Thanks for joining us today for this presentation about preparing an e-discovery system for Enterprise-scale operations.

Transcription

1 Thanks for joining us today for this presentation about preparing an e-discovery system for Enterprise-scale operations. The demand for e-discovery operations is fairly new to most organizations. Although the potential of digital evidence has been around for many years, only in the past decade has it been recognized as a major source for evidence in civil litigation cases. The sudden, insatiable demand for digital evidence has forced e-discovery environments to expand rapidly, placing additional strain on the IT infrastructure it depends upon. 1

2 Before we go into e-discovery infrastructure, we need to start with a disclaimer. What you hear today should not be construed as legal guidance. We are specialists in the IT field and know how to design efficient, robust, high performance e-discovery systems. While we have acquired a broad understanding of e-discovery principles, we may not fully grasp all legal implications of various courses of action. Given this limitation, please understand than anything we discuss today is in the realm of technical design and not legal opinion. On the other hand, your legal team is usually well-versed on the legal requirements for e-discovery. While they may also have some grasp of the technical issues, they may not fully understand the ramifications that various courses of action will have on the organizations IT infrastructure. Any issues or questions involving e-discovery should be presented to their respective specialists. If they overlap, then a mixed team of IT and legal representatives should be consulted. The best of both worlds is to establish a oversight team consisting of both IT specialists and legal council, and have them meet regularly to review issues involving e-discovery infrastructure and your organization s response to litigation challenges. This is one area where mutual participation by both departments can yield significant dividends. 2

3 So what is e-discovery? E-Discovery describes virtually any process where electronically stored information (ESI) is identified, filtered, analyzed, and reduced to a small amount of potential evidence relevant to a civil litigation case It may be performed off-line in an environment designed specifically for e-discovery searches, or in the field via a computer network. An e-discovery search may comb through hundreds of thousands of files to identify 1-2 sentences than may contain potential evidence. e-discovery searches can include many types of files including regular text, spreadsheets, Instant messages, images, databases, audio files, digital recordings, archived legacy data, and many others. Unfortunately this means that evidence can exist at virtually any place data exists, from primary servers in the corporate data center to memory in your smart phone. 3

4 This slide represents the well-known Electronic Discovery Reference Model (EDRM). It was designed to help identify different phases of the e-discovery process and visualize the relationship between each of these steps. Two other significant activities are represented in this model. On the left-hand side, massive quantities of raw data is ingested during the search process, resulting in less-and-less information to process. However, as raw quantities of data are reduced, the relevance of any remaining data increases dramatically. In the end, literally terabytes of raw information may only yield a few documents worth of data. Although some degree of automation can be introduced in every segment, most of the compute-intensive activities occur in the center of the model, and include the processing, review, and analysis phases. 4

5 E-Discovery is changing how pre-trial discovery is conducted in civil litigation challenges. Today e-discovery sits squarely at the intersection of IT and the law. On one hand the growth of new digital data is occurring at such a rate that companies are virtually swimming in tsunami of stored information. On the other, the courts have a growing expectations for requiring digital evidence in litigation cases. So what makes digital evidence that much different than paper-based evidence? Most paper documents are maintained in human-readable form, and are easy to review. Digital data presents greater challenges, since it exists in magnet form only. Information is stored as magnetized specks on a metallic base. It can easily be altered, corrupted, or lost by the stroke if a single key. In addition, digital data may reside anywhere, and is becoming a far greater challenge to locate, harvest, and filter for interesting content. The result is that e-discovery is becoming more expensive, time-consuming, and burdensome than ever before. Since the use of digital evidence is a relatively new phenomena, many companies lack awareness about e-discovery preparedness and are subject to financial penalties, court sanctions, and lost litigation cases. It can be a very expensive education. 5

