eClaris recently contributed a featured article to the DRI eDiscovery Committee.  The article is entitled "eDiscovery Project Management: Observations from the Long and Winding Road" and appeared in the Summer edition of eDiscovery Connection.  Click here to read the article.

eClaris recently contributed an article on the value of collaborative eDiscovery to the American Bar Association's Electronic Discovery and Digital Evidence Committee.   Click EDDE Journal - volume 1 issue 3.pdf (890.84 kb (second entry down) to read all about it.

eClaris recently capitalized on highly responsive and scalable Hitachi Storage for flexible eDiscovery growth.  Click eClaris - Hitachi Case Study.pdf (602.70 kb) to learn how.

Computer forensics on TV looks like magically powerful voodoo that, with a few strokes on the keyboard, easily cracks the case.  Real life computer forensics is quite a bit more mundane, painstaking and even tedious.  Yet, it can often uncover unexpected information.  This article discusses the most common types of data from which a forensic analyst will be able to recover files that have been deleted.  The article appears in the April 2010 edition of San Diego North County Lawyer Magazine.  To read more click on North County San Diego Bar Association Article.pdf (11.08 mb) and head to Page 20.

At the end of the day, but before advising attorneys and staff on the best solutions to handle their discovery demands, the ultimate question is, “How much will this cost?” Litigation has always been a cost/risk assessment question. Attorneys look at the claims and the facts of the case presented in order to make a determination of how much money it is worth spending defending the matter before them. The level of risk dictates every aspect of the case.

If a claimant is seeking $10,000 in damages, the cost an attorney is willing to spend defending the claim is going to be rather small; in most cases. If a claimant is seeking $1,000,000 in damages with the possibility of punitive damages on top of that and if the case looks very favorable in light of the risk assessment, then the budget to defend will increase. If the facts present a poor case for the defense, then the budget for the $1,000,000 case is going to shrink.

This is an important backdrop to understand for the Litigation Support Manager before advising their attorneys and staff on the best solutions for litigation support for a given case especially when the case involves electronically stored information (ESI). Understanding this leads to better communication. Better communication leads to better budgeting.

Discussion will often times center on the discovery demand itself and the budget gets lost in the talk. When the budget gets lost and the monthly cost bill is being prepared, all too often the Litigation Support Department gets called into question. Why? Internal law firm litigation support costs are not always accepted as a legitimate cost that can be passed on to the client and equally important is that attorneys are in the dark as to how much it costs to handle the electronic discovery portion of the case.

In my early career, I would all too often be brought into a discussion to answer, “What should we do?”, or “How should we best handle this request?” I would give my advice, proceed to perform the tasks agreed upon, and then present the outside vendor bill and my hours to the attorneys. Sometimes my hours would be written off to the client and the vendor bill would languish forever on someone’s desk and I would have to answer the vendor’s request for payment. Other times, I would be called in to explain the bill. I would say, “You asked me to perform this task and I did.” The attorneys would answer back with, “I had no idea how much this was going to cost.” Why? Budget was not brought up during the discussions.

After these type of experiences, I have made it a point when asked to handle the processing of ESI to run initial cost analysis even if I am not asked to. I do this, because I know that the issue is too important to ignore and unless I raise it, it may never be asked until it is too late. There are other times where I have had experiences, as many of us have, where I hear about a partner or associate calling up a vendor, independent of talking to me, to print out all the emails from a 1 GB PST file so they could review the documents in hard copy. One month and 100 billable hours later, I find out about it. I explain to the attorney that had they sought my advice in the beginning they could have saved about $2,500 in upfront processing costs and about 90 billable hours to the client in review time. I would get sheepish grins, or sometimes very red faces.

Today, many Litigation Support Managers use a formula-based spreadsheet to calculate the cost of handling ESI and other litigation support tasks. This has grown into a very powerful tool to help communicate the cost impacts of pursuing a certain line of litigation support to attorneys. It is also a very powerful tool that Litigation Support Managers can use to evaluate offerings among a variety of support vendors. Whether it’s formulae in spreadsheets, or budgeting software, the goal is to provide information to the litigation team early on so they can factor in the price of handling ESI into the cost analysis of defending their case.

