers is Outside In technology which is available from Oracle as a developer kit and incorporated by software vendors into their products.  Outside In is incorporated into recent versions of Encase.  Thus, a forensic analyst reviewing a document in encase can view and carve out if necessary documents in any of the 500 plus formats supported by Outside In. 

3.      Installs from Original Image

Often people download software and store the original install image somewhere on their hard drive.  Many companies keep their corporate install images located on the corporate servers.  If an analyst obtains the original install image from the server or the original disk, then the software can be installed on the computer being used for review.

4.   Quasi Native Format

Another option is to covert the file into a format that is readable and equivalent as part of the ediscovery processing.  This mostly applies to databases and spreadsheets.  Thus if data is produced in an Oracle format, it may be possible to convert it into an Access database.  Similarly, if data is in spreadsheet format, it may be translatable to a different spreadsheet or convertible into comma delimited format.

5.  Open Source and Freeware Alternatives

There are open source and freeware alternatives to the alternative product.  Open Office is widely known example.  Microsoft Office documents can be read by the Open Office software, which is available for free.  Another very useful open source program is Gimp.  Gimp is a Photoshop clone.  If one needs to review a document created in Adobe Photoshop and needs to unpeel layers in the photo, it isn’t necessary to purchase Photoshop, the photoshop layers can be revealed by opening the document in Gimp.