6 The sheer VOLUME of digital data being produced now dramatically impacts the e- Discovery process. In addition to the growing output of typical computing devices, it now includes digital files from an array of new technologies. For the purpose of e-discovery, not only relevant file content must be located and evaluated, but its metadata as well. This is information stored about the file itself, and includes creation data, last modification date, file type, ownership and permissions, and many other details about the file itself. This also increases the potential for spoliation modification of metadata parameters that may render it s contents invalid or unusable. The rich variety of emerging digital technology is also producing a growing number of file types (such as.isz,.rmvb,.3ga,.ithmb, etc.) that must be included in a search. The situation is further complicated by having many of the new devices creating and retaining user data outside of areas traditionally used for data storage and backup protection. 6

7 According to a 2006 IDC report, there was approximately 161 exabytes of stored digital data around the world. That is about 3 million times the amount of information in all the books ever written! That same report predicted digital data would increase to around 988 exabytes by In a different report, Cisco estimates that 11.2 exabytes of data per month will be moving across wireless networks by the year Whether you believe these numbers or not, everyone agrees that the growth of digital data the stunning. This creates significant challenges for IT departments, which are struggling to simply keep ahead of the surge data. To this add the challenge of e-discovery, which requires that large blocks of data must be searched to produce potential evidence for litigation defense. To accommodate these demands, tomorrow s E-discovery infrastructure must be carefully designed for robustness, efficiency, performance, and scalability. (Use clicker to bring in) 7

8 In past decades e-discovery would ve been a much simpler process. Digital data was produced by relatively small group of devices, and typically segregated in a computer room or data center. That day is gone forever. Today s digital environment has data being generated by a myriad of corporate and personal devices. Some of the more obvious sources our desktops, laptops, tablets, and smart phones. Some of the less obvious sources are digitally stored voice mails, social media logs, personal backup devices, departmental printers, and data residing in The Cloud. Any of these relatively obscure devices could be a virtual treasure trove of evidence. Emerging technologies will continue to produce new and innovative ways to store information in a digital format, driving the demand for new E-discovery methods and capabilities. These are uncharted waters. 8

9 The growing demand for digital evidence starts during the pre-trial phase of a lawsuit, when each party or the court requests certain evidence from the other party. Almost anything is fair game, since any data that is reasonably calculated to lead to admissible evidence can be requested. This includes all information that might be relevant, rather than being limited to specific content that is known to be relevant. So far there has been no industry-based definition of a legally defensible search can be limited to. The involvement of digital data came to the forefront in 2006, when revisions to the Federal Rules of Civil Procedure introduced practical changes to discovery rules to make it easier for courts and litigating parties to manage electronic records. << Needs Text >> 9

10 Let s take a look at the evidence harvesting process and consider some of the challenges that must be addressed. 10

11 The collection of potential evidence from the field creates its own set of technological challenges to overcome. A first step in this process is to identify and map the location where evidence may reside. In most cases the physical location of target information will directly impact the strategy and tools chosen for the data harvesting process. If potential evidence resides in one physical location and resides in active files, the harvesting process is greatly simplified. Either manual or automated tools may be used to identify and extract the desired information. However if the desired data is distributed across multiple locations, the difficulty of collection is greatly increased. Such challenges as travel budget restrictions, Wide Area Network (WAN) bandwidth limitations, transportation methods, Chain-of- Custody integrity, data upload methods, and long term retention requirements must be addressed. One problem that may be encountered at any location is the growing trend of encrypting desktop storage. This technology may create additional hurdles to overcome, although many vendors now offer offer tools that address the problem of encrypted content. 11

12 As mentioned above locality of the potential evidence will play a significant role in the difficulty of collecting target data. If the search is limited to a local facility, the process is fairly simple. If the search involves remote facilities, additional challenges are introduced that must be overcome. Even so, the process remains relatively straightforward. Much greater challenges are introduced when data may exist across corporate or legal boundaries. Obtaining the cooperation and assistance of other divisions not closely related to the division in the litigation challenge can be difficult. Additional coordination and cooperation challenges may be faced if potential evidence spans arms-length affiliates and partners, and/or independent agents. Additional questions surrounding content ownership and compliance requirements may also be encountered. However the greatest challenge, most from the standpoint of operational processes and technology, is found when potential evidence is required from organizations outside the United States. 12