There are several ways that Litigation Support Managers can better interface with the litigation team to ensure that budgeting goals are achieved when a case involves ESI.

1. Integrate the Litigation Support department with the legal department rather than have it stand as a separate entity. Often times, Litigation Support exists as a separate department just as IT. The role of Litigation Support spans across both legal and IT, but in practical terms Litigation Support serves to increase the ability to effectively handle the discovery and trial presentation aspects of the case; a legal function. Bringing Litigation Support directly into the legal department immediately enhances the quality of communication.

2. Initiate discussions early on concerning cost with the litigation team handling the case. All too often a case team meets with Litigation Support weeks after receiving a case and about half way through the discovery process to discuss budget. This is often too late in the process to be helpful and often ends up costing the client more. Early talk about costs can have a profound impact on early case negotiations depending on the volume of data to be processed.

3. Use budget tools to help calculate costs. Formulae based spreadsheets, or budgeting software can drastically increase the accuracy of the electronic discovery budget for Litigation Support. It is important to factor in not only the amount of data to process, but also the impact that amount of data has on the review time. The greater the amount of data to review, the greater the cost to review is going to be. Budgetary tools also force the entire team to get to know that data.

4. Immediately notify the litigation team anything that might affect the budget throughout the lifecycle of the case. Often the volume of data or the complexity of the data will increase the cost of the case. Litigation budgets are based on assumptions. As the case proceeds, hard facts gathered through the discovery process impact these assumptions.

In conclusion, the best defense is the best offense. Start the communication on cost of e-Discovery as early as possible with your case team. This will trigger a more thorough discussion of risk assessment of engaging in defense of a case. Your input on the budgetary considerations of e-Discovery can have a dramatic influence how the case is litigated.

Jeff Steve, Esq., is based on Los Angeles, California where he works for eClairs, Inc., an e-Discovery and computer forensic consultancy and service provider dedicated to helping law firms and corporations classify, process and review electronically stored data. Jeff has over 18 years of experience in litigation technology. He can be reached at +1.213.270.1465, jsteve@eclaris.com or through www.eclaris.com.

NB: This article appears in the January 2010 issue of the Association of Litigation Support Professionals

 

The Federal Courts adopted amendments to the Federal Rules of Civil Procedure in 2006.  Among the reasons for adoption of the Federal Amendments was that “[w]ithout national rules adequate to address the issues raised by electronic discovery, a patchwork of rules and requirements is likely to develop. See Report of May 27, 2005, as revised July 25, 2005 (the “Advisory Committee Report), at 23, available at http://www.uscourts.gov/rules/Reports/ST09-2005.pdf.  Yet, while the Federal Rules approach to ediscovery does provide guidance, there remains a patchwork of requirements and in many cases an absence of requirements at the state level.  As of September 2009, 23 states have enacted state ediscovery rules. ( Alaska, Arizona, California, Idaho, Indiana, Iowa, Kansas, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Montana, Nebraska, New Hampshire, New Jersey, North Dakota, Ohio, Tennessee, Texas, Utah and Virginia. See, Allman, Thomas Y., State E-Discovery Rulemaking after the 2006 Federal Amendments: An Update (as of September 2, 2009) Available at http://www.ediscoverylaw.com/uploads/file/State%20Rulemaking%20-%20Allman.pdf.  Each of those states takes a slightly different approach; some follow the Federal Rules almost verbatim and others, like California, follow the federal structure but in quite different terms.

