When E-Discovery Becomes Evidence

Monday, June 11, 2007 When E-Discovery Becomes Evidence Make sure that you can easily authenticate the information that was so costly to produce By Leonard Deutchman Special to the Law Weekly A federal district judge from Maryland recently made the trenchant observation that "it makes little sense to go to all the bother and expense to get electronic information only to have it excluded from evidence" for lack of a sufficient foundation. District Judge Paul W. Grimm, in Lorraine v. Markel American Insurance Co., Civil Action No. PWG- 06-1893 (D. Md. May 4, 2007) Grimm, J. (101 pages), available online at http://www.mdd.uscourts.gov/opinions152/ Opinions/Lorraine%20v.%20Markel%20- %20ESIADMISSIBILITY%20OPINION.pdf, was dismissing summary judgment motions in a dispute over insurance coverage for a boat struck by lightning. What occasioned his deep insight was that both the insurance company and boat owners moved for summary judgment without first having "proffered any admissible evidence to support the facts set forth in their respective motions" as required by Federal Rule of Civil Procedure 56(c). In dismissing both motions, Grimm took the opportunity to provide "a comprehensive analysis of the many interrelated evidentiary issues associated with electronic evidence," which, he admitted, was dicta: "a broader and more detailed analysis" of the "evidentiary issues associated with the admissibility of electronically generated and stored evidence" than "would be required simply to resolve the specific issues presented" in the case. The court explained that it took this opportunity because "the pervasiveness today of electronically prepared and stored records" requires counsel to "be prepared to recognize and appropriately deal with" these issues, while there is a paucity of decisions on the matter. Grimm told the parties that "considering the significant costs associated with discovery of ESI, it makes little sense to go to all the bother and expense to get electronic information only to have it excluded from evidence or rejected from consideration during summary judgment because the proponent cannot lay a sufficient foundation to get it admitted." Since Grimm has written so perceptively on e-discovery matters in opinions, articles and books, and has been equally enlightening in his many appearances at e-discovery conferences, his analysis of how to authenticate electronically stored information is worth looking at in detail. Although a few pages of analysis cannot do justice to this thoughtful opinion, even a brief review leads to the ineluctable conclusion that forensic data collection is the prerequisite for authentication of ESI for all but a small class of cases. Moreover, even where the relatively low threshold for authentication of ESI can be met through other means, forensic data collection provides the strongest source of

authentication evidence. Finally, forensic collection and tracking of files through e-discovery processing satisfies the requirements of both the authentication and original writing rules. Admissibility of ESI The court first observed that the criteria for admissibility of ESI are no different than for any other kind of evidence. "Whether ESI is admissible into evidence is determined by a collection of evidence rules that present themselves like a series of hurdles to be cleared by the proponent of the evidence," Grimm wrote. "Failure to clear any of these evidentiary hurdles means that the evidence will not be admissible." To show that ESI is admissible, its proponent must demonstrate that it is: relevant under Federal Rule of Evidence 401 authentic under Rule 901(a) not hearsay if offered for its substantive truth or, if it is hearsay, admissible under an applicable exception under Rules 803, 804 and 807 an original or duplicate, in the form in which the ESI is offered or, if not, admissible secondary evidence to prove the content of the ESI under the "original writing" Rules 1001-1008, and substantially more probative than prejudicial under Rule 403. Analysis of the relevance, hearsay and probative value "hurdles" does not differ whether the evidence is ESI or in some other form. However, because the authenticity and original writing hurdles raise technical questions, we will focus on them. Authenticity While a "party seeking to admit an exhibit need only make a prima facie showing that it is what he or she claims it to be," the court notes that "counsel often fail to meet even this minimal showing when attempting to introduce ESI, which underscores the need to pay careful attention to this requirement. Indeed, the inability to get evidence admitted because of a failure to authenticate it almost always is a self-inflicted injury which can be avoided by thoughtful advance preparation." The court then importantly observed that while "courts have recognized that authentication of ESI may require greater scrutiny than that required for the authentication of "hard copy" documents, they have been quick to reject calls to abandon the existing rules of evidence when doing so." Such "greater scrutiny" must be paid because, as the Manual for Complex Litigation Section 11.447 (4th Edition 2004) observes, "Computerized data raise unique issues concerning accuracy and authenticity" due to human error, computer error and the programs that produce accurate but misleading results. "The proponent of computerized evidence has the burden of laying a proper foundation by establishing its accuracy." The court then gives specific, technical examples of ways of laying a proper foundation. 'Hash Values' Grimm notes that Rule 901(b)(4), which permits authentication by "[a]ppearance, contents, substance, internal patterns, or other distinctive characteristics, taken in conjunction with circumstances," is "one of the most frequently used to authenticate e-mail and other electronic

