Computer Forensics and E-Discovery Blog : Computer Forensics & E-Discovery Specialist : Electronic Evidence Retrieval L.L.C. : Data Recovery, Hard Drive Retrieval, Deleted Files : New Orleans, Louisiana

Jason R. Baron wrote a guest blog,  DESI, Sedona and Barcelona, in Ralph Losey's blog e-Discovery Team.  In the blog, Jason Reports from the DESI III Global E-Discovery/E-Disclosure Workshop at ICAIL 2009 and The Sedona Conference® International Programme on Cross Border E-Discovery and Privacy.   He reports on many of the individual presentations and has some great links.

Jason reports  a familiar refrain, being prepared for the Rule 26 "meet and confer" and his interesting study on "asymmetric preparation" for the meeting.  He also discusses the use of testing e-discovery plans before launching full fledged e-discovery, a procedure similar to Judge Shira Scheindlin’s "Rolling Discovery" that I reported on previously.

Another trend among the presentations was the use of clustering techniques reduce the size of the ESI that has to be reviewed.

What encouraged me most about these conferences is the genuine sharing of researchers with practitioners-attorneys.  From my experience of 40 years in academe, I know that such collaborations between theoretical research and practitioner are not a given.

I'm interested in hearing from attorneys who have been through an e-discovery case.  What worked?  What didn't work?  What will you do differently next time?

• Email This
• Print
• Comments & Questions
• Trackbacks

I just came across Jeffrey Beard's white paper on litigation holds, a must read for folks relatively new to e-discovery and a good idea for those who have more experience.  It concludes with 10 best practices for litigation holds.  He emphasizes planning ahead for e-discovery, strategies for putting the hold in place (categorize ESI with respect to potential spoliation), and ongoing communication.  He also argues that litigators can use the Rule 26 hearing as an advantage by setting the scope of discovery, a refrain I've been singing for some time.

• Email This
• Print
• Comments & Questions
• Trackbacks

My last post  highlighted an observation by Judge Shira Scheindlin’s, judge in the seminal Zubulake v UBS Warburg, in a podcast with Ralph Losey, attorney and frequent e-discovery blogger.

Both have wise and thoughtful comments on both e-discovery and legal education. However, Judge Scheindlin introduced one idea that is, I believe, so important as to merit an entire discussion by itself.

In expressing concerns about the cost of e‑discovery being used as a bludgeon to force defendants to settlements in order to avoid the costs of e-discovery, she advocates “rolling discovery.”

And I know there’s been a fear, I hear it all the time in The Bar, that the cost of e-discovery is shifting the ground in terms of the ability to extort settlements. But I do think … that there is no need to try and find every piece of relevant email, but you should instead scale your search. We should be thinking in terms of rolling productions in a series. Let’s start off – let’s see what we can get in an economical manner and produce that first, and then come back with secondary, more focused discovery. Because, you know, I don’t think you should have to spend a million dollars to find electronic evidence if the case is two million. I think that’s where you go immediately for protection and do not allow yourself to be extorted.

I used to do human factors research.   We often had questionnaires for subjects to complete or had materials subjects had to manipulate. Before we started the study, we tried the materials out on ourselves, graduate students, and teaching assistants. We used the testing to identify typos, confusing instructions, or a missing step. If we were trying to get funding for the study, we would do a small study, called a pilot study, which we used to show agencies as proof of concept.

Rolling discovery has the same concept. A smaller initial discovery request would test the search terms and criteria. It could be used to develop a realistic estimate of the eventual costs and could let attorneys begin their review earlier in the production process. It could verify an argument of some materials not being “reasonably accessible” as provided in the e-discovery amendments to the FRCP.

A question to my readers: What would have to change in order to implement a rolling discovery process? What are the obstacles to a rolling discovery procedure?

• Email This
• Print
• Comments & Questions
• Trackbacks

Shira A. Scheindlin is a United States District Court judge for the Southern District of New York and she presided over the pivotal e-discovery case Zubulake vs. UBS Warburg. Her rulings, known as Zubulake 1 through 5 set presidents for the practice of e-discovery.    Ralph Losey is an attorney and frequent blogger on e-discovery.  

