NYCLA BRIDGE THE GAP
January 25, 2012
eDiscovery 101:
The Discovery of ESI - A Practitioner’s Guide to Handling
Electronically Stored Information in Litigation
Instructors:
Kenneth Rashbaum - Rashbaum Associates, Principal
Jason Lichter - Seyfarth Shaw LLP, Senior Counsel
eDiscovery and Information Governance
Matthew Knouff - eDiscovery Counsel ,CDS
Christopher O’Connor - Director of Litigation Support. CDS
2012 ©
Your Instructors:
Matthew Knouff is General Counsel and
eDiscovery Counsel with Complete Discovery
Source, Inc. (CDS), a global, full-service provider
of eDiscovery services and technologies,
managed document reviews, and litigation /
investigation support solutions. Matthew
advises law firms and corporations worldwide
on eDiscovery and information governance best
practices and defensible deployment of
technology during legal proceedings. He is an
active member of Working Group 1 of The
Sedona Conference, is Chairman of the New York
County Lawyers’ Association’s Cyberspace Law
Committee’s eDiscovery Sub-Committee, has
developed numerous e-Discovery programs and
CLE courses, and is a frequent writer and
speaker on issues related to eDiscovery and
information governance nationally.
Em: mknouff@cdslegal.com
Ph: 212-813-7006
Your Instructors:
In his thirty years of experience as a litigator,
trial lawyer and counselor, Kenneth N.
Rashbaum has been the trusted advisor to
health care providers, health plans and
multinational corporations on information
governance and its compliance with federal,
state, and international law. He has served as
partner and Co-Chair of the E-Discovery,
Compliance and Data Management Practice
Group of Sedgwick, Detert, Moran & Arnold, LLP,
and Director of Consulting of Fios, Inc., where he
founded the Cross-Border divisions. Ken has vast
experience counseling multinational
corporations on data protection and privacy laws
and regulations in Europe, Asia, Canada, and
South America. Ken served as Co-Editor-in-Chief
of The Sedona Framework For Analysis
of Cross-Border Discovery Conflicts.
Em: krashbaum@rashbaumassociates.com
Ph: 212-421-2823
Your Instructors:
Jason Lichter is Senior Counsel and East Coast lead in
the eDiscovery and Information Governance practice
group of Seyfarth Shaw LLP, resident in the New York
office. Jason has advised clients and colleagues on all
major electronic discovery issues, both during and
outside of litigation, including document preservation
and retention policies, efficient approaches to
document review, forensic collections, backup tape
remediation strategies, cost shifting, vendor selection,
and cloud computing initiatives. Jason has also given
presentations and published articles on a number of
timely electronic discovery and legal technology topics
and is a member of the Sedona Conference’s Working
Group 1 on Electronic Document Retention and
Production. In 2009, Jason was named a “Future Star”
by Benchmark Litigation: The Definitive Guide to
America’s Leading Litigation Firms & Attorneys.
Jason graduated cum laude from Yale University in
2000 and received his J.D. from Harvard Law School in
2004. Prior to law school, Jason worked as a Software
Engineer for Sapient Corporation, an international IT
consulting company.
Em: jlichter@seyfarth.com
Ph: 212-218-5563
Your Instructors:
Chris O’Connor is the Litigation Support Services
Manager with Complete Discovery Source, Inc.
(CDS), a global, full-service provider of
eDiscovery services and technologies, managed
reviews and litigation/investment support
solutions. Chris has been advising and working
with law firms in the areas of eDiscovery for the
past decade. While his career has drawn him
more and more into advising and strategy
creation for reviews and firms, he is still actively
managing cases and working with clients to find
the best solution to their eDiscovery challenges.
In addition to working with clients, Chris is a
prolific speaker on various eDiscovery topics,
focusing on practical and defensible application
of the FRCP, state law, and cutting-edge
technology to the full EDRM lifecycle.
