CASE STUDY: Top 5 Communications Company Evaluates Leading ediscovery Solutions

Transcription

1 AccessData Group CASE STUDY: Top 5 Communications Company Evaluates Leading ediscovery Solutions White Paper

2 "#$%&'()'*+&*+, Overview... 1 Top 5 Communications Company: Background and Its ediscovery Requirements... 1 The Choice to Replace EnCase ediscovery... 1 Faster Collection... 2 Faster Processing... 2 The Best Customer Support in the Business... 2 Evaluating Clearwell Systems Modules against AD ediscovery... 2 Usability... 2 Broad Interoperability among Multiple Review Tools... 2 Search Reporting That Maintains Structure of Complex Search Terms... 3 Avoiding Additional Processing, Duplication of Data and Additional Storage... 3 Delivering Accurate Results and Forensic Integrity... 3 Forensically Sound Collection... 3 Collecting Open Files and Handling Interrupted Collections... 4 Accurate Data Processing... 4 Conclusion... 5

3 Overview The following case study examines the decision made by a Top 5 Communications Company to implement AccessData (AD) ediscovery. The company tested AD ediscovery against Guidance Software s EnCase ediscovery and Clearwell System s ediscovery software modules. The communications company found AccessData Group s product to be the solution that best addressed their internal requirements. The following reviews the company s findings and the benefits they ve received as a result of implementing AccessData technology. What is AD ediscovery? AD ediscovery is a comprehensive in-house solution that maps to the EDRM, walking users in a wizard-driven fashion through the ediscovery lifecycle from litigation hold to the production of load files, TIFFs, PDFs and/or native files for attorney review. Top 5 Communications Company: Background and Its ediscovery Requirements As a large communications provider, the company is noted for its high-capacity, reliable broadband delivery network and superior customer care. With millions of residential and commercial customer relationships and more than 20,000 employees, the company places great importance on the prudent management of information assets and ediscovery preparedness. Due to the nature of its business, the communications company handles a large number of complex law suits annually. Even before implementing AD ediscovery, the company was very much ahead of the curve with a highly developed ediscovery program that relied on mature technology and processes, as well as a committee of electronic discovery experts. Although, the ediscovery team had a mature program in place, they were looking to further enhance their processes and capabilities and had a very clear set of requirements they wanted address: A software vendor that is easy to work with and functions as a strategic partner with its clients Faster and more thorough forensic collection and processing to address rocket dockets More advanced analysis and reporting to facilitate effective early case assessment Flexible technology that allows data to be imported or exported at any stage in the process, while supporting a variety of thirdparty review tools Collaborative analysis among internal personnel and even outside counsel when needed A solution that delivers the above enhancements without introducing hardware and storage challenges Greater cost savings The Choice to Replace EnCase ediscovery The company had used Guidance Software s solution for some time but wanted to achieve faster collection and processing to better address cases with extremely tight deadlines ( rocket dockets ). That, coupled with the fact that they were not entirely satisfied with their current vendor s customer service and support, led to their decision to see if another software vendor could better serve their needs. The goal was to be able to deliver relevant data to the attorneys more quickly, giving them more time to assess cases and develop their strategies. After testing EnCase against AD ediscovery, their choice was clear. According to company s ediscovery team chairperson, It took approximately 4 times longer to collect data with EnCase. Using AccessData ediscovery, I was collecting and processing data in a quarter of the time, which helped me ensure that our attorneys were getting what they needed to do their jobs without having to wait until the 11 th hour. In addition, by cutting the collection and processing times by 60% 75% and giving the attorneys more time with the data, the company saw dramatic cost savings. "#" #$%