13 Evidence collection from globally diverse operations may present significant difficulties. These can include significant variations in the laws that protect data, foreign governments restrictions on data privacy, prohibitions limiting or preventing information from crossing national boundaries, and even differences in languages and file types can present almost insurmountable hurdles. Even if the above challenges can be overcome, there still may be significant problems in identifying the location of potential evidence, the collection methods available, incompatibilities in applications and file formats, and even problems with scheduling time for the harvesting process to take place. If the data resides in countries with less stable governments then consideration of local political disputes, the personal safety of the team, and the complexity of sending e-discovery specialists into the country to perform data harvesting must be addresses. Even with a carefully thought out strategy in place, it can, and most likely will be an expensive and time-consuming process. 13

14 So now that we have identified some of the problems facing the data harvesting process, let s take a look at some of the major components that make up an enterprise-scale e-discovery operation. 14

15 Their several key components at the heart of every modern e-discovery system. These include the data storage system the search engine a backup and recovery system a separate data mover remote data harvesting system litigation hold and user communications management workstations a secure and robust network If an e-discovery system is to be truly capable of supporting Enterprise-scale operations, care must be taken with each of these critical components to ensure they do not present future growth bottlenecks for the system. 15

16 A key element of any e-discovery system is the storage subsystem. The SAN or NAS of a suitable capacity will store potential evidence awaiting processing, and maintain post-processing case data until a final disposition is made by the courts. It may also play a significant role in the backup and recovery process. The storage system will play a key role in the overall performance and operations of the e-discovery environment. Careful consideration should go into the planning and design of this equipment. Properly designed storage platform should contain both high-speed disk for top performance and low-speed, high capacity drives to retail less active data economically. The systems should have sufficient scalability for future growth, contain redundant components that will protect operations against failure, an efficient I/O system, and appropriate tools to provide management of the processes. 16

17 Another major component in the e-discovery environment is the evidence processing server or servers. The system should be base upon relatively powerful machines capable of searching through massive amounts of raw data in a relatively short period of time. They may be deployed as individual servers, clustered servers, virtual servers, blade servers, or other possible configurations, based upon the operational requirements of the E-discovery vendor selected. If multiple servers are employed, they should have the ability to share data and load balance operations across all servers. The configuration should also provide some degree of high-availability, ensuring uninterrupted operations in the event one of the servers would fail. As with the storage equipment, particular care should be given as to how well the server equipment can be scaled to accommodate ever-increasing case workloads. 17

18 A good backup and recovery process is you last line of defense against data corruption or loss. Due to the critical nature of potential evidence, it is imperative that there is some reliable method for recovering data. This should be combined with a carefully thought through execution schedule to ensure a sufficient number of backups are taken to minimize risk. In addition to performing backup and recovery tasks, a tape library of sufficient size will provide a number of tape media slots to support keeping several weeks worth of data at-the-ready for an extended period of time. As long as the appropriate media is still loaded in a tape library slot, recovery of off-line data can occur in minutes. This is much more productive than having to request archived information from an off-site facility, then wait until it s delivered and loaded into the tape library. Near-line storage capability is particularly useful when dealing with very large volumes of case data. 18

19 Another important piece of the a discovery operation is the Data Mover system. This is an independent server specifically dedicated to transferring data from one location to another. In the absence of a data mover, the task of I/O operations will default to the content search engines. Since the movement of data requires a significant number of processor cycles, having the content search engines responsible for this task increases its workload and reduces its ability to search through raw data for potential evidence. When not engaged in the transfer of data, the data mover can be used to perform disk sanitization activities on mobile transport media before sending them back to the field. 19

20 Another key function in the core e-discovery environment is the ability to execute automated or semi-automated remote data harvesting. With this system, and e- discovery specialist can identify a set of search parameters and send them to remote machines for execution. If there is sufficient LAN/WAN bandwidth, the remote search can be executed and the results transferred back to the E discovery environment for processing. If bandwidth limitations exist, search parameters may still be sent to a remote location with instructions to harvest and output the results to a local transportable data medium for shipment back to the e-discovery center. An automated data harvesting system usually requires the installation of a small piece of code or agent on each desktop to facilitate inter-communications between the data harvesting workstation and itself. Organizations with a large number of desktops should consider embedding this agent in the standard desktop golden image. 20