There have also been attempts to develop uniform rules for ediscovery.  In August of 2007, the National Conference of Commissioners of Uniform State Laws ("NCCUSL"), best known as the author of the Uniform Commercial Code, approved the Uniform Rules Relating to the Discovery of Electronically Available information.  Available at http://www.law.upenn.edu/bll/archives/ulc/udoera/2007_final.htm. The result is that there are federal rules, various state rules, court guidelines and proposed uniform rules.  Thus in practice, there is a patchwork which is further complicated by the presence of many specific local rules.  In those states which lack explicit electronic discovery rules, attorneys are often left searching for guidance because so few discovery issues become the subject of printed appellate decisions.  Attorneys who become familiar with the federal rules are often perplexed about how to approach ediscovery in the state trial courts.  This article will provide some practical suggestions for handling ediscovery at the state level, particularly in those jurisdictions where rules are absent.  In essence it will conclude that the procedures which have become best practices at the federal level follow logically from the nature of the evidence itself, and the principles apply to all electronic discovery at the federal and state level.

Identifying Electronically Stored information (“ESI”).  ESI is essentially any information created or stored in digital form.  Some state rules, such as those in California, provide specific definitions, but as a general way to identify ESI, anything that is on a computer, or storage drive, or cell phone, or hard drive, or an mp3 player for example is ESI.  ESI presents unique challenges for several reasons: it is dynamic (constantly changing), voluminous, requires special software and tools to render it meaningful, and ESI contains metadata (data about the data). 

The first challenge for the attorney is identifying the locations of the ESI, and determining if there are any special challenges with respect to their evidence.  Is it so voluminous that some tool is required to cull the volume?  Is it in a form, such as backup tapes, that may be difficult and costly to process?  Is there metadata that is relevant to this case that may need to be preserved?  The attorney will find it useful to interview the client, communicate with the IT staff, and possibly to retain an outside ediscovery expert to prepare a data map. 

Communicate with Opposing Counsel.  The Federal Rules take an approach that attorneys should “meet and confer” to discuss the handling of ESI.  Not all states specifically require “meet and confer” with respect to ESI, and many states do not include a formal “meet and confer” for discovery generally.  Attorneys need to check the specific requirements of the local rules.  Regardless of the specific requirements resolution of a few questions between opposing counsel early in the litigation will potentially keep the ediscovery process and costs under control.  These issues are reaching agreement on the form of production and handling inadvertent production of privileged or confidential information. 

Form of production refers to whether the discovery will be made in the form of native files, quasi-paper– such as Tiff images, or paper form.  This can make a big difference in the ease and cost of review.  If an attorney wants to review in Concordance or Summation, the attorney will probably prefer Concordance or Summation load files, or at least to get the information in some electronic format.  Each attorney needs to understand the implications of the format for his or her case, and both parties need to be clear that each understands the other’s expectations.  These simple decisions, when made at the beginning of a case, can be instrumental in keeping discovery manageable.

Handling inadvertent production comes from the sheer volume of documents.  When there is a high volume case, much of the culling and first round of document elimination needs to be automated.  Sometimes, even when great care is taken, documents slip through.  It’s important to understand the state rules regarding quick peek, claw back or other methods that might allow some protection in the event of inadvertent production.  Many issues can be avoided by counsel agreeing, within the discovery rules applicable in their state, to a procedure for handling inadvertent production.

Consider Witnesses and Witness Preparation for Document Production.  One aspect of ediscovery cases that has led to many spoliation claims is a poor showing by a 30(b) (6) witness testifying about the document production.  Even where state rules do not specifically provide for an electronic discovery witness, there will still be provision for a “keeper of records” or “person most knowledgeable” witness.  Consider while collecting the documents who from the company, or if necessary which consultant, can best speak to the process.  When deposing the opposition witness, take the time to prepare with an IT person or consultant to get the best understanding of the electronic record preservation process.

Preservation of Evidence.  Once litigation is reasonably anticipated, often with the filing of a complaint, parties have an obligation to preserve evidence.  Usually counsel identifies potential custodians and sends a litigation hold letter.  Sometimes, and often advisably, key information is collected at the outset as collection can be the best method of preservation.  Counsel also needs to be aware of document retention and destruction policies that a client may have, and to suspend the operation of those policies for the duration of the litigation if necessary to preserve evidence.

Cost Shifting.  In those instances where ESI is deemed “inaccessible” the cases have allowed for some shifting of the cost of locating, collecting and processing the documents.  The standards actually vary some from state to state.  The most frequently cited precedent is of the Zubulake cases.

In Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 317-18 (S.D.N.Y. 2003) (Zubulake I), Judge Scheindlin suggested a seven-factor test for determining whether cost-shifting should occur:

(1) The extent to which the request is specifically tailored to discover relevant information;

(2) The availability of such information from other sources;

(3) The total cost of production compared to the amount in controversy;

(4) The total cost of production compared to the resources available to each party;

(5) The relative ability of each party to control costs and its incentive to do so;

(6) The importance of the issue at stake in the litigation and;

(7) The relative benefits to the parties of obtaining the information.

These are very fact specific and in Zubulake III, Zubulake v. UBS Warburg, 217 F.R.D. 309 (S.D.N.Y. 2003) Judge Scheindlin applied these factors to the facts in that case.  After there had first been a sampling of some of the backup tapes to determine their relevance, the defendant had asserted that plaintiff should pay for restoration of the backup tapes.  The court ruled, under the circumstances of the case, that defendant should pay 75% and plaintiff 25% of the cost of restoration.

Electronic Discovery Reference Model (“EDRM”) Best Practices.  Ultimately, the need to address ediscovery according to its unique requirements arises from the very nature of the digital information itself.  The EDRM available at http://www.edrm.net attempts to lay out a process for the handling of ESI.  The recommendations of the EDRM model are meant as an analytical framework for conducting ediscovery.  While they were developed within the context of the federal rules, that framework stands as a reference for how to approach ediscovery regardless of specific court rules. 

The basic framework is to start with good information management, have good document retention policies and follow them.  Then identify the information needed in the context of the particular case.  Preserve the information so that it is not lost or damaged, not spoliated in any way.  Collect the information so that it can be processed and used; this may involve forensic collection methods. Process the information to reduce it in volume and convert it into formats for review.  Review for relevance and privilege. Analyze the data for context and content.  Produce it in an appropriate form using an appropriate delivery method, and finally present the evidence as needed at trial.

Sanctions.  One of the big concerns in ediscovery cases is the imposition of sanctions.  Every state has rules regarding the obligation to preserve evidence.  In the absence of specific ediscovery rules, a court will look to its general discovery rules regarding preservation and spoliation when evaluating sanctions.

Resources.    There are a number of resources available for assistance with an ediscovery issue.  At http://www.applieddiscovery.com/ws_display.asp?filter=State%20Courts is a list of the status of ediscovery rules in every state, including whether the state has no specific rules.  At http://www.ediscoverylaw.com/articles/resources/  is a list of local federal court rules for every Federal District Court.  At http://www.ediscoverylaw.com/articles/ediscovery-case-database/ is a regularly updated database for discovery cases.  Also useful at the state court level are the previously cited proposed Uniform Rules and the Conference of Chief Justices Guidelines For

State Trial Courts Regarding Discovery of Electronically-Stored Information available at http://www.ncsconline.org/images/EDiscCCJGuidelinesFinal.pdf. Another excellent resource for best practices is the Sedona Conference web site http://www.thesedonaconference.org/.

Conclusion. Since slightly fewer than half of the states have explicit rules for handling electronic discovery, and since each state has slightly different rules, counsel are often challenged by questions regarding the handling of ESI at the state court level.  Although the federal rules were partially intended to avoid this patchwork of rules, they do not apply in every state.  However, the Federal Rules and the best practices that have been devised to deal with them, such as the EDRM, address the physical realities of ESI, its dynamic nature, volume, need for special tools and meta data.  Even in the states where guidance is lacking, best practices like the EDRM provide a significant degree of guidance.  

*Sheryl Katz, Esq., EnCE, is based on Los Angeles, California where she works for eClaris, Inc., an e-discovery and computer forensic consultancy and service provider dedicated to helping law firms and corporations classify process and review electronically stored data.  She can be reached at 213.784.4142, slkatz@eclaris.com or through www.eclaris.com.

 

NB: This article is scheduled to appear in the upcomming issue of the Women's Law Journal which is put out by the National Association of Women Lawyers. 