records Courts have recognized this rule as a means to authenticate ESI, including e-mail, text messages and the content of websites." The court notes with approval the use of "hash values" to authenticate electronic evidence under Rule 901(b)(4). The court explains that a "hash value" is a "unique numerical identifier that can be assigned to a file, a group of files, or a portion of a file, based on a standard mathematical algorithm applied to the characteristics of the data set. The most commonly used algorithms will generate numerical values so distinctive that the chance that any two data sets will have the same hash value, no matter how similar they appear, is less than one in one billion Hash values can be inserted into original electronic documents when they are created to provide them with distinctive characteristics that will permit their authentication under Rule 901(b)(4)." The court further notes that ESI can be "hashed" during discovery "to create a form of electronic 'Bates stamp.'" Such hashing "underscores a point that counsel often overlook," that is, the very point Grimm made so forcefully at the start of the opinion: a "party that seeks to introduce its own electronic records may have just as much difficulty authenticating them as one that attempts to introduce the electronic records of an adversary." What the court does not discuss, but what is implicit in the court's opinion, and what was discussed in "Getting Ready for the Rules Changes, Part IV" (Pennsylvania Law Weekly Jan. 8, 2007), is that hash verification is the last step in making a bit stream, forensic copy of digital media. A forensic image gathers all data initially by making an exact "bit stream image," that is, an exact copy of all data on the media. Bit stream imaging is widely accepted by courts and peer groups as being scientifically reliable. By contrast, non-forensic data gathering often alters or simply omits data. When copying alters or omits data in or from the original, the hash value for the copy will, by definition, not be identical to that of the original, and so hash verification cannot take place. To guard against this, bit stream imaging is required; this is why bit stream imaging with hash value verification is practiced by law enforcement. Whether imaging a hard drive, a server or simply files therein, bit stream imaging must be practiced to make hash value verification possible. Metadata The court next points to metadata as another means of authentication under Rule 901(b)(4). Commonly described as "data about data," "metadata" is defined as "information describing the history, tracking, or management of an electronic document," and may include "all of the contextual, processing, and use information needed to identify and certify the scope, authenticity, and integrity of active or archival electronic information or records." The court provides some examples of metadata: "a file's name, a file's location (e.g., directory structure or pathname), file format or file type, file size, file dates (e.g., creation date, date of last data modification, date of last data access, and date of last metadata modification), and file permissions (e.g., who can read the data, who can write to it, who can run it)." The court then notes that because F.R.Civ.P. 34 now "permits a party to discover electronically stored information and to identify the form or forms in which it is to be produced," the party "therefore can request production of electronically stored information in its 'native format,' which includes the metadata for the electronic document"; that metadata, being a "distinctive characteristic of all electronic evidence," can thus "be used to authenticate it under Rule 901(b)(4)." Grimm's reliance upon metadata to authenticate ESI assumes, of course, that the metadata is reliable. However, that assumption must be predicated on the data having been gathered through forensic, bit-stream imaging. If the data is not gathered forensically but instead is collected simply by copying it to external media, such as a DVD, data is often omitted or altered. The most common example of alteration involves the file creation date: when a file is copied to a DVD in a non-forensic matter, the file's "file creation date" is often the date it was created on the DVD. In that situation, the metadata will contain the apparently inconsistent information that the file was last modified, for example, on Oct. 1, 2006 but created on Nov. 1, 2006. Obviously, the absurdity of a file creation date coming after the file's last accessed or modified dates undercuts the reliability of the metadata so that it cannot be used for authentication; conversely, if ESI has been gathered forensically and verified with a hash value, the forensic image