4 Faster Collection AD ediscovery s collection is faster because the solution s infrastructure is designed so that the routine search and analysis operations are performed on the target machines. This is made possible with AccessData s smart agent. Other solutions require the main product console to communicate back and forth with the agents installed on the target machines, and all operations are performed at the main console. This additional back and forth communication delays the collection process. In addition, AD ediscovery s Dynamic Locality allows custodian laptops with smart agents and workstations in disparate locations to be routed to optimal collection points. Furthermore, the Smart Restart capability allows collections to pause and resume as a custodian travels. For example, as a custodian moves from one geographic location to another, the collection is automatically re-routed to the optimal collection point and the collection resumes from the point of failure without having to start over. Leveraging optimal collection points and smart agents that perform the operations locally dramatically reduces collection times. Faster Processing AD ediscovery is the only ediscovery solution using true multi-threaded distributed processing, which divides massive amounts of data among multiple processing machines to increase processing by 50% to 80%, depending on the types of data being processed. Fortune 500 companies, law enforcement and government agencies are currently processing terabytes of complex data per day with AccessData s distributed processing technology. While other companies claim to be able to process terabytes per day, it is important to realize that they are likely referring to terabytes of text files, which are much less difficult to process. AD ediscovery is able to perform thorough and accurate processing of not just text files, but very complex files formats as well. The only way to determine a product s processing competency is to test it against other products using your own data repeatedly, and this is exactly how the communications company approached its software evaluation process. The Best Customer Support in the Business AccessData is widely recognized for being focused on the client. SC Magazine named AccessData a 2010 SC Innovator, citing not only AccessData s efforts to innovate as though it were a hungry start-up, but also its customer-first attitude. AccessData develops its solutions around its clients needs and assigns each enterprise-class client a Technical Account Manager who ensures that the client s solution is functioning as needed to address the client s specific internal processes and data universe. I was impressed with AccessData s client support program from the beginning, stated the ediscovery chairperson. Furthermore, AccessData s client support doesn t begin and end with the Technical Account Manager. AccessData takes client support so seriously that even chief executives and the development team get involved when needed. While other companies are making development and support decisions based on revenue potential, AccessData makes its development and support decisions based on client satisfaction, relying a great deal on word of mouth to grow its business. Evaluating Clearwell Systems Modules against AD ediscovery A while after implementing AD ediscovery, the communications company decided to test AD ediscovery against Clearwell s ediscovery software products to confirm that they were, in fact, using the best solution to address their requirements. Clearwell had an impressive pitch, and in keeping with this company s proactive approach to achieving the best possible ediscovery program, the ediscovery team chose to evaluate what Clearwell had to offer. The formal evaluation process gave Clearwell 60 days to prove that their technology was better suited to meet the company s needs. The ediscovery team chose two cases a medium-sized case of low complexity and a large case of incredible complexity. The results were not favorable in critical areas, such as usability, accuracy of results and forensic integrity. Usability The biggest challenge for us was to find a solution that worked well with our mature internal processes. AD ediscovery accommodated our processes and workflow very well, and Clearwell did not. It would have required dramatic changes to processes we ve been honing for years, in order to implement Clearwell software said the ediscovery chairperson. $#" #$% Broad Interoperability among Multiple Review Tools Due to the nature of the communications industry, the company often does not have exclusive ownership of the cases its handling. For example, a cable channel will sue multiple operators, and the company must share evidence with those multiple operators legal counsel. There is a great degree of interoperability between AD ediscovery and any other product we ve had