For most attorneys, embarking into the world of electronic discovery (e-discovery) and confronting the costs associated with it represent the single biggest challenge—and headache—in conducting litigation or alternative dispute resolution. The recent proliferation of federal and state laws dealing with electronically stored information (ESI) has exacerbated these hurdles. Against this backdrop of growing legislation and case law, counsel engaged in arbitration are tasked with making sense of how ESI will be approached and harnessed to its most effective use and presentation in an alternative dispute resolution setting without imposing all the courtroom expectations and sensibilities inherent in the traditional litigation setting.

Common Hurdles

For the past decade, ESI has surfaced as the foremost and most popular medium for data communication and storage. Although ESI is perhaps most recognizably represented by electronic mail messages, it may be found in a myriad of other formats and comprises enormous amounts of digital data. Some experts estimate that as many as 161 billion gigabytes of digital data were created solely in the year 2007.[1] A paper document containing an equivalent amount of information would stretch over 92 million miles!

To make matters even more complex, the sheer size of ESI is not the sole issue that must be confronted. After all, digital data can just as easily be duplicated and moved across an array of network systems with a few simple commands. As a result, it has become increasingly complicated to pinpoint the sources and locations of particular pieces of ESI. Indeed, the ESI sleuth will need to navigate through complicated servers, email systems, detachable media, voicemail, and even iPhones, to name a few. Each of these resources may contain information that is pertinent to legal discovery.

In contemplating and integrating ESI into an admissible form with a proper evidentiary foundation, counsel begin to confront an additional series of hurdles—namely, increased expenses and added risk. The combination of these two, and the fear of the unknown that they engender for the uninitiated, has led numerous cases to mistakenly settle prematurely. The arbitration attorney must therefore ensure that expense and risk are eliminated or minimized in tackling these evidentiary legal issues outside the courtroom setting.

Whither Arbitration?

At its inception, arbitration was articulated as a relatively relaxed alternative to complex litigation. The concept was thus born of the idea of giving both sides a straightforward, swift, and cost-effective arena to sort out their differences. Although the myriad rules of evidence generally did not apply, the arbitrator was granted authority to demand production of data, both electronic and not. Parties, however, did not believe that the arbitrator’s mandate was robust enough to accomplish complete discovery. This understanding has transformed arbitration into an expensive and lengthy expedition in which each side is left with the often unsatisfactory results of, at best, a partial discovery process.

Nonetheless, arbitration may be favored by parties because, if nothing else, it is still viewed as being less costly than traditional litigation. This perception is based on the greater latitude granted by state and federal courts for expansive and expensive discovery requests in response to motions to compel discovery. In litigation, this outcome is particularly discouraging when strict deadlines must be confronted and enormous amounts of ESI must be accounted for as part of the discovery process. Thus, arbitration, as flawed as it may be, is preferable from a cost-savings perspective because it allows for additional limitations as to the scope of ESI that will be admitted into evidence.

There are other benefits as well. Arbitration offers a secure, proven forum for airing and managing controversial pre-hearing dilemmas. In addition, the traditional rules of evidence do not fully govern in an arbitrational setting, and the perceived procedural shackles of litigation are therefore less restrictive in arbitration. These advantages dovetail quite well when supervising large-scale and specific ESI requisites in an arbitrational setting.

When Worlds Collide

Many have been baffled as to how e-discovery should be conducted in practical terms once ESI becomes pertinent to an arbitration. This is perhaps due to the enormous amount of possibly discoverable ESI and the expenses associated with producing it to the other side. In these and other arbitrational settings, the arbitrator should take the lead by setting up a case management conference to be attended by both parties. The conference should be of substance in terms of time and content and be attended, preferably, by the parties in person. In addition, it is recommended that the parties’ information technology representatives be present as well to review, explain, and query the ESI in question.