21 A litigation hold workstation is a critical tool for orderly case management. Although features may vary from vendor to vender, the system should be capable of end-toend management of the Litigation Hold process. It keeps track of schedules and deadlines, employee notifications, data custodians, and other details pertaining to each case. It serves as a central point of communications between all parties involved in the evidence gathering process. It also maintains historical information about past cases that is available for review and reporting. A properly designed Litigation Hold Workstation can be an invaluable tools that can same time, money, and critical details about each case. 21

22 Another important piece of the environment is a dedicated user communications portal. Litigation hold activities normally fall while out of the mainstream of daily work activities. It is easy for the e-discovery team to overlook the importance of frequent communications with the rest of the organization about activities that may involve users at the personal level. Creating a dedicated e-discovery portal that provides regular updates, schedules, new case activities, and other content pertinent to the user greatly improves the level of acceptance and compliance of required e- discovery activities. In addition to having the portal technology in place, it is important to task one or more individuals with the regular update of content on the portal. Great care should be taken to ensure information provided via this portal remains current and relevant to the readers. 22

23 The network infrastructure supporting the e-discovery environment acts as the glue that keeps everything together and functioning properly. This includes both the Ethernet LAN and the fibre-optic SAN fabric as well. For both security and performance reasons, the e-discovery networks should be isolated by either VLAN or VSAN virtualized networks as well. If possible it is advisable to segment e-discovery operations onto dedicated networks to ensure maximum performance and isolation can be achieved. Since access to the external Internet may be a requirement, it is critical to implement multiple layers of security between the e-discovery systems and the outside world. 23

24 Last, but not least in our discussion about key elements for e-discovery is having an effective disk sanitization process. Disk drives can contain an organization s financial records, personally identical information (PII), competitive business data, and other critical content. Before these devices are released for reuse or sent to the dumpster, they should be properly sterilized to ensure no recoverable data remains. Modern forensic tools are capable of recovering data residue at truly remarkable levels. For those of you believing that erasing a Windows file is as simple as clicking the delete key, it is not. In most operating systems this simply sets a bit that indicates the content can be overridden. Reformatting a disk is not much better. While the file system structure may be replaced, most of the disk sectors that contain actual data are untouched. If you plan to reuse a disk, obtain a copy of disk sanitization software (such as DBAN Dean s Boot and Nuke). This application will write a series of bit patterns consisting of all zeros and all ones across every disk sector, effectively neutralizing any residual data on the disk. If the disk previously contained critical data or is going to be thrown away, then magnetic degaussing can be used to neutralize the magnetic fields. Otherwise complete herphysical destruction of the disk is recommended. 24

25 25

26 Once evidence processing is complete, move case data off to tape media as soon as practical. Spinning disk is expensive. The cost-per-gb for tape media is 5 7 times less than the cheapest, highest capacity spinning disk. If properly cared for, tape media has a storage life of 30-years. Average life expectancy for disks is around 5-years. To ensure operability, disks must continue to spin during their entire lifetime, consuming expensive power and cooling resources. Tape media only consumes expensive resources when actively being addressed by the tape drive. To effectively create a tape media archiving process, a number of steps must be put in place. 1) Establish a contract with a professional vendor providing off-site tape storage in a controlled environment. 2) Create policies for writing archived data to tape. (When will it be done, one or multiple cases per tape, etc.) 3) Develop a medial labeling system that identifies cases by date, content, outcome, general type, or other pertainent data. 4) Create a case management database to keep track of all case details and location. 5) Establish a policy of regularly expiring case data when it is no longer relevant or legally required. 26