5 %#" #$% to interface with. It s relatively easy to get data out of the solution at any step in the process. Either other tools support AD1 or AD easily generates load files for import into third-party review tools, stated the ediscovery chairperson. The ability to easily share data with other parties in a law suit has proven to be off great value, and in their evaluation of Clearwell software, the communications company was not able to achieve this same level of interoperability. Search Reporting That Maintains Structure of Complex Search Terms As is usually the case with ediscovery analysis, the company searches collected data using very complex search terms, which allows them to zero in on responsive documents. In their evaluation of Clearwell software, they discovered that the product s search reporting does not support complex search terms. According to the team chairperson, There was no way to tell legal counsel how many hits a search term had within the universe of documents, unless the search term was very simple. The problem is search terms are never simple. For example, take a search term such as COMPANY within 30 of COMMUNICATIONS enabling stemming of the word COMMUNICATIONS -- and including several other keywords within 50 of a competitor s company name. Clearwell splits this type of search term out into individual terms. So in order to see how many hits that specific term had, a user would have to look at the numerous terms listed in the Clearwell report and figure out which ones represent the original complex term. Then the user would have to add up the hits associated with those terms that were broken out. Where AD ediscovery reporting listed the complex search term as it was entered, along with all the hits, Clearwell software would split that single complex term into as many as 7 different search terms. The report broke everything up, so it was not digestible based on the original term that was submitted, which is not helpful when dealing with a high volume, high complexity case, commented the ediscovery chairperson. Avoiding Additional Processing, Duplication of Data and Additional Storage Clearwell s solution requires all collected data to be reprocessed in order to move the data into their solution. This creates a second index, data duplication and storage challenges. In addition, Clearwell did not support the commonly used AccessData AD1 evidence format and offered no conversion path. So in order for the ediscovery team to process data for use in Clearwell s analysis tool, they had to send the collected data back out to a hard drive in native format, thereby losing the file compression they were leveraging with the AD1 evidence container. This only created more storage problems, according to the team chairperson, How do you plan for case capacity if you properly handle evidence in compressed evidence files, but when you process it, you lose the compression? For example, 150 gigs of compressed files became 400 gigs of native files, causing us to lose the value of the evidence container. Why would I want to explode the data just to process it? Furthermore, collection tools that do not provide the safety, integrity and compression of a forensic container provide little incremental value over tools, such as Robocopy or other stand-alone products. AD ediscovery s integrated solution, leveraging purpose-built technology, provided this communications company with a level of confidence that isn t achieved with competing solutions. Delivering Accurate Results and Forensic Integrity Forensic-level collection and processing are paramount to ensuring that your ediscovery processes will stand up in court. This is top of mind at the communications company, and therefore, forensic integrity was the primary criteria for which they were evaluating Clearwell s collection and processing modules. Forensically Sound Collection While AccessData s forensic technology immediately preserves data, including metadata, in a forensically sound evidence container, Clearwell s collection methodology involved mapping the custodian hard drives and copying that data to its processing module for indexing. As the ediscovery chairperson explained, Clearwell s collection methodology was no different from creating a generic Windows file copy. Mapping a hard drive and merely copying the data causes the spoliation of metadata. So if we had elected to use Clearwell s collection technology, we would have failed at our basic responsibility right out of the gate. To be fair, at the time the company evaluated the Clearwell collection module, the product was in beta. However, according to the ediscovery team chairperson, in discussions with Clearwell, there was no indication that they were going to change their approach to collection. Collecting Open Files and Another difference between AccessData s collection capability and that of Clearwell s was the ability to handle open files and s. When collecting a live machine with documents and in use, Clearwell failed to collect the open PST files and other open documents. When we used Clearwell to collect from a computer that had Outlook open, the data was

