October 21 st, 2009 E-Discovery: Tips & Technology Rhea N. Frederick, J.D., Legal Consultant, Kroll Ontrack 2009 Kroll Ontrack Inc. www.krollontrack.com
Discussion Overview E-Discovery Overview Electronic Discovery Reference Model: Technology & Tips Why Does This Matter To Me? 1
E-Discovery Overview 2009 Kroll Ontrack Inc. www.krollontrack.com
Introduction Computer Forensics Investigative and detailed analysis Typically a single hard drive or PC Determine who, what, when Recreation of time critical events Reporting and expert testimony Breaking of passwords/encryption Searching for deleted information Electronic Discovery Gathering, searching, culling and producing large volumes of relevant information for legal review Data is accessed but not analyzed Includes active and archival data Typically does NOT include discarded, hidden or deleted data E-mail systems, network shares, desktops and backups 3
How Is Information Created? 99.9% of All Information is Digital 0.1% Paper 4
Information Volume Issues: Example National Archives and Records Administration (NARA): Ingested 67GB of data into an ERA system for federal records 64.4TB of searchable records from the George W. Bush administration Bush administration volume of data is about 35 times the amount of data received from the Clinton administration Source: Ben Bain, NARA digs out of digital avalanche, http://fcw.com/articles/2009/09/14/nara-era-dig-out-of-digital-recordsavalanche.aspx?s=fcwdaily_210909. Sept. 11, 2009. Last accessed Oct. 13, 2009. 5
Sources & Storage Locations Source and Storage Location 6
Sources & Storage Locations 7
Where Is Information Stored? Active Data Easily accessible by user in the ordinary course of business Captured by use of copying or mirror imaging technology Archived Data Available, but requires some effort to restore (tapes) Legacy Data May be impractical or impossible to restore (obsolete media or obsolete programs) Deleted Data Requires an expert analysis to recover unallocated and slack space 8
Why Doesn t Deleted Mean Gone? Delete does NOT mean delete Delete simply makes space available for overwriting 9
Delete Delete SmokingGun.doc SmokingGun.doc FAT 1 2 3 4 Disk Surface 1 2 Links 3 4 10
Delete Delete σ mokinggun.doc SmokingGun.doc FAT 1 2 3 4 Disk Surface 1 2 Broken Links 3 4 11
Defining Metadata & Typical Fields Metadata is the data about the data, including information about who created a file, the date it was created, when it was last modified and more 12
Electronic Discovery Reference Model: Tips & Technology 2009 Kroll Ontrack Inc. www.krollontrack.com
Electronic Discovery Reference Model (EDRM) Processing Preservation Information Management Identification Review Production Presentation Collection Analysis 14
Electronic Discovery Reference Model (EDRM): Information Management Processing Preservation Information Management Identification Review Production Presentation Data Mapping and Accessibility Consulting Records Retention Consulting Information Security Assessment and Penetration Testing Collection Analysis 15
Essential Steps for Proactive Data Management Identify & Leverage Resources Create an Application Inventory & Data Map Classify Records & Determine Retention Periods Determine Retention Procedures Create a Discovery Task Force 16
Information Management Best Practices Information Management Develop a comprehensive retention policy Implement the retention policy before litigation arises Monitor adherence to the retention policy Create a detailed preservation plan Establish a discovery response team 17
Electronic Discovery Reference Model (EDRM): Identification Processing Preservation Information Management Identification Review Production Presentation Custodian Interviews Rule 26(f) Conference Consulting Computer Forensics and Analysis Data Breach Investigation and Analysis Collection Analysis 18
Identification & Early E-Discovery Discussions: Rule 26(f) & 16(b) Rule 26(f): Directs the parties to discuss discovery of electronically stored information during their discovery-planning conference Rule 16(b): Designed to help both the parties and the court prepare for electronic discovery issues at the outset of litigation 19
Identification Best Practices Identification Seek to ascertain information about the client s computer systems and practices before the 26(f) conference Use the conference to begin steering electronic discovery decisions in your favor: Educate the court about the potential technological issues involved in collecting, reviewing, processing and producing Flag concerns regarding any unresolved e-discovery issues Propose realistic timeframes for completing collection, review and production 20
Electronic Discovery Reference Model (EDRM): Preservation & Collection Collection Planning and Consulting Litigation Hold Consulting Preservation Processing Information Management Identification Review Production Presentation Collection Onsite and Remote Data Collection Active Data Gathering or Forensic Imaging Chain of Custody Tracking Analysis 21
Preservation Management Initiation of a lawsuit or investigation should trigger re-consideration of your electronic records retention policy KEY: Maintaining the status quo will likely result in document destruction! Confirm and monitor that you have suspended any policy which regularly destroys or overwrites data (Disaster recovery and backup systems) Deliver preservation notices both to client and opponent The potential consequences of data destruction are severe! 22
Data Collection for E-Discovery 23
Preservation & Collection Best Practices Preservation & Collection Identify data sources and preserve appropriately: Preserve pertinent ESI upon reasonable anticipation of litigation Avoid downgrading data accessibility Create and maintain a data storage directory and use it to identify, locate and ascertain the accessibility of responsive data Enlist the help of individuals who are properly trained in handling digital data to avoid questions regarding completeness or accuracy of data collection 24
Electronic Discovery Reference Model (EDRM): Processing Preservation Processing Data Processing and Conversion Electronic and Paper Documents from All Sources Information Management Identification Review Production Presentation Collection Analysis 25
Key Steps in Processing File filtering Extracting file metadata Creating file fingerprints and de-duplication Conducting compound document extraction Identifying file types 26