During the case management conference, the arbitrator should mandate a litigation hold on all pieces of relevant ESI. If the parties have previously agreed to a litigation hold, the terms of the litigation hold should be scrutinized at the case management conference for all permutations of ESI along with any pertinent retention or deletion timetables to ensure that no ESI is manipulated. In addition to a methodical march through the many ESI options that may exist, including third-party and legacy systems, it is recommended that the parties review at this time the production formats and search terms to be employed thereafter.In intricate cases, arbitrators have become accustomed to ordering sampling as a form of search term verification. Sampling can be imposed by an arbitrator when the parties may be dealing with an enormous number of ESI search terms. In doing so, the arbitrator crafts less invasive and more limited ESI searches to evaluate the helpfulness of repeating the partial sample searches more extensively. While this method may not yield consistent results, it is a practical substitute to sanctioning an indiscriminate search, which would be likely to increase the time and costs associated with interrogating the ESI.

Conclusion

E-discovery and arbitration need not be incompatible. Indeed, the fact that arbitration is the forum for resolving the parties' dispute can play a vital role in determining a party's ESI interests in a manner that is both swift and equitable. Consequently, arbitrators must be familiar with the workings of ESI to better manage the e-discovery likely to appear in their next case, so that the perceived advantages of arbitration are not lost in the process of handling ESI in the arbitrational setting.

Really?  I’ve spoken with many attorneys even in today’s tech savvy environment and this response is still common when I ask them if the cases they litigate involve eDiscovery.  In fact, over 95% of all cases involve some form of electronically stored information or ESI.  Even if an attorney says they only deal in paper, the content that is printed out on that paper, in all likelihood, was generated on a computer somewhere.   From the smallest of cases to the largest, “We all do eDiscovery.”  The question should not be, “Is eDiscovery relevant in my case,” but “How can I better manage my case by using eDiscovery.”

Is the existence of ESI a burden or a blessing?  Many litigants who say they don’t do eDiscovery often are the litigants who position themselves nearest the door during a CLE presentation on eDiscovery, or they avoid talking about the subject all together.  The main reason given is that, “I don’t want to engage in eDiscovery because it’s too expense and complicated.  I’d rather stay with paper.”  They believe that it is a burden to handle discovery information in an electronic format.  This belief system actually creates more of a burden than avoids one.  When ESI is reduced to paper form a number of things happen: 1) the document becomes static and unsearchable except to the human eye; 2) paper often becomes lost during the course of litigation and new copies have to be printed; 3) paper is difficult to organize into separate categories without multiple copies being made; 4) the ability to electronically search aspects of the document are not available such as author, sent date, subject line, etc.

On the contrary, when ESI is maintained in an electronic format a number of advantages arise: 1) the documents can be maintained in a database for easy access; 2) the document never gets lost since it is electronically stored and is regularly backed up; 3) the content of the document can be searched electronically and even thousands of records can be searched simultaneously in a fraction of the time it would take to search an equal amount of paper; 4) document characteristics can be searched such as author, date created, date sent, subject line, etc.  The actual cost of handling litigation, no matter what the size of information involved in discovery, is actually less expensive in today’s world and much more efficient if one “Does eDiscovery.”

I served as a litigation support manager and analyst in two AMLAW 100 firms as well as litigation technology consultant to other law firms spanning 15 years and nowhere did I see a situation where handling a case “electronically” or “digitally” was more costly or more burdensome.  On the contrary, the opposite was true and still is.  Prior to the new Rules of Civil Procedure concerning ESI, the specter of electronically stored information and how do deal with it long scared litigants to “minimize” the scope of discovery.  “I won’t ask for your Pandora’s box if you won’t ask for mine.”  In such cases, I was told personally by the litigants that they are only going to ask for paper as if they could freely pick and choose what evidence to build a case with.  Not only did this mindset do injustice to their own clients’ interests, it also put them at a disadvantage.

With the adoption of the new FRCP concerning electronically stored information, the luxury of picking and choosing evidence is going away as well it should.  Advances in technology have lessened the risk of opening that Pandora’s Box and actually enhanced the discovery process itself.  Information can be processed exponentially faster than ever before and searched with greater clarity.  As the volume of information that is drawn into the discovery net increases, the tools to fish have become more sophisticated and efficient and arguments that eDiscovery requests are over burdensome are getting less and less traction in the courts.