27 Many organizations have a significant quantity of legacy tape media on hand that has not been previously expired by company policy. This may be due to acquisitions, consolidation of facilities, a need for local data protection, or simply because of a lack of sound data management procedures covering data retention. Regardless of the reason, there may be substantial amounts of outdated media containing content that could become subject to a litigation search, if retained. In most cases this will require the creation of an entire legacy data recovery environment, build upon the particular vintage of backup equipment and applications used to originally capture the data. This type of environment can be very difficult to build and maintain, since key pieces of the technology may have long since disappeared from the market. A possible alternative to a legacy data recovery system is engaging the services of companies specializing in indexing and searching legacy tape media without requiring the original backup and recovery that was used to create it. The capabilities and focus of the services very widely, so it is advisable to identify exactly the types of media and technologies each vendor is capable of emulating. 27

28 One of the challenges e-discovery must face is how to manage data residing on user devices that are subject to retirement and/or reallocation due to retirements, employee turnover, equipment repairs, upgrades, and other operational activities. Employees retire or move on, leaving behind data stored on desktops, laptops, digital voice messages, instant message logs and other devices. Processes and policies need to be established to identify, capture, store, and ultimately deliver potential evidence to the e-discovery operation for processing. This operation must be accomplished without overlooking potential evidence or causing any data spoliation in the process. 28

29 In addition to the stresses rapidly growing data assets can place on the e-discovery operation, it also adversely affects many associated components in the organization's IT operations. Since user information must be transported between sites, there is an increased emphasis on data security. This process also increases demand for LAN and WAN bandwidth. Storage capacity is significantly increased, so the demand for equipment, floor-space, and data center resources increases. Since e-discovery is considered a critical process by most organizations, rapid growth in this operation adversely affects existing Disaster Recovery plans. It also indirectly impacts such things as the technology refresh cycle, patches and upgrades implementation, and the organization s staffing and training plans. 29

30 So how will e-discovery be impacted by future technologies and events? Let s take a peek into the future and speculate about what may be impacted. 30

31 If we peek into our crystal ball we see a number of technologies that will dominate future e- Discovery operations. This process will not escape the lure of Cloud-based services. As with other aspects of technology, Cloud promises to deliver services-on-demand, shifting expenses from a capital expense to an operational expense. However, transitioning to Cloud-based e-discovery operations is still a risk. Issues surrounding security, accessibility, and data ownership, and well as anticipated consolidation of providers in the industry still plague Cloud and limit its popularity. One trend that is expected to continue is the conversion of e-discovery from a fringe activity to a mainstream IT activity. As the demand for digital evidence grows and the threat of monetary penalties resulting from non-compliance increases, organizations are gradually recognizing the value and importance of the evidence production process. As mentioned previously, integration of stored information produced by social media, mobile devices, and other forms of digital equipment will continue to increase. Big Data and the role of predictive coding will play a greater role in the e-discovery process, while point solutions that solve specific problems will gradually fall from favor. One problem that will continue to create problems for the industry is that of evidence collection across international borders. Unfortunately, technological advancements have outpaced our ability to produce treaties and agreements. Efforts are being made to create acceptable standards and political accommodations to simplify this process, but it will continue to be an obstacle into the foreseeable future. 31

32 E-discovery is transitioning from a side-bar activity to one of the organization s core IT functions. As digital data continues to grow, so with the demand for digitally stored evidence. The age-old practice of keeping everything forever is no longer a viable strategy. Data growth is accelerating at a staggering rate, and it is already stressing the IT department s ability to store it. Retaining information that is outdated, has no value, and is never accessed is a luxury few organizations can afford. The more capable and efficient your e-discovery system is, the easier it will be to respond to court-mandated requirements and deadlines. As you build out your e- discovery operation, pay particular attention to designing in scalability, performance, efficiency, and robustness. e-discovery will become a mainstay activity for most organiations in the future. 32

33 Are there any other questions? Thank you for attending today s presentation. If you d like to discuss today s topic in greater detail please stop past our booth #545 in the exhibition hall and ask for Randy Cochran. 33

34 We have prepared a comprehensive e-discovery infrastructure readiness checklist for those of you attending today s If you would like a free copy of this checklist, or a copy of today s presentation, please give us a business card and we will send you a copy next week via . 34