Processing Options Traditionally, there are three main ways to process data for an electronic production: Do-it-yourself using home-grown processes and tools Do-it-yourself using third-party tools (Discovery Cracker, Mobius, etc.) Third-party service providers that specialize in electronic data processing 27
Data Filtering Key benefits: File identification Effective keyword searching Elimination of blank and duplicate documents Segregation of potentially privileged documents Flagging of very large files Responsive Non-Responsive Privileged 28
Data Filtering Average Filtering Reduction Filtering Options 35% 1% 1% De-duplication Large File Handling Encrypted and Corrupted 25% Review Set 18% 10% 10% Date Range File Type Keyword Searching These are averages based on actual Kroll Ontrack projects. Filtering reduction amounts will vary on an individual project basis. File type filtering presumes system and application files have previously been removed. Approximately 75% of your documents can be eliminated by using filtering options 29
Electronic Discovery Reference Model (EDRM): Analysis Processing Preservation Information Management Identification Review Production Presentation Collection Analysis Discovery and Case Management Consulting Early Case Assessment Technology and Consulting Data Analytics Technology and Consulting 30
Analysis: Engage in Early Case Assessment Vital first step in investigation or litigation process Scope of potentially relevant data can be narrowed prior to e- discovery processing Results in cost and time savings Aids counsel in deciding whether to proceed with lawsuit Can help make decision to settle based on existence of damaging evidence 31
Analysis: E-Mail Analytics Technology-enabled process where e-mails in your document set are organized and analyzed Recognizes and visually represents relationships between people, events, timelines and communication patterns through advanced visualizations Allows all players with e-discovery responsibilities to analyze e-mails, form legal case strategy, investigate internal incidents and intelligently collect data in preparation for discovery 32
Analysis: E-Mail Analytics Answers Who, What and When Example: Who authored the e-mail and to whom was it sent? 33
Electronic Discovery Reference Model (EDRM): Review Preservation Processing Online Review Document Review Services Advanced Search Technologies Information Management Identification Review Production Presentation Collection Analysis 34
Paper & Electronic Review 35
Document Review: Utilize Smart Searching Technologies Concept Searching 36
Document Review: Utilize Smart Searching Technologies Topic Grouping 37
Document Review: Utilize Smart Searching Technologies Near Duplication 38
Document Review: Utilize Smart Searching Technologies E-Mail Threading 39
Analysis & Review Best Practices Analysis & Review Engage in Early Case Assessment to gain a better understanding of the data Utilize cutting-edge technologies to reduce the volume of data that must be reviewed Organize data in a way that facilities an intelligent and meaningful review Document all the steps taken and decisions made to create a defensible review process 40
Electronic Discovery Reference Model (EDRM): Production Processing Preservation Information Management Identification Review Production Presentation Collection Analysis Multiple Production Formats 41
Production Options: Comparison Pros Paper Familiar to many attorneys Cons High print costs No search capabilities Native Reduced document processing costs Search capabilities TIFF Image Metadata preserved Search capabilities Redaction capabilities Metadata not preserved No redaction capabilities Important parts of documents not visible High costs Online Repository (permits both native & TIFF image review from any online computer) Preserves metadata when viewed in TIFF Search capabilities Allows concept searching 42
Production Best Practices Production Plan for production early! Discuss production options with opponent ahead of time Do not make unilateral decisions to produce in a certain format Those that do will risk a court order to reproduce data 43
Why Does This Matter To Me? 2009 Kroll Ontrack Inc. www.krollontrack.com
Federal Rules of Civil Procedure: Overview Federal Rules of Civil Procedure Early Discussion of ESI Production Considerations Third Party Production Sanctions Rule 26(f) Meet & Confer Rule 16 Scheduling Conference Rule 26(b)(5)(B) Belated Assertion of Privilege Rule 33(d) Options to Procedures ESI in Response to Interrogations Rule 34(a) Definition of ESI Rule 34(b) Form of Production Rule 26(b)(2)(B) Reasonable Accessibility Rule 45 Subpoena for Electronically Stored Information Rule 37(e) Safe Harbor from Sanctions 45
State Rule Making Activity: Minnesota Minnesota adopted the FRCP amendments in 2007 Except for the mandatory meet and confer provision E-Discovery Rules: Rule 16 Rule 26 Rule 34 Rule 37 Rule 45 46
Why Does This Matter To Me? National Association of State Chief Information Officers (NASCIO): #5 priority for 2009 is: E-Records Management/Digital Preservation/E-discovery http://www.state.mn.us/mn/externaldocs/oet/state_it_master_plan_2009_0403 09073403_2009%20MN%20Master%20Plan%20for%20IT.pdf The Office of Enterprise Technology (OET) for Minnesota will be adding an enterprise e-mail archiving solution to available e-mail tools. Includes: e-discovery: search tools embedded in the email archiving system that can search thousands of email records. This may be used for internal investigations or for court-ordered legal discoveries. http://www.state.mn.us/portal/mn/jsp/content.do? 47
Why Does This Matter To Me? Defendant alleged the SEC s production of 1.7 million documents maintained in thirty-six separate databases was a document dump Court found that Fed.R.Civ.P. 34 s usual course of business requirement for production requires the documents to be organized Ordered re-production with documents responding specifically to defendant s requests Court noted that a government agency which initiates civil litigation must generally follow the same discovery rules that govern private parties -SEC v. Collins & Aikman Corp., 2009 WL 94311 (S.D.N.Y. Jan. 13, 2009). 48
Parting Thoughts 2009 Kroll Ontrack Inc. www.krollontrack.com
Parting Thoughts Plan for discovery! Stay up-to-date on evolving case law and discovery rules Leverage technology to hone in on pertinent data, reduce review time and curb costs 50
www.krollontrack.com/newsletters Free monthly newsletters Latest cases and legislation Distributed via e-mail 51
2009 Kroll Ontrack Inc. www.krollontrack.com