Judge Scheindlin and Ralph recently participated in a podcast focusing on e-discovery education. Judge Scheindlin included several observations about the state of e-discovery; however, her comments on the state of, and future of, e-discovery are insightful. Speaking of the future of e-discovery, she said:

We used to say there’s e-discovery as if it was a subset of all discovery.  But now there’s no other discovery. [Emphasis added.]

As an e-discovery expert, I’ve had countless attorneys and even some judges argue that e-discovery is one of the worst ideas any litigator every heard of—that e-discovery is not needed. I’ve heard attorneys tell me that they have agreed with opposing counsel that a particular case does not “need” e-discovery. [More about that in another posting!]

Since 90 % of new communication is said to be done electronically, I’m certain that she is correct in judging the pervasiveness of e-discovery in future litigation. I’m sending copies of her remarks to a bunch of the attorneys I know who share the attitude that they can ignore e-discovery if they wish. 

I welcome questions and comments. 

• Email This
• Print
• Comments & Questions
• Trackbacks

I came across a prognostication from Mary Mack, Corporate Technology Counsel at Fios. She offers 20 predictions re e-discovery for 2009. Some are funny and some are scary. I will be discussing several of them in future posts, but for now, they are well worth reading.

1. White collar defendants will be sunk by criminal e-discovery evidence rules created by case law involving drug dealers and child pornographers.
2. The financial crisis will increase the volume of e-discovery in bankruptcy courts and cause such a backlog with the magistrate judges that the use of special masters and mediators will double or triple.
3. In the wake of the financial crisis, law firms, IT departments and corporate legal departments will create a surfeit of top e-discovery talent as layoff by machete takes hold.
4. Credit-constrained vendors and service providers will not be able to scale on demand and will cut corners on redundancy and backup that will severely impact a client's case.
5. Software as a Service will start gaining inroads due to lack of credit and a reluctance to make capital purchases.
6. Laid-off financial services professionals will join review teams to troll through instant messaging.
7. A major government official, board member, officer or partner will be held personally responsible for e-discovery spoliation or obstruction.
8. Key cases will be used liberally: Lorraine will be used to challenge authenticity and admissibility; the Qualcomm CREDO will be issued; and Mancia, American Home Products and Qualcomm will be used to determine whether sanctions apply.
9. Family law will bring e-discovery to the state level, keeping solo forensics practitioners fully engaged.
10. A magistrate judge will get so frustrated he or she will write a sanctions opinion with the words "COOPERATION PROCLAMATION" in all caps.
11. There will be many more law schools offering e-discovery courses for credit.
12. e-Discovery providers will discover diversity and alternative billing.
13. There will be a dramatic increase in international e-discovery (e-disclosure) requirements due to the financial crisis, arbitration, class actions and competition law.
14. The number of practitioners sporting "Technology Counsel" titles will triple.
15. The federal government will create an e-discovery response team in reaction to the recent White House archiving and SEC email issues.
16. Web 2.0 will start to emerge as the next technical/legal challenge (dynamic, multi-company content).
17. e-Discovery attorneys and providers will do more case-level pro bono work, supplementing educational and rule-making activities.
18. SOX guidelines will be applied to the legal hold process.
19. Insurance providers will get involved earlier and more visibly in the e-discovery process.
20. Law firms will be sanctioned for not having their own e-discovery houses in order.

  I'd certainly be interested in any predictions my readers have.

• Email This
• Print
• Comments & Questions
• Trackbacks

I’m always on the lookout for good templates for e-discovery documents and orders. In Star, Inc. v. QFA Royalties LLC, No. 07-cv-02223-WYD-CBS (D. Colo. Filed Oct. 10, 2007), Magistrate Judge Craig B. Shaffer issues an excellent e-discovery order. In it, he calls for an E-discovery Liaison.

To promote communication and cooperation between the parties, each party shall designate a single individual through whom all e-discovery requests and responses are made (“the e-discovery liaison”).

