digital forensics & ediscovery overview prepared for charlotte arma chapter september 20, 2007...
Post on 13-Jan-2016
220 Views
Preview:
TRANSCRIPT
Digital Forensics & eDiscovery Overview
prepared for
Charlotte ARMA Chapter
September 20, 2007
Copyright © 2007 Document Technologies, Inc.
DTI | Discovery Solutions | Confidential 2
The Post 12/1/06 World
• New Federal rules governing discovery and production codified existing case law and changed the face of ‘document discovery’
• Shortened timeline for planning, discovery and production
• Significantly impacted ESI collection, processing, review and production
• Confirmed expansion of the scope of discovery and, consequently, reinforced significance of developing and adhering to comprehensive corporate record retention policies
DTI | Discovery Solutions | Confidential 3
Sources of Electronic Data
DTI | Discovery Solutions | Confidential 4
New Sources of ESI
• IM• VOIP• MP3 Storage Devices (iPods)• Memory sticks and flash drives• Global positioning systems • Blogs
DTI | Discovery Solutions | Confidential 5
EDD Page Counts
• 1 Megabyte (MB) will average around 75 pages• 1 Gigabyte (GB) will average around 75,000 pages• 1 Terabyte (TB) will average around 75,000,000 pages
• Email average 1-2 pages per each• Word Processing File average 5-8 pages per each• Spreadsheets average 15-30 pages per each• Presentation average 12-24 pages per each• Graphic average 1 page per each• Adobe PDF File average 35 pages per each
• Diskette 1.44 MB if full 50-150 pgs• Zip Disk 100 MB or 250 MB if full 7,500-18,750 pgs• CD 640 MB - 800 MB if full 48,000-64,000 pgs• DVD 4.7 GB - 17 GB if full 350,000 - 1.3 million• Tape Drive 2 GB - 360 GB if full 150,000 - 27 million• Hard Drive 20 GB and over if full 1.5 million and up
DTI | Discovery Solutions | Confidential 6
• Treat an attorney review like a production process– Predict cost & time– Cost of attorney review is always more than
document processing costs
• Have forensically defensible processes in place
• Rolling deliverables of data from vendor• Linear review vs. Non-Linear Review
EDD Workflow Best Practices
DTI | Discovery Solutions | Confidential 7
Think of document review…
as a manufacturing process
– Require progress reporting and production statistics
• How many documents per hour reviewed?• How long will it take to complete?• Which attorneys are reviewing above average
rates?
– Manage audit and quality control processes
DTI | Discovery Solutions | Confidential 8
• Adoption of the long-awaited federal rule changes
• Managing parent-child relationships
• Clarification on the role of metadata in litigation
• Communicating effectively with opposing parties
• Proper evidence handling procedures
• Processing volume is increasing
2007 EDD Trends
DTI | Discovery Solutions | Confidential 9
• Save Time and Money– De-Duplication Reduces File Review Time– Obtain Full Data Fields Without Coding Expense– 100% Accurate Text– Rapid Filtering and Searching– Produce and Share Tremendous Volumes of Information
Quickly
• Learn More– Extensive Meta-Data – Uncover Hidden Data and Comments – Show Tracked Changes
• Find Critical Information Early and Make Better Strategic Decisions
EDD Advantages
DTI | Discovery Solutions | Confidential 10
Small• Convert all• TIFF for blowback
• TIFF and data for online review
Large• Consulting and
collection• Multiple locations for
acquiring data• National, multi-party
review• Thorough plan in
place long before we see any data
Medium• Multi-pass review• Data only with
native files• Hosting• Searching /
filtering, production sets, etc.
Data Processing Scenarios
DTI | Discovery Solutions | Confidential 11
1. Prevent Spoliation2. Formulate Discovery Plan3. Limit Scope of Discovery Request4. Seek Cost Shifting5. Collect Documents6. Process Documents7. Review Documents8. Produce Documents
Responding to EDD Requests
DTI | Discovery Solutions | Confidential 12
• Develop a discovery response plan and standard spoliation letters to opposing party and to client in advance
• Implement spoliation plan upon occurrence or anticipation of litigation (suspend backup recycling and archive deletion, etc.)