It’s actually a good time to admit that you “Do eDiscovery” and to seek the expertise of those who have walked in your shoes before.  An eDiscovery expert can 1) give early direction to limit the scope of how much ESI is needed to collect through the Meet and Confer process; 2) provide best practices to cull the collected data down; 3) provide tools for early analysis of the data; 4) design searches to identify key records, or group-tag potentially relevant or privileged records; 5) design review criteria to increase review rates and reduce time in review; and 6) help plan the production of evidence.  The result will be greater control over the evidence and more efficient handling of your case.

In conclusion, eDiscovery should be embraced rather than avoided.  While many litigants in large firms understand the benefits of eDiscovery and who are aware of the changes to the FRCP as well as state versions of the same, there is a large pool of attorneys in these large as well as mid-size and smaller firms who do not.  This article invites you to explore the option of your first question in discovery being, “Where is the ESI?” rather than it being your last question.

*Jeff Steve, Esq. is based on Los Angeles, California where he works for eClaris, Inc., an e-discovery and computer forensic consultancy and service provider dedicated to helping law firms and corporations classify process and review electronically stored data.  He can be reached at 213.270.1465, jsteve@eclaris.com or through www.eclaris.com.

 

In "EDD Tale: Caught in the Middle" Computer forensic examiners can find themselves the scapegoats in discovery battles" an article posted on November 23, 2009, Jason Krause discusses a case in which an ediscovery vendor found itself defending against a motion for sanctions.

http://www.law.com/jsp/lawtechnologynews/PubArticleLTN.jsp?id=1202435729989&EDD_Tale__Caught_in_the_Middle. 

 The article refers to the case Technical Sales Assocs., Inc. v. Ohio Star Forge Co., Nos. 07-11745, 08-13365 (E.D. Mich. May 1, 2009).  In that case Midwest Data Group was retained to search for certain terms in email.  When conducting its search, the company found no responsive email, but it also found evidence that 70,000 email had been deleted immediately after the court discovery order.  The vendor was supposed to produce its findings to the defendant, and it did report that it found nothing.  It then reported to the plaintiff, that it had found evidence of spoliation in the 70,000 deleted files.  This led to the defedant's counsel seeking sanctions against the vendor.  One problem is that the vendor had no instructions regarding what to do in such a circumstance.  Vendors need clear, understandable instructions and that it may advisable for them to participate in early conferences with counsel.  Another problem is that the vendor jumped to a conclusion - while the destruction of 70,000 emails immediately after a court order is suspicious, and best practices would have had the client suspend normal operation of its document destruction policy pending discovery, that destruction is not in and of itself proof of spoliation.  The vendor was also in an unclear situation regarding to whom it owed a duty - the court or the defendant that was its immediate client. 

This situation can create quite an ethical thicket, not just for the vendor but for counsel as well.  An attorney has an ethical obligation to disclose a fraud that its client perpetrates on the court.  Disclosure at some point may have been necessary, but before the vendor jumped the gun and reported a conclusion that spoliation had occurred, the vendor should have brought the evidence of destruction to its own client. 

 In the Law.com article, Krause argues that the case is support for the need for better training in forensics.  This doesn't seem like a lack of forensics knowledge on the part of the vendor.  It's pretty basic to know whether or not email was deleted.  Whether that deletion amounts to spoliation is a legal question.  While forensics experts should be expected to know rules about evidence preservation, chain of custody and evidence handling, they should not have to be lawyers.  To me this case is a good lesson that the ediscovery or forensics vendor needs to be clear what it is being asked to do.  There are also a number of ethical questions that need to have clearer guidelines within the nascent forensics profession.  The attorneys who retain the experts also need to make sure that their instructions are adequate. 

Most litigation support staff understand the basic challenges of electronic discovery. However, while many forensic methods are used in e-Discovery, computer forensics is a unique discipline.