Judge Shaffer specifies that each E-discovery Liaison must be:

a. familiar with the party’s electronic systems and capabilities in order to explain these systems and answer relevant questions;

b. knowledgeable about the technical aspects of e-discovery, including electronic document storage, organization, and format issues;

c. prepared to participate in e-discovery dispute resolutions; and,

d. responsible for organizing the party’s e-discovery efforts to insure consistency and thoroughness and, generally, to facilitate the e-discovery process.

In the remainder of the order, he addresses many of the topics I have been discussing: searching strategy, timing, the format of the production (including metadata), document retention and preservation (AKA Litigation Hold), privilege, and costs. 

Questions and comments are welcome. In particular, I’d like to know of any other model orders, letters, and other forms for e-discovery.

• Email This
• Print
• Comments & Questions
• Trackbacks

Koosharem Corp. v. Spec Personnel, LLC, 2008 WL 4458864 (D.S.C. Sept. 29, 2008) has a well known “story line” but is very interesting in two respects. 

Kenneth Fuston was a former employee of Koosharem who left to join SpecPersonnel. The plaintiff alleged that Fuston took confidential information, used it to hire some 20 of the plaintiff’s employees, and started a business in direct competition with the plaintiff.

The court ordered that the Fuston produce to produce emails between himself and any current or past employee of either company from both his home and work computer. He produced 1,936 pages of email, however

Plaintiffs noted several problems with defendants’ original production.  Notably, all of the emails produced reflected the date compiled rather than the date received or sent, several emails allegedly retrieved from Trevor Doyle did not have Doyle listed as a sender or recipient, and many emails were missing their attachments.  These irregularities, plaintiffs argued, called the authenticity of the documents into question.  Plaintiffs also argued that documents were modified even after notice of litigation and that defendants made no document retention efforts after the lawsuit was filed.  Specifically in support of production of home computers, plaintiffs argued that defendants’ new hires were not immediately provided with a company email account and thus conducted work from home computers and personal email accounts.  Also, according to the plaintiffs, former employees emailed confidential information to their homes before going to work for defendants.

The court granted the second motion to compel and required forensic inspection of, not only the defendant’s home and work computers, but also those of the employees who left Koosharem and went to SpecPersonnal.

I’m frequently asked for samples of various documents needed in e-discovery, for example, a litigation hold letter. In issuing his order in this case, Judge William M. Catoe included a detailed, 20-step protocol for conducting the forensic analysis. He includes a time line as well. It is excellent and I recommend it to anyone looking for a template for an expert examination of ESI devices.

Secondly, note that the home computers of the plaintiff’s ex-employees’ were subjected to forensic analysis. More and more I find myself recommending that you keep your personal and business communication and data strictly separated. I understand the convenience of sending a personal email from a work machine in the middle of a busy day (or sending a business email from a personal account at night), but as I see more cases in which inspection of personal, home computers is compelled, I’m beginning to think the risks are too high.  

• Email This
• Print
• Comments & Questions
• Trackbacks

Today’s blog is about deleting files and file slack space, a rich source of evidence for the forensic examiner—and a favorite topic of mine.

Most people have heard the expression “formatting a disk.” Formatting a drive divides up the space on the drive into pieces called sectors. Each sector has a numeric address. As an application needs disk space, the operating system assigns it enough sectors to fill its needs. To keep track of “who’s got what,” the operating system keeps a directory that is much like a phonebook.   When a user needs to access some data, the operating system goes to the directory and looks up the data’s location.

  But what happens when you delete a file that was stored in one or more of these sectors? Again, the operating system goes to the directory and finds the data’s location. However, rather than actually deleting (removing) the data, all the operating system does is place a special mark in the directory indicating the disk space is no longer needed and can be reassigned to other applications that need space. Nothing is done to the file itself. The file just remains on the drive

until the operating system reassigns the space to some application. It is much like a renter who is told by the landlord “I’m going to put the house on the marked, but you can stay until the new owner moves in.”

