THE WINDOWS MANAGER S GUIDE TO INSIDE: Reactive litigation hold tools Proactive litigation hold tools Review tools Enterprise search tools Archive systems CHAPTER Exploring e-discovery tools Simplify the e-discovery process by learning which tools to use and when to use them.
CHAPTER Exploring e-discovery tools STAYING ON TOP of legal requests and litigation holds doesn t have to be so complicated. There are basic technical tools that can help provide a level of preparedness for litigation whether a company handles hundreds of lawsuits a year or only four or five annually and outsources the entire process to outside counsel or third-party vendors. The trick is knowing what the tools are and how to use them. Here is a list of the tools that can help simplify the e-discovery process: q Proactive litigation hold tools q Archive systems q Enterprise search tools q Reactive litigation hold tools q E-discovery processing tools q Review tools PROACTIVE HOLD Staying ahead of the game is critical when thinking about e-discovery. Because the crux of any litigation hold notice focuses on identifying Creating a litigation profile UNDERSTANDING THE required by Windows managers to handle litigation holds begins with an analysis of each company s litigation profile. Company profiles will vary, but IT staff should have an idea about the number of cases annually, the most common type of litigation and the way each case is handled. When creating a litigation profile, determine how the legal department handles the management of a standard case. Does it handle most litigation internally? Is it moving in this direction, or does it rely on outside counsel to handle all or part of each lawsuit? Many of these answers will help the IT staff best determine how to prepare for the type of litigation hold requests that will be issued. It will also help the staff figure out how IT fits into the litigation hold process and what types of tools will be required. 2 THE WINDOWS MANAGER S GUIDE TO
CHAPTER and preserving information, it s always beneficial to put in place tools that make it easier to do the core functions of searching and preserving the information. It also benefits a company to apply that same functionality to its business and IT processes as well. ARCHIVE SYSTEMS Email archives, in particular, can assist in capturing and centralizing electronically stored information within an organization. Depending on how the archive system is implemented, the archive can also ensure that documents are not deleted or modified a huge advantage when working under a litigation hold. Because the archive is indexed and searchable, it can be scanned for specific information related to a hold notice. The search result can be flagged, copied or exported for the purposes of preservation. More sophisticated archive tools also provide litigation hold features, allowing the legal department direct access to search within the archive and to place litigation holds on email without the need of IT staff. When looking at archival systems as a tool for litigation readiness, make sure that the system: e Allows the placement of multiple litigation holds on archived data. A single document in the archive may be subject to several legal holds. It s important that they can all be tracked separately so that removing one will not remove the others. r Archives the original document in a forensically defensible manner. It s essential that each archived document is an exact duplicate of the original file with no changes to the document s metadata or content. t Provides a centralized and secure storage area for all of the archived data. For litigation hold purposes, consider tools that allow copying of the information for a litigation hold onto a tamper-proof storage product. u Offers the ability to output the search to litigation-oriented software, such as CaseCentral, Case- Logistix, Concordance, Introspect, JFS Litigator's Notebook, Lextranet, Nmatrix, Ringtail, Summation and Virtual Partner. Individual archival tools are available for instant messaging and other data sources like SharePoint, but often the ability to archive these sources will be part of a well-rounded email archiving plan. The benefit of these all-in-one types of products is the centralization of all electronically stored data types into one searchable archive, which provides a single point of access for the legal team for litigation hold purposes. 3 THE WINDOWS MANAGER S GUIDE TO
The legal investigation is connected to the discovery request is connected to combing through terabytes of archived email is connected to your clean bill of health is connected to Symantec Enterprise Vault, the comprehensive archiving solution that makes managing email fast, efficient, and thorough. 200 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and Enterprise Vault are registered trademarks of Symantec Corporation. Take control of your most important digital assets. Up to 5% of your company s intellectual property is in email or instant messaging. Today, a typical ediscovery request can cost IT departments countless hours and dollars to recover the specific range of messages on time. Symantec Enterprise Vault facilitates the legal and business best practices of storing, managing, and discovering email and other electronic files. So you re free to focus on the big picture. Learn more at www.enterprisevault.com Confidence in a connected world.
