How to Avoid The Biggest Electronic Evidence Mistakes. Ken Jones Senior Technology Architect Pileum Corporation

Transcription

1 How to Avoid The Biggest Electronic Evidence Mistakes Ken Jones Senior Technology Architect Pileum Corporation

2 Why is Proper Handling of Electronic Data Important? Most of the evidence in your case isn t on paper and never will be. From a 2005 survey, only 5% to 7% of all information is born outside of a computer. Paper Evidence Computer Evidence

3 Why is E-Discovery Different from Traditional Discovery? Volume of Information 1 search for 68 terms for 10 users = 45GB of data in over 500,000 messages! In the Enron/Andersen litigation, the digital evidence topped 200 Terabytes, far more than if you digitized all the books in the Library of Congress. Vicinity of Information Data moves to places not expected Servers, workstations, portable drives, recipients cache files, slack space, duplicate documents

4 Why is E-Discovery Different from Traditional Discovery? Volatility of Information Data change through normal operations Ease of Data Corruption during collection Variation of Information Log Files Metadata Databases and spreadsheets Headers

5 Mistake 1: Inadequate Preparation

6 Are You Prepared? Usual reaction: Panic, confusion, unnecessary expense, and possible loss of evidence Example: Database had information critical for a case. Attorney answer Print it out How can you fix this? Train attorneys, paralegals, and staff Review (or create) data collection policies and procedures Proactively assist clients with high litigation risk to create a plan to preserve electronic evidence Create an e-discovery procedure for your firm (yes, it can happen to you too!)

7 Mistake 2: Moving Too Slowly

8 Why is this a problem? Example: Key evidence was an that had been deleted, but waited until 6 months after the suit was filed to try to recover it or prove it was sent! Data can easily be lost. How? Routine system deletion many log files are only saved for 30, 60, or 90 days. Computer Log files ( transmission, web page activity, etc) ISP logs of IP addresses Alteration through routine system operations Just booting a PC changes hundreds of files Employee actions deliberate or accidental Example: Employee had key data in their but left the company, so their mailbox was deleted! Automatic overwriting and recycling (especially with backup)

9 What is the solution? Preserve early Preserve widely Can always exclude for privilege later Notify ALL necessary people (especially IT) November 1, 2013 Bob Smith ABC Corporation PO Box Jackson, MS Re: Smith v. XYZ Corp. Not Yet Filed Dear Mr. Smith: Please be advised that Plaintiffs in above matter believe electronically stored information to be an important and irreplaceable source of discovery in the abovereferenced matter. The discovery requests we intend to serve will seek information from your client s computer systems. This includes, and other electronic communication, word processing documents, spreadsheets, databases, calendars, telephone logs, contact manager information, Internet usage files, and network access information. The laws and rules prohibiting destruction of evidence apply to electronically stored information in the same manner that they apply to other evidence. Due to its format, electronic information is easily deleted, modified or corrupted. Accordingly, we demand that you immediately take every reasonable step to preserve this information until the final resolution of this matter. This includes, but is not limited to, an obligation to discontinue all data destruction and backup tape recycling policies. Sincerely, Les Cheatem DUHE, CHEATEM & HOWE

10 Mistake 3: Not Involving Specialists Early Enough

11 Why is this a Problem? Internal IT staff does probably does not have the time, tools, or knowledge to do it properly. If there is a dispute over the method of preservation or collection do you want your internal IT staff to testify in court? Difficulty of getting information after the discovery period It is not just WHAT you ask for but HOW you ask for it to be delivered. Many times metadata is key to getting answers headers and routing information Word processing profiles and editing history Spreadsheet data sources and formulas Database structure and relationships Computer Forensics may need to be used Recovery of deleted items Detailed examination of activities on a computer

12 What is Computer Forensics? Computer forensics is a branch of digital forensic science pertaining to legal evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing and presenting facts and opinions about the digital information.

13 Which was never received? Received: from smtp486.redcondor.net ( ) by mail.pileum.com ( ) with Microsoft SMTP Server (TLS) id ; Mon, 7 Oct :26: Received: from mail-vb0-f67.google.com ([ ]) by smtp486.redcondor.net ({ a-536a-45f9-a c }) via TCP (inbound) with ESMTPS id for <kenjones@pileum.com>; Mon, 07 Oct :26: X-RC-FROM: <pileummailtest@gmail.com> X-RC-RCPT: <kenjones@pileum.com> Received: by mail-vb0-f67.google.com with SMTP id g17so549789vbg.2 for <kenjones@pileum.com>; Mon, 07 Oct :26: (PDT) Received: from pileum.com ( ) by PILEUM- EXCH2.corp.pileum.com ( ) with Microsoft SMTP Server id ; Mon, 7 Oct :34: Answer: They both were, only the one of the right is a fake

14 What is the solution? Create a partnership now with a vendor to assist with handling of electronic evidence Involve the vendor prior to discovery to help Ask for the right data Ask for data in the right format Ask for the right amount of data Know when to use computer forensics Deleted data is often recoverable Allow adequate time for examination of data

15 Mistake 4: Incorrect Handling of Data

16 Why is this a problem? IT or Staff Lacking in Tools or Methodology Wrong methods to image a PC (Windows, Ghost, etc.) Not creating adequate chain of custody documents Not securing the equipment properly Example: A laptop had critical info on it. The IT staff powered on the computer to copy all of the files to a USB hard drive. They just ruined all of the last accessed information on the files Possible Judicial Actions as a result of a Failure to Preserve Preservation Orders Forensic Investigation Costs Negative Inference Jury Instructions Default Judgment or Dismissal EDD Horror Stories usually include judicial sanctions

17 Failure to Preserve - Examples A jury awarded $800-million in punitive damages when Morgan Stanley repeatedly failed to produce s in a timely manner. The judge stated that "efforts to hide its s" were evidence of "guilt." (Coleman Holdings v. Morgan Stanley) A jury awarded $29.2-million in the largest single sex discrimination verdict in U.S. history after UBS Warburg could not produce copies of relevant s. The jury was instructed to "infer that the [missing] evidence would have been unfavorable" to the defendant. (Zubulake v. UBS Warburg) The SEC imposed a fine of $10-million on Banc of America Securities, the brokerage arm of Bank of America, after they "repeatedly failed promptly to furnish" and gave "misinformation".

18 Mistake 5: Not Asking for All Sources of Data

19 Where can ESI be found? The Usual Suspects: Desktops Laptops Servers USB drives CD-ROMs DVDs Backup Tapes

20 The Vicinity Problem: Data Moves To Places You Don t Expect Less Obvious Sources of Relevant Data Internet Service Provider Logs Cloud Service Provider Data and Logs Archives Instant Messaging Cell Phone Text Messages Smart Phones/Tablets Personal Home Computers Former Employees Computers Personal accounts Recipients Copiers/Fax/Scanners

21 Keys to Avoid Mistakes Plan Ahead Get the proper tools Get the proper training Involve the right experts Electronic Evidence Collection Forensics Make a good plan and move quickly!

22 Contact Information Support: Ken Jones Senior Technology Architect Pileum Corporation