What happens when the operating system eventually reassigns the space? The first thing to know is that when disk space is needed, operating system assigns whole sectors at a time. That is, an application needing 2 ½ sectors would be assigned a full 3 sectors. When the information is

written to disk, the first 2 ½ sectors is over-written, leaving the last ½ sector unchanged. This unchanged space between the end of the file and the end of the sector is called slack space or simply slack. 

What is in the slack space? Remember, when a file is deleted the operating system only marked the space as available to be reused. If a new file only takes up a portion of the sector, the old data “stays” there until it, too, is eventually overwritten. In the example of the file needing 2 ½ sectors, the last ½ sector contains whatever was stored there before the overwriting occurred.

Slack space has the potential to contain any information that was ever stored—or even viewed—on the computer. Photos, documents, credit card numbers, internet browser histories, you name it.  The data in the slack space may be whole files or simply fragments of files (most often a mix of the two), but a forensic engineer can view, retrieve and catalog the evidence found in slack space. 

Slack space is a good example of the difference between a user doing a "copy-and-paste" and a forensic examiner making a valid forensic image.    Using "Copy" in our example, only the 2 ½ sectors would be copied, while a valid forensic image copies the entire 3 sectors.

The bottom line?  1, Don't assume that something is gone off your computer just because you can't see it!  2.  And the data in slack space can be the very piece of evidence you need in a case.

• Email This
• Print
• Comments & Questions
• Trackbacks

I came across several interesting items this week so this post is going to be about a variety of things. 

The Round Table Group, an expert services firm, approached me about writing an article for their newsletter. They wanted something different. I ended up writing about some actual scenarios from my practice. Although it was written for the Round Table Group’s clients, “Threading the E-Discovery Maze” is available publically.

IMS Services is another expert placement firm. Their latest newsletter, written by frequent blogger Robert Ambrogi, has an excellent compendium of e-discovery resources. He includes reading materials, blogs, and vendors. 

Recently President Bush signed into law Rule 502, an addition to the rules of evidence. I found an excellent discussion of it at Law.com: “How Rule 502 Affects Lawyers and E-Discovery.”

My expert reports often contain drawings, diagrams, and screen shots. That means they get too large to email. There are a number of web sites that enable you to send large files securely through their website. Robin Good has a list of four such sites along with definitions and range of services. Typically, they work by uploading your material to their website and sending an email to the recipient with a link to download. Some allow you to store materials for a substantial period of time, making them great for collaboration or working away from the office.  Obviously, if you have an ftp site (a technique for transferring files over the Internet), you do not need such services, but many small firms don't.

On July 1, a number of amendments to the rules of civil procedure went into effect in Ohio. According to the Ohio Supreme Court’s press release, key amendments include:

clarifying that issues related to electronically stored information are appropriate topics for resolution during pretrial conferences; clarifying that discovery of electronically stored information is permitted; amending to provide factors a judge should consider in determining sanctions when a party has destroyed potentially relevant electronically stored information; and specifying that a subpoena may be used to obtain electronically stored information from nonparties.

That reminded me that many states are making changes to their state version of the rules of civil procedure. Here is an updated list of the status of e-discovery rule changes in each state.

Ken Withers is Director of Judicial Education and Content for The Sedona Conference®, an Arizona-based non-profit law and policy think-tank which has been on the forefront of issues involving complex litigation, intellectual property and antitrust law.    His thoughtful upcoming article for the San Diego Lawyer Magazine is titled “E-Discovery and the Combative Legal Culture: Finding A Way Out of Purgatory” and proposes a more collaborative relationship between opposing counsel. He gives examples of the explosion of e-discovery and discusses moving beyond the adversarial legal culture. He argues “cooperative discovery” is a means of controlling e-discovery costs.  I’ve had some cases in which the opposing counsel cooperated with each other and some in which the definitely did not. And I can tell you from my perspective, cooperation is better. 

I'd be interested to hear from attorneys what their experience is with cooperative discovery and whether they think it has a chance.

• Email This
• Print
• Comments & Questions
• Trackbacks