The Portcullis Guide to Disclosing Electronically Stored Information (ESI) Portcullis Computer Security Limited www.portcullis-security.com http://labs.portcullis.co.uk/ Tel: +44 (0)20 8868 0098 Email: asm@portcullis-security.com
Who am I? Eight years in Digital Forensics / edisclosure Portcullis since February 2012 LE and commercial clients Worked for both defences, prosecution and plaintiffs People still manage to surprise me!
What is edisclosure? Electronic disclosurerefers todisclosureincivil litigationwhich deals with the exchange of information inelectronic format(often referred to as Electronically Stored Informationor ESI). This data is subject to local rules and agreed-upon processes, and is often reviewed for privilege and relevance before being turned over to opposing counsel.
edisclosure vs Digital Forensics Forensic principles are applied where possible 1GB of data is equivalent to 65000 pages of A4. Expect to work on an average of 5 custodians Approximately 10GB of responsive data per custodian 50 x 65000 = 3,250,000 pages
edisclosure Putting it in Perspective
edisclosure Laws and Guidelines Civil Procedure Rules of England and Wales PD 31 PD 31b ACPO Guidelines for Computer Based Evidence
edisclosure Landmark Case Zubulake v. UBS Warburg 2003/2005. Plaintiff was awarded $29.3 million. Set many of the principles applied to ESI today Points to bear in mind are: Do not try to hide things Do not try to destroy things - someone WILL find out
edisclosure Early Case Assessment Identify level of exposure Can be used proactively Regulatory bodies can take a pragmatic view Average ECA of five days Dependent on volume of data
Electronic Discovery Reference Model Processing Preservation Information Management Identification Review Production Presentation Collection Analysis VOLUME Electronic Discovery Reference Model / 2009 / v2.0 / edrm.net RELEVANCE
Information Management Getting your electronic house in order Mitigate risk & expense From initial creation of ESI to final disposition Knowing where all relevant data is can reduce overall costs
Identification Aim: To identify: subject matter experts resources involved potential sources of data the depth and breadth of potential liability aggregate information sources for developing a course of action Goal: Evaluate, leverage and mitigate
Identification - Data Sources Data requiring examination may stem from many sources: Laptops, (Encryption)? Desktop Systems Servers NAS/SAN Thumb drives Digital Media cards
Identification - Data Sources Data requiring examination may stem from many sources (cont): Mobile telephones/blackberry MP3 players, IPOD etc Satellite Navigation Systems Backups (data tapes / cartridges etc)
Identification Potential Issues Could data fall outside corporate ownership? BYOD policy Employee status (full time, contractor?) Webmail
Preservation Aim: When duty to preserve is triggered, promptly isolate and protect potentially relevant data in ways that are: Legally Defensible Forensically Sound Proportionate Efficient Auditable Broad, but tailored Goal: Mitigate risks
Collection Aim: When data needs to be used, collect potentially relevant data in ways that are: Legally Defensible Forensically Sound Proportionate Efficient Targeted Auditable Goal: Mitigate risks
Collection Methods Forensic image acquisition Targeted collection of data using specialist utilities Mailbox dumps or complete message database? Client provided data Copying of data using file manager (Windows Explorer, Finder etc)
Processing Aim: Perform actions on ESI to allow for: metadata presentation Itemisation normalisation of format data reduction via selection for review Goal: Identify ESI items appropriate for review and production as per project requirements
Review Aim: Gain an understanding of document content while organising them into logical sub-sets in an efficient and cost effective manner Goal: Develop facts Reduce risk and cost Leverage technology Facilitate collaboration and communication
Production Aim: To prepare and produce ESI in an agreed upon and usable format Goal: Efficient production in compliance with agreed production specifications and timelines Reduce cost, risk and errors
Portcullis and edisclosure Natural progression from existing services ECA ensures cost effectiveness CPR Practice Direction 31b Costs dependant on volume of data No per GB processing charges
Questions? Portcullis Computer Security Limited