Em: coconnor@cdslegal .com
Ph: 212-718-7031
eDiscovery 101:
The Discovery of ESI - A Practitioner’s Guide to Handling
Electronically Stored Information in Litigation
Our Agenda Today
• eDiscovery in General
• EDRM / IGRM
• eDiscovery under the Federal Rules
• Ethics Rules to Understand
• 2011 – Year in Review
• Case Law Update
• Preservation, Litigation Holds, and FRCP 37(e)
• Collections – Domestic and Abroad
• Best Practices and Cost Cutting Throughout the Process
eDiscovery 101:
The Discovery of ESI - A Practitioner’s Guide to Handling
Electronically Stored Information in Litigation
Our Agenda Today
• The Processing Stage
• Review & Analysis – Keywords and Concepts
• Document Production
• Handling Privilege Communication and Attorney Work Product
• The Meet and Confer Process
• Costs Again
• Best Practices Overview
• What to Expect in 2012
The Discovery of ESI:
eDiscovery in General
What is eDiscovery?
• Electronic Discovery is the process of
identifying, collecting, preparing, reviewing, and
producing Electronically Stored Information
(ESI) during the legal process.
SEE YOUR MATERIALS:
• Seventh Circuit Electronic Discovery Pilot Program – Report on Phase 1.
•Report of the Judicial Improvements Committee (October 2011).
•Also see the “Suggested Protocol for the Discovery of Electronically Stored
Information (Maryland Protocol).
The Discovery of ESI:
eDiscovery in General
Types and Sources of ESI
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Email servers and attached storage
SharePoint servers and attached storage
File/Print servers and attached storage
Share drives
Server log files
Server RAM
Backup tapes or backup targets
External storage facilities
Failover sites
Hosted archive sites
Legacy systems
Internet Archives
Social Media (Facebook, MySpace,
Twitter, LinkedIn, etc.)
Cache files and cookies
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Chat room logs
Employee workstations
Employee external hard disks
Employee CDs/DVDs/thumb drives
Cloud data
Voice Mail
Digital camera memory
iPods/PDA
Cell phones
Corporate web sites/blogs/podcasts
Data in the possession of a non-party
Employee personal computers
Employee external email accounts
Registry files
Data located internationally
The Discovery of ESI:
eDiscovery in General
Why is eDiscovery Important?
– EVERY case involves some type of electronic data.
– It can be your best friend or your worst enemy.
– No more excuses. There are too many educational/vendor resources
available.
– Serious consequences for not satisfying your discovery obligations.
• Coleman (Parent) Holdings, Inc. v. Morgan Stanley & Co., Inc.
• 2011 Mid-Year Update on E-Discovery Cases, Gibson, Dunn & Crutcher.
The Discovery of ESI:
eDiscovery in General
ESI is Discoverable
• FRCP 26(b)(1) permits discovery as to “any matter, not privileged,
that is relevant to the claim or defense of any party.”
• The Rules now expressly call for the discovery of “Electronically
Stored Information.”
- FRCP 26(a)(1)(B), 33(d), and 34(a).
• The intent is to eliminate ambiguity associated with “documents” and
“data compilations.”1
1. 2006 Advisory Committee Note to Fed. Rule Civ. P. 26(a).
The Discovery of ESI:
eDiscovery in General
What Makes ESI Unique?
Benefits
Burdens
Storage
Accessibility
Searchability
Easy to Generate
Fast and Reliable
Metadata
Voluminous
Variety
Dynamic
Resilient
Delicate
Metadata
The Discovery of ESI:
eDiscovery in General
Is Metadata Discoverable?
“Metadata” is not directly addressed by the FRCP but keep in
mind Rule 26(b)(1):
• Is it relevant to any claim or defense?
• Does it lead to the discovery of admissible evidence?
GENERAL RULE: production should be made in the form or forms in which the
information is ordinarily maintained or in a reasonably usable form, taking into
account the need to produce reasonably accessible metadata that will enable the
receiving party to have the same ability to access, search, and display the
information as the producing party – Sedona Principles – 2nd Edition (2007).
