The Portcullis Guide to Disclosing Electronically Stored Information (ESI)

Transcription

1 The Portcullis Guide to Disclosing Electronically Stored Information (ESI) Portcullis Computer Security Limited Tel: +44 (0)

2 Who am I? Eight years in Digital Forensics / edisclosure Portcullis since February 2012 LE and commercial clients Worked for both defences, prosecution and plaintiffs People still manage to surprise me!

3 What is edisclosure? Electronic disclosurerefers todisclosureincivil litigationwhich deals with the exchange of information inelectronic format(often referred to as Electronically Stored Informationor ESI). This data is subject to local rules and agreed-upon processes, and is often reviewed for privilege and relevance before being turned over to opposing counsel.

4 edisclosure vs Digital Forensics Forensic principles are applied where possible 1GB of data is equivalent to pages of A4. Expect to work on an average of 5 custodians Approximately 10GB of responsive data per custodian 50 x = 3,250,000 pages

5 edisclosure Putting it in Perspective

6 edisclosure Laws and Guidelines Civil Procedure Rules of England and Wales PD 31 PD 31b ACPO Guidelines for Computer Based Evidence

7 edisclosure Landmark Case Zubulake v. UBS Warburg 2003/2005. Plaintiff was awarded $29.3 million. Set many of the principles applied to ESI today Points to bear in mind are: Do not try to hide things Do not try to destroy things - someone WILL find out

8 edisclosure Early Case Assessment Identify level of exposure Can be used proactively Regulatory bodies can take a pragmatic view Average ECA of five days Dependent on volume of data

9 Electronic Discovery Reference Model Processing Preservation Information Management Identification Review Production Presentation Collection Analysis VOLUME Electronic Discovery Reference Model / 2009 / v2.0 / edrm.net RELEVANCE

10 Information Management Getting your electronic house in order Mitigate risk & expense From initial creation of ESI to final disposition Knowing where all relevant data is can reduce overall costs

11 Identification Aim: To identify: subject matter experts resources involved potential sources of data the depth and breadth of potential liability aggregate information sources for developing a course of action Goal: Evaluate, leverage and mitigate

12 Identification - Data Sources Data requiring examination may stem from many sources: Laptops, (Encryption)? Desktop Systems Servers NAS/SAN Thumb drives Digital Media cards

13 Identification - Data Sources Data requiring examination may stem from many sources (cont): Mobile telephones/blackberry MP3 players, IPOD etc Satellite Navigation Systems Backups (data tapes / cartridges etc)

14 Identification Potential Issues Could data fall outside corporate ownership? BYOD policy Employee status (full time, contractor?) Webmail

15 Preservation Aim: When duty to preserve is triggered, promptly isolate and protect potentially relevant data in ways that are: Legally Defensible Forensically Sound Proportionate Efficient Auditable Broad, but tailored Goal: Mitigate risks

16 Collection Aim: When data needs to be used, collect potentially relevant data in ways that are: Legally Defensible Forensically Sound Proportionate Efficient Targeted Auditable Goal: Mitigate risks

17 Collection Methods Forensic image acquisition Targeted collection of data using specialist utilities Mailbox dumps or complete message database? Client provided data Copying of data using file manager (Windows Explorer, Finder etc)

18 Processing Aim: Perform actions on ESI to allow for: metadata presentation Itemisation normalisation of format data reduction via selection for review Goal: Identify ESI items appropriate for review and production as per project requirements

19 Review Aim: Gain an understanding of document content while organising them into logical sub-sets in an efficient and cost effective manner Goal: Develop facts Reduce risk and cost Leverage technology Facilitate collaboration and communication

20 Production Aim: To prepare and produce ESI in an agreed upon and usable format Goal: Efficient production in compliance with agreed production specifications and timelines Reduce cost, risk and errors

21 Portcullis and edisclosure Natural progression from existing services ECA ensures cost effectiveness CPR Practice Direction 31b Costs dependant on volume of data No per GB processing charges

22 Questions? Portcullis Computer Security Limited