itself will be more than sufficient to authenticate the ESI and metadata analysis will not be necessary. Authentication Of course, a document, whether generated electronically, by typewriter, pen, pencil or crayon, may be authenticated by its author or anyone else who can provide eyewitness testimony of authenticity. Rule 901(b)(1) permits authentication by "[t]estimony that a matter is what it is claimed to be." This most obvious of categories would permit authentication through "the testimony of a witness that actually drafted the exhibit," but would also permit authentication even if the witness had no "personal knowledge of the making of a particular exhibit" so long as the witness had personal knowledge of how that type of exhibit was "routinely made," and that, importantly, such witness' testimony "provide factual specificity" regarding how ESI is "created, acquired, maintained, and preserved without alteration or change," as opposed to "boilerplate, conclusory statements that simply parrot the elements of the business record exception to the hearsay rule, Rule 803(6), or public record exception, Rule 803(8)." There are two caveats when invoking this rule. The first is that it will apply only in a small class of cases, that is, when the witness can actually recall authoring the document and can vouch that it has not been altered in any way. The second is that there is a great deal of difference between the weight and admissibility of evidence, and when e-discovery (or any discovery) is regarded as evidence, its weight as well as its admissibility should be kept in mind. Just as Grimm warns against using boilerplate conclusions to try to authenticate evidence, so should the practitioner be warned against having "just enough" evidence to cross the threshold of admissibility but not enough to overcome the burden of proving his or her case; in those situations, the lack of witness credibility will hurt your case, even if the ESI is admitted. As pertains to e-documents, a witness may be able to authenticate ESI, but the absence of hash verification and the presence of good opposing counsel can easily undercut the credibility of that witness before the trier of fact. You do not want the court to admit the evidence grudgingly, "for whatever it's worth," only to give it no weight or instruct the jury, whether directly or by off-hand remark, to give it no weight. Thus, forensic data gathering and hash verification are not simply good practice in producing e-discovery or even in authenticating it as evidence, but in meeting your ultimate burden of proof to prove your case before the trier of fact. Original Writing Rule "The next step in evaluating the admissibility of electronic evidence," the court instructs, "is to analyze issues associated with the original writing rule, which requires an original or duplicate original to prove the contents of a writing, recording or photograph unless secondary evidence is deemed acceptable." The court then provides a lengthy analysis of all aspects of the rule. Here, we will focus on but one: using the forensic tools we have discussed to so show that an email or e- document is an original writing. As I discussed in "Getting Ready for the Rules Changes, Parts V and VI" (Pennsylvania Law Weekly Feb. 12 and March 13, 2007), e-discovery is generally produced in a searchable database. All files are processed so that the producing party may review them easily in the database and produce selected files to opposing counsel. E-discovery that is then offered as evidence would of course be a duplicate of the original and so admissible under Rule 1003. However, by first making a bit-stream copy of the original media and then providing the "file path information" for each file offered into evidence, the e-discovery offered into evidence is shown to be a true copy of the original and thus passes muster under the Original Writing Rule. "File path" information is the location where a file is found: the computer or server on which it resided, the location within that media (the drive, the e-mailbox, etc.), the folders, sub-folders and name of the file. When data is gathered forensically and processed into e-discovery format, and the file path information, pointing to the source of the processed copy, is retained in the database, authentication has been built into the e-discovery searchable database and so is easy.

Moreover, the searchable database itself may be admissible under Rule 1006 which, the court notes, "permits introduction into evidence of written or testimonial summaries of voluminous writings, recordings or photographs, provided the original or duplicates from which the summaries were prepared were made available to the adverse party at a reasonable time in advance of trial for examination or copying." Having forensically imaged the original media, verified that forensic image by hashing it, and provided the file path information in the searchable database for each file, that database contains "voluminous writings," and a list of the contents of that database i.e., the ESI offered as evidence would be a "summary" of such a "voluminous writing." Thus, proper data gathering and preservation allows for e-discovery to be authenticated as evidence. Grimm's opinion in Lorraine is highly instructive to litigators who regard ESI solely as e-discovery. The opinion shows us that forensic data gathering at the start and tracking of files through processing is not only crucial to gathering and producing e-discovery but indispensable when you wish to offer that ESI as evidence. Leonard Deutchman is general counsel and managing partner of LDiscovery, LLC, formerly known as LegisDiscovery, a firm based in Fort Washington, PA and McLean, VA that specializes in electronic digital discovery and digital forensics. He may be contacted at ldeutchman@ldiscovery.com. This article is reprinted with permission from the June 11, 2007 issue of Pennsylvania Law Weekly. 2007 ALM Properties Inc. Further duplication without permission is prohibited. All rights reserved.