The Discovery of ESI:
eDiscovery in General
What is Metadata?
•
The who, what, where and when of a document.
•
Data about Data
•
Electronic DNA
•
Sedona’s Definition: Information about a particular data set or
document which describes how, when and by whom it was
•
collected, created, accessed, modified and how it is formatted.
Evidence, typically stored electronically, that describes the
characteristics, origins, usage and validity of other electronic
evidence.
Two “Must Read” Cases: Aguilar v. Immigration & Customs, 255 F.R.D. 350, 354 (S.D.N.Y.
2008). National Day Laborer Org. Network v. Immigration & Customs Enforcement Agency,
2011 U.S. Dist. LEXIS 11655 (S.D.N.Y. February 7, 2011). NOTE: National Day Laborer
Opinion was WITHDRAWN!
The Discovery of ESI:
eDiscovery in General
Types of Metadata
System Metadata:
Substantive/Application Metadata:
Embedded or User Metadata:
Information that is
automatically generated
by a computer system.
Reflects modifications and
substantive changes to a
document.
Directly or indirectly inputted by
a user not typically viewable in
the output display.
The Discovery of ESI:
eDiscovery in General
Why is it important?
•
EVERY active file contains metadata.
•
Helps you make sense of ESI.
•
Enhances our ability to review data (i.e. sorting, searching, reports).
•
Can be the key to the relevance of a piece of information.
•
Can be critical to supporting or challenging privilege claims.
•
Can help you establish a prima facie case.

•
See Elektra Entertainment Group v. Does 1-9 (S.D.N.Y Sept 7, 2004).
Can support a motion to dismiss and sanctions.
The Discovery of ESI:
eDiscovery in General
It is Important that you understand that:
The standard is not perfection, the standard is reasonableness.
“Courts cannot and do not expect that any party can meet a standard of
perfection…”
The Hon. Shira Scheindlin, United States District Court Judge for the
Southern District of New York in Pension Committee of the Univ. of
Montreal Pension Plan et al. v. Banc of America Securities, LLC, et al.
The Discovery of ESI:
eDiscovery in General
The Light at the End of the Tunnel
The Discovery of ESI:
EDRM / IGRM
The Discovery of ESI:
EDRM / IGRM
The Information Governance Reference
Model (IGRM) Project is designed to:
•
Provide a framework to help organizations
develop and implement effective
information management programs.
• Seeks to facilitate dialogue among
stakeholders.
•
The IGRM is an entirely new reference
model; a separate counterpart to EDRM.
Go to http://www.edrm.net/projects/igrm
The Discovery of ESI:
eDiscovery Under the Federal Rules
The 2006 eDiscovery Amendments
• Electronic Discovery has changed the way lawyers interact with their clients,
each other and the courts.
• To address the emerging technical challenges that electronic discovery
presents, amendments to the FRCP were created. These rules went into effect
on 12/1/2006.
• Designed to facilitate cooperation.
• Do we need to amend the amendments?
The Discovery of ESI:
eDiscovery Under the Federal Rules
The 2006 eDiscovery Amendments
• The definition of what is discoverable: FRCP 26(a)(1), 33, and 34;
• Dealing with ESI early:
FRCP 16(b), 26(a), 26(f) and Form 35;
• Designating the format of ESI: FRCP 34(b) and FRCP 45;
• Discovery from sources that are not reasonably accessible: FRCP 26(b)(2);
• Post-production claims of privilege: FRCP 26(b)(5);
• Interrogatories and production requests:
FRCP 33, 34(a), and (b).
• “Safe Harbor” for inadvertent spoliation: FRCP 37(e);
• Subpoenas FRCP 45.
ALSO SEE: Federal Rule of Evidence 502(b):
Limitations of AC/WP Privilege Waiver.
The Discovery of ESI:
eDiscovery in New York State
eDiscovery in New York
• Uniform Rules for the Trial Courts - Rule
202.12(c)(3)
• The Commercial Division for the Supreme Court,
Nassau County
• Cost Shifting – CPLR 3111
SEE YOUR MATERIALS: Tener v. Cremer, 2011 N.Y. Slip op. 6543 (1st Dep’t
2011). NYSBA – Best Practices in E-Discovery in New York State and Federal
Courts.
The Discovery of ESI:
Ethics Rules to Understand
The Ethics of eDiscovery
It is important to understand the ethical obligations of attorneys since often times
paralegals are running the show:
• MRPC 1.1 – A lawyer shall provide competent representation to a client
 The importance of Issues related to search and retrieval.
- United States v. O’Keefe (2008).
- William A. Gross Construction Assoc. v. American Manufactures
Mutual Insurance Co. (2009).
• MRPC 1.6 – Confidentiality of Information
• MRPC 3.4 – Fairness to Opposing Party and Counsel
• MRPC 4.4 - Respect for Rights of Third Persons
• Duty to Cooperate under FRCP 26(f) and state equivalents.
The Discovery of ESI:
2011 Year in Review
The Year in Review: eDiscovery in 2011
• Parties increasingly sought sanctions but the number of court granting
sanctions remained consistent with 2010.
• The growing focus on proportionality
• Parties increasingly sought the taxation of eDiscovery costs.
• Cooperation
• Development in the criminal context
• The certification debate raged
SEE YOUR MATERIALS: The ABA Journal – The Trouble with Terabytes (Cloud Computing
Article).
The Discovery of ESI:
2011 Year in Review
The Year in Review: eDiscovery in 2011
• Assisted review became more prevalent.
• Cross-Border eDiscovery
• Social media is playing a large role in discovery.
• Privacy
• Reform of the Federal Rules
SEE YOUR MATERIALS: Gibson, Dunn and Crutcher 2011 Mid-Year E-Discovery Update http://www.gibsondunn.com/publications/pages/2011Mid-YearE-DiscoveryUpdate.aspx . 2011
Year-End Update is a resource that should be available online shortly.
The Discovery of ESI:
Case Law Update
Case Law Update – Important 2011 Opinions
• Nat’l Day Laborer Org. Network (NDLON) v. United States Immigration and Customs
Enforcement Agency (ICE) (S.D.N.Y. Feb. 7, 2011) (Rescinded)
• Steuben Foods, Inc. v. Country Gourmet Foods, LLC (W.D.N.Y. Apr. 21, 2011)
• Race Tires America v. Hoosier Racing Tire Corp., 2011 WL 1748620 (W.D. Pa. May 6, 2011).
• Katiroll Co. Inc. v. Kati Roll & Platters, Inc. (D.N.J. Aug. 3, 2011)
• Abu Dhabi Commercial Bank v. Morgan Stanley & Co. Inc. (S.D.N.Y. Aug. 18, 2011)
• Victor Stanley, Inc. v. Creative Pipe, Inc., "Victor Stanley III", 2011 U.S. Dist. LEXIS 112846
(D. Md. Sept. 30, 2011).
• Pippins v. KPMG LLP, No. 11 Civ. 0377 (CM) (JLC), 2011 WL 4701849, at *1 (S.D.N.Y. Oct.
11, 2011).
The Discovery of ESI:
Preservation
The Duty to Preserve - Discovery Generally
• Pre-trial discovery in the U.S. is VERY broad.
• FRCP 26(b) extends far beyond relevance to include
anything that “appears reasonably calculated to lead
to the discovery of admissible evidence.”
The Discovery of ESI:
Preservation
The Duty to Preserve ESI
• Proper preservation ensures that electronically stored
information is protected against destruction or alterations.
• Key Questions:
– What is the duty to preserve?
– When does the duty arise?
– What is the scope of the duty?
– How do you satisfy the duty?
The Discovery of ESI:
Preservation
The Preservation Obligation
Q. What is the duty to preserve?
A. The duty to preserve is essentially the duty to prevent “the destruction or significant
alteration of evidence, or the failure to preserve property for another’s use as evidence in
pending or reasonably foreseeable litigation.”2
Q. When does the duty to preserve arise?
A. At the time when a company reasonably anticipates litigation.3
2. Zubulake v. UBS Warburg, 02 Civ. 1243 (SAS), slip op. at 5, 220 F.R.D. 280 (S.N.D.Y. Oct 22, 2003) (Zubulake IV) (quoting
West v. Goodyear Tire & Rubber Co., 167 F. 3d 776, 779 (2nd Cir. 1999)).
3. 2. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 216-17 (S.D.N.Y. 2003); (see also Wiginton v. CB Richard Ellis, 2003 WL
22439685, *4 (N.D. Ill. Oct. 27, 2003) (Wiginton I) ("A party has a duty to preserve evidence over which it had control and
'reasonably knew or could reasonably foresee was material to a potential legal action.'") (citation omitted).
The Discovery of ESI:
Preservation
The Preservation Obligation - Scope
Q. What is the scope of the duty?
A. A “party or anticipated party must retain all relevant documents (but
not multiple identical copies) in existence at the time the duty to
preserve attaches, and any relevant documents created thereafter.”4
NO DUTY TO RETAIN EVERYTHING!
Balanced against reasonableness and proportionality
4. Zubulake v. UBS Warburg, LLC (Zubulake IV), 220 F.R.D. at 218 (S.D.N.Y. 2003).
The Discovery of ESI:
Preservation
The Preservation Obligation
Q. How do I make preservation decisions?
1.
2.
3.
4.
5.
Decide what types of data are discoverable and relevant.
Identify the sources that contain this data.
Determine the accessibility of these sources.
Investigate the availability of other sources with this data.
Weigh the benefit of the data against the burden of preservation.
PRACTICE TIP - If you are the requesting party request with particularity
important data in a direct and timely manner.
The Discovery of ESI:
Preservation
Preservation Obligation - Inaccessible Data
• A party need not provide ESI that is not reasonably accessible because of undue
burden or cost.
• Burden on producing party to show inaccessibility.
• How do you “identify” these sources?
• If burden met, court may still order discovery subject to limitations of 26(b)(2)(C).
• Court balances the costs/burdens based on the circumstances of the case.5
PRACTICE TIP - Assert claims on inaccessibility early prior to production to
preserve cost-shifting arguments.
5. 2006 Advisory Committee Note to Fed. Rule Civ. P. 26(b)(2).
The Discovery of ESI:
Preservation
The Preservation Obligation - Compliance
Q. How do you satisfy the duty to preserve?
A.
Lots of debate, but the most widely endorsed mechanism is the legal hold:
1. Formalized suspension of routine retention/destruction policies,
2. Designed to ensure that key parties know about preservation efforts,
3. Prevents spoliation!
The Discovery of ESI:
Preservation
Litigation Holds
Strictly a creature of case law:
• Does not appear in any federal or state statute, nor is it in the Federal
Rules of Civil Procedure.
• No national electronic discovery or data retention standard though
industry-specific regulations often require maintenance of certain records
for specified periods of time, unrelated to litigation.6
6. 29 C.F.R. § 1602.14 (“Preservation of Records Made or Kept”); 18 C.F.R. § 125.2(l) (“[I]f a public utility or licensee is involved in pending
litigation, complaint procedures, proceedings remanded by the court, or governmental proceedings, it must retain all relevant records.”); 18
U.S.C. § 1519 (Sarbanes-Oxley Act § 802) (“Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false
entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of
any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or
contemplation of any such matter or case, shall be fined under this title, imprisoned not more than twenty years, or both.”). Health Insurance
Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (1996