• Make all parties aware of possible sanctions– Penalties– Adverse inferences– Preclusion from arguing issues
1. Prevent Spoliation
DTI | Discovery Solutions | Confidential 13
• Evaluate universe of media• Monitor and enhance spoliation prevention
measures• Determine method of review• Determine production format• Select parties to assist with process• Establish schedule for production process
2. Formulate a Discovery Plan
DTI | Discovery Solutions | Confidential 14
• Determine whether argument can be made that request is overbroad
• Determine whether argument can be made that request is unduly burdensome
• Suggest narrower/less burdensome alternative or alternatives to request
• Negotiate search protocol
3. Limit Scope of Production Request
DTI | Discovery Solutions | Confidential 15
• Analyze facts based on relevant case law– Rowe, UBS, Sedona Principles
• Availability from other resources
• Total cost vs. total at stake
• Resources of the parties
• Ability of and incentives for the parties to control costs
• Relative potential benefits
• Move for shift/share to requesting party • Argue in the alternative for narrowing the
request
4. Request Cost Shifting/Sharing
DTI | Discovery Solutions | Confidential 16
• Begin early
• Consider all relevant media & don’t forget the hard copy documents
• Maintain chain of custody and record of recovery procedures
• Never Conduct a “Home-Made” Review– Why approach electronic files differently than hard copies– Potential conflicts of interest– Lack of consistency or understanding of process– Risk of damage to data or documents– Don’t give opposing counsel a reason to put them on the stand– You don’t want to lose the case over this process
5. Collect Responsive Data / Documents
DTI | Discovery Solutions | Confidential 17
• Use litigation specific conversion software
• De-duplicate files
• Extract hidden information
• Cull Results by date and search terms
• Create combined database of hard copy and e-files for more powerful review
• Consider manual coding or auto-coding of paper document, particularly if present in volume
6. Process Electronic & Paper Documents
DTI | Discovery Solutions | Confidential 18
• Never work with original electronic document
• Use litigation-specific software to review– Ability to efficiently view native documents– Ability to easily tag issues, relevancy– Ability to redact privileged and confidential information– Ability to annotate important documents– Ability to share access with co-counsel
• Methodically track “review production”
• Electronically bates number production sets, not necessarily originals
7. Review Data and Documents
DTI | Discovery Solutions | Confidential 19
8. Produce Data and Documents
• Produce in the appropriate format– Closely monitor production to avoid unintended
disclosure of meta-data– TIFF or PDF images are preferable– Avoid producing native documents unless it provides
a substantial economic benefit
• Produce in timely manner
• Maintain comprehensive production history– What was produced, to whom and in response to
what
DTI | Discovery Solutions | Confidential 20
• Identify all potential data sources within the organization
• Issue notice to all appropriate employees to preserve all documents, including e-mail, relating to the matter after consulting with counsel on scope of litigation hold communications
• Identify someone to locate and gather the data in a manner that is forensically defensible!
• Inventory the resulting media and maintain chain-of-custody documentation
• Restore the data from backup media only after consulting counsel
• Convert, dedupe and cull the data prior to release for relevancy review by counsel
• Load the resulting data to a system specifically tailored for litigation-related document reviews
ESI Collection Checklist
DTI | Discovery Solutions | Confidential 21
1. Failing to Have a Data Collection Plan
2. Failing to Prioritize the Data
3. Neglecting to Conduct Thorough Interviews
4. Ignoring Key Data Locations & Important File Types
5. Conducting Do-It-Yourself Data Collection
6. Performing Ad Hoc Desk-side Collection
7. Failing to Mirror Image v. Imaging Excessively
8. Limiting Names
9. Assuming IT Can Manage on Their Own
10. Failing to Maintain Proper Chain of Custody
TOP 10 DATA COLLECTION PITFALLS
DTI | Discovery Solutions | Confidential 22
• Morgan Stanley Case
– “Failure to produce all e-mail attachments was negligent”
– Discovered & revealed by 3rd party vendor
– Led to jury awarding plaintiff over $1.45 billion
• Attachment handling procedures subject to increasing scrutiny
• Dynamic links between host email and attachments vital to effective document review and production
Dealing with Attachments to E-mail
DTI | Discovery Solutions | Confidential 23
• You cannot impose the paper practices on the ESI
• Redactions can’t be done to e-data except via images (TIFFs, PDFs)
• Document production are much more complicated with ESI-sourced documents. Plan, test and verify agreed upon production methodology
• Best Practice Tip: Rolling deliverables to manage the volume
Paper Versus Electronic Documents
DTI | Discovery Solutions | Confidential 24
eDiscovery Response Team
DTI | Discovery Solutions | Confidential 25
eDiscovery Workflow Plan - simplified
DTI | Discovery Solutions | Confidential 26
In Conclusion…
• Stick to your discovery response plan but be flexible
– Maximize planning and assessment
– Consider variety of options
– Apply proportionality assessment
• Continuing education– Track current technology trends
– Stay on top of legal developments
• Utilize technology and resources effectively– In-house resources (IT, legal staff, etc.)
– Vendors
DTI | Discovery Solutions | Confidential 27
• Courts are not afraid and, in fact, increasingly prone, to hold companies accountable for deficient discovery practices
• Courts consider electronic data a part of mainstream discovery & are unwilling to tolerate destruction of relevant information
• Counsel, organizations & individuals must take affirmative steps to prevent intentional and negligent spoliation
• Spoliation as a result of document mismanagement is now seldom, if ever, excused
And Remember ….
top related