“[F]orensic science is the application of a scientific discipline to the law, the essence of all forensic disciplines concerns the principles applied to the detection, collection, preservation, and analysis of evidence to ensure its admissibility in legal proceedings. Computer forensics refers to the tools and techniques to recover, preserve, and examine data stored or transmitted in binary form.” 
— Kenneally, Erin, “Computer Forensics,” The Magazine of Usenix& Sage, August 2002 Volume 27-number 4

This article will focus on practical issues faced by litigation support professionals when the use of computer forensics techniques and analysis are required. The potential of computer forensics has been almost always confined to criminal cases, but it can be very useful in civil cases as well. The biggest mistake litigation support personnel make in evaluating their need for forensics is looking to their internal IT departments for forensic support.

Understanding Where Forensics Will Be Useful

(a) Collections. In the context of civil litigation, computer forensics are most frequently used in the collection of evidence. Forensics experts are trained in acquisition methods that ensure the authenticity of evidence. The mere act of turning on a computer causes information to be written to the computer’s hard drive. The forensics expert will gather the information from the computer using special hardware and software tools that will ensure no changes to the data stored on the computer. In many litigation matters, evidence is collected by in-house IT staff, and not by forensics experts. This method of collection always results in the loss of some metadata. This metadata is not always material to the lawsuit; however, the best way to ensure that evidence collected is forensically sound and admissible in court is to have evidence collected by forensics experts or technicians trained in forensic acquisition methods. The EDRM model does not specifically require forensic collection, but forensic collection – whether of a full hard drive or simply logical files – works well for the collection phase of the EDRM.

(b) Analysis. Forensic analysis can obtain considerable information from a hard drive. It is often possible to recover deleted files, and in many cases even deleted and reformatted partitions. The date that a file was created, by whom, when it was changed, if it was copied off to an external drive, if it was sent in email are all possibly recoverable. Forensic techniques can often identify and break encryption or find information that was hidden deliberately with tools like steganography (hiding documents in pictures). In addition to criminal cases, forensic analysis can be useful in a number of civil cases, particularly if there are issues of fraud, if timing is critical, or if lost documents are needed. Forensic analysis can be very useful in cases of intellectual property theft, and in actions for wrongful termination.

Finding Forensic Experts

Most litigation support personnel are very familiar with methods for finding experts. One additional consideration for forensics are forensic specific certifications. There are a number of certifications, both third party and from vendors. The Computer Forensics Certified Examiner (CFCE) for law enforcement personnel and Computer Certified Examiner (CCE) (the CFCE for non-law enforcement personnel) are respected vendor neutral certifications. Another frequent certification is the Global Information Assurance Certification Certified Forensics Analyst (GIAC-GCFA) which is primarily connected to the SANS Institute programs. The Encase Certified Forensic Examiner (“ENCE”) is a vendor certification, but well-regarded because it involves both a written a practical exam and because Encase is the most frequently used forensic acquisition and analysis software.

Understanding the Limitations of Computer Forensics

Many forensics experts fear the “CSI Effect”. This is the belief that many people get from watching CSI on TV that forensics is infallible and instantaneous. On CSI the forensic analyst turns on the computer, guesses the password as the suspects daughter’s name and magically all data on the computer is easily accessible. Computer forensics is incredibly powerful in its own way, but it is often painstaking and tedious. The analyst often must spend hours studying a hard drive, looking at hexadecimal code, counting the bits and bytes forward and back, in order to find the hidden information. If a password is involved and it is cracked, that is usually just a starting point for investigation.

Understanding That IT is Not Computer Forensics

Due to the uniqueness of forensics as a discipline, the IT staff is not likely to be forensically trained. Many times the IT staff will want to look at a hard disk with data recovery tools, but they are not forensics analysts. One of the ways in which evidence is often damaged is when IT staff start poking through disks without using write blockers. IT staff lack the training to get the information while leaving the original intact, and they lack the training to do in depth analysis. They may know quite a bit about file systems, but they are unlikely to have had the in depth training into all the virtual crevices on a hard drive that would be the province of a forensic analyst.

Conclusion

Whether using it as part of e-Discovery, or as a key tool in proving a case, computer forensics can be extremely valuable in litigation. The key is to use forensic collection methods, be aware of what forensic analysis can provide, be aware of what it cannot provide and make use of the right experts.