CHAPTER ENTERPRISE SEARCH Unstructured files are very difficult to search. In typical cases, the searching party will have only the traditional filename or creation date information. Enterprise search tools have strong indexing capabilities. The indexing itself typically adds specific pieces of metadata to each file, which prepares a file to be found at a later date. Comprehensive indexing is usually matched with an equally powerful search capability. In most cases, searching will sort through files based on previously created metadata. However, search capabilities are increasingly contextual, looking inside of files to locate important keywords or concepts. Enterprise search tools offer the following capabilities: e They allow the legal department to search and apply litigation holds. This self-service approach allows Windows managers to stay focused on IT projects. r They offer the ability to copy or export search results to a secure storage area. To preserve information under the litigation hold, the search tool needs to be able to identify and copy or export the search results to a secure area. And, like the archive, the copies must be exact copies for defensibility in court. t They can output the search to litigation-oriented software, such as CaseCentral, CaseLogistix, Concordance, Introspect, JFS Litigator's Notebook, Lextranet, Nmatrix, Ringtail, Summation and Virtual Partner. REACTIVE HOLD In many instances, organizations with proactive tools such as information archive solutions and enterprise search capabilities will still need other tools to identify, preserve and then deliver documents as part of the e-discovery and litigation hold process. Deciding on which tool is needed will depend on the level of expertise within the IT organization and at what stage the legal department decides to work with third-party vendors or outside counsel. FORENSICS Where chain of custody and potential fraudulent conduct is an issue, forensics tools are needed. When evidentiary information is produced, companies must be able to prove the veracity of the evidence itself. Although always important, forensics tools are especially critical when dealing with situations where fraudulent conduct is suspected and a user's computer behavior is in question. Because of the specialized skills needed for forensics collections, more companies are outsourcing this work 5 THE WINDOWS MANAGER S GUIDE TO
CHAPTER to third-party vendors. But because of the technical nature of the forensics process, any IT group that decides to bring this process in-house should have someone in the department attend certification training for forensics collection purposes. For litigation hold purposes, a forensics tool should be able to: e Mirror image hard drives and create exact duplicates of the subject hard drive. It is mandatory that the copy be a bit-level exact duplicate. r Index and search through native format data. t Restore deleted or otherwise difficult-to-access files and fragments. PROCESSING The process of extracting metadata and text from electronic documents is known as e-discovery processing. By extracting the metadata and text from electronic documents, such as email or word documents, attorneys can use the resulting data to help organize the electronic documents for review and production. The documents can be sorted according to specific metadata, such as email threads or creator, and grouped together for quick review. Typically, the e-discovery work is performed by third-party service providers that are skilled at handling large amounts of data and delivering the resulting data back to the firm or outside counsel in a loadable format that can be used by review or analysis tools. However, depending on the size of the e-discovery project, some companies are choosing to bring this process in-house. At a minimum, an e-discovery processing tool should include: e The ability to process multiple types of electronic documents, such as email messages and attachments, PDFs and Microsoft Office files. Most systems today will provide a list of more than 200 file types that can be processed. r Reporting tools to track individual jobs back to the original custodian or information source. t The ability to maintain document relationships through the process. For example, email and attachments should be kept together. u The ability to export data to common review application load files, such as Summation, Concordance, CaseLogistix and ASCII. i Exception logging capabilities to identify which documents could not be processed because of password protection or corruption. 6 THE WINDOWS MANAGER S GUIDE TO
CHAPTER REVIEW Another common area for outsourcing is the e-discovery review process, which is a necessary stage in the litigation hold and production portions of the e-discovery process. Once information has been identified as part of the litigation hold but before it is produced to opposing counsel each piece of information must be reviewed by the legal department or by outside counsel to ensure that the documents are relevant, not privileged and can be safely produced. Consider the following requirements for any review tool: e The ability to view multiple types of electronic documents. Similar to e-discovery processing tools, most review tools will provide a list of more than 200 file types that can be viewed by the application. r Able to work with both native and imaged documents. Although a majority of today s information is stored in electronic format, paper is still a common form of document storage. It is important that the review tool be able to work with both scanned-imaged paper documents as well as electronic versions. t A tool for flagging or tagging documents identified as non-responsive or privileged. Also needed is the ability to run a report that provides a list of the privileged documents that can be used in defense of the final produced set. u Tools for redacting portions of a document. When only a portion of a document is privileged or confidential, the reviewer needs to be able to take that portion out of the document before making it available for the other side. In the case of electronic documents, the review tool must have the ability to create an image of the native document so a redaction can be applied. i The ability to produce the reviewed documents. The final step in the review process is the creation of a production set of all information that will be produced to opposing counsel. The tool should be able to export and number both the images and electronic documents in an agreed-to format, such as.pdf. Given the large volumes of electronic data that corporations are now generating during e-discovery requests, it is common for legal departments to look for outside companies to host the review process. These third-party vendors have the staff and technology available to handle millions of documents at a time, with hundreds of reviewers. But for smaller cases in which the documents number in the hundreds or thousands, it may be more cost-effective to bring this process in-house. 8 THE WINDOWS MANAGER S GUIDE TO
CHAPTER ABOUT THE AUTHORS: Margie Semilof is the senior news director for TechTarget s Windows Media Group and is responsible for news coverage of the Windows platform. A high-tech journalist for more than 20 years, Semilof has written about a variety of technical topics ranging from hardware and software to telecom and networking. Kathryn Hilton has worked as an industry analyst for Gartner Group and for several large storage companies. She is currently a senior analyst for policy at Contoural Inc., a provider of business and technology consulting services that focuses on litigation readiness, compliance, information and records management, and data storage strategy. The Windows Manager s Guide to e-discovery is part of the Windows Manager s Guide series from SearchWinIT.com. Marilyn Cohodas Editorial Director mcohodas@techtarget.com Christine Casatelli Editor ccasatelli@techtarget.com Martha Moore Copy Editor mmoore@techtarget.com Linda Koury Art Director of Digital Content lkoury@techtarget.com Jonathan Brown Publisher jebrown@techtarget.com Matthew Salamone Director of Sales msalamone@techtarget.com 9 THE WINDOWS MANAGER S GUIDE TO