6 corrupted, explained the chairperson. On the other hand, using AD ediscovery, all documents and s are preserved in the state that they are in at the time of collection, even if they are open and in use. Furthermore, AD ediscovery allows the user to incrementally collect all data that has been changed or added over time, ensuring that any additional content relevant to a case is preserved. Handling Interrupted Collections Finally, during testing, the ediscovery team wanted to see how the Clearwell module handled interrupted collections. It is very common for the collection of a computer to be interrupted by loss of internet connectivity, or for example, if the user left for the day and turned off the machine. During collection, they took one of the computers offline and then brought it back to see if Clearwell s collection module would resume collection. In the chairperson s words, We ripped the cable out of the box. Clearwell stopped and never restarted. This is yet another dramatic difference between AD ediscovery and Clearwell s collection product. AD ediscovery has smart restart functionality, meaning that once a computer has been targeted for collection, the solution will continue to make collection attempts until the collection is complete. Even if a collection begins with a custodian laptop on the corporate network and that custodian logs off and goes to a coffee shop to work on public WiFi, AD ediscovery will be called by the custodian machine to resume collection once internet connectivity has been reestablished. It is important to note that whether a computer is on the corporate network or an unsecure public connection, the data collected is secure. AD ediscovery meets federal standards for secure inter-component communications, leveraging industrystandard x509 certificates and a FIPS certified SSL encryption engine. This ensures that only authorized entities can communicate with the target machines and that all data is securely encrypted as it travels back to the collection repository. Accurate Data Processing The company found the Clearwell processing module to be lacking when handling structured data sets and some complex file formats. You can really see the difference between a product that leverages forensic technology and a newer product that does not, said the chairperson. Typically, any software vendor must tweak their solution to address a client s specific data types and the way they address a case. However, Clearwell had 60 days to get the process working and failed to accomplish the results AccessData delivered. There are many tools that have been designed in the last three to five years to address only ediscovery, and those products do not have the technological development behind them to be able to address complex data sets. When processing complex files, it is very common for these ediscovery-only tools to simply skip any files they cannot handle. Those skipped files are not included as Exceptions in the reports generated by those products. Therefore, users relying on such immature products have no idea that they failed produce all relevant data. This is why it is extremely important to test multiple ediscovery products against each other using your own data. This will allow you to see how they handle complex data, such as various formats, compound files, encrypted files, or in the instance of criminal litigation, deleted files and slack space. AD ediscovery is built on AccessData s industry-standard computer forensics technology, Forensic Toolkit (FTK ). As an industry-standard forensics technology relied on by law enforcement and government agencies, the processing and analysis delivered by FTK must stand up to far more rigorous scrutiny in court. Therefore, FTK has been developed to provide far more accurate processing, analysis and reporting than typical ediscovery-only tools. In the reports AccessData has received from several clients, such as this communications company, AD ediscovery exposes approximately 20% more relevant documents and s than Clearwell s processing module. In addition, when AD ediscovery encounters a file that it cannot process for some reason, that file is included in an Exception Report. Therefore, AD clients are aware of any unprocessed files and their locations, enabling them to revisit those exceptions to ensure that they are analyzed and, if necessary, produced for trial. Even though the FTK foundation of AD ediscovery delivers deep forensic-level analysis, the solution is very easy to use. It provides different windows into the data to suit the various types of users participating in the ediscovery process. IT personnel can leverage more technical analysis capabilities using the FTK console, while non-technical legal personnel can collaboratively analyze, cull and comment on data via the intuitive, web-based interface. AD ediscovery leverages the same advanced collection, processing and analysis technology used by 3-letter agencies, yet it's so intuitive anybody can use it, explained the ediscovery team chairperson. &#" #$%

7 Conclusion This communications company takes a proactive approach to ediscovery, always striving to ensure that its technical infrastructure and internal processes are the best that they can be. This organization was kind enough to share with AccessData the results of the aggressive testing they engaged in to ensure that their decision to implement AD ediscovery was the correct one. The company s goal was to achieve the fastest possible collection and processing, as well as advanced analysis and early case assessment capabilities, while maintaining forensic integrity. Their evaluations against EnCase ediscovery and the various Clearwell modules confirmed for this company s Discovery team that AD ediscovery delivers an innovative and cost-effective framework that enables the speed, accuracy, efficient workflow and forensic integrity they were looking for. In the ediscovery chairperson s words, We reduced the time it takes to collect, process, cull and deliver the data to our attorneys by between 60% and 75%, and we are confident in the fact that our ediscovery processes are forensically sound. While it is difficult to produce a firm number with regard to cost, the increased efficiency and the fact that our attorneys have additional time to focus on their cases has resulted in significant cost savings AccessData, Inc. All Rights Reserved. AccessData, Forensic Toolkit and FTK are registered trademarks owned by AccessData in the United States and other jurisdictions and may not be used without prior written permission. All other marks and brands may be claimed as the property of their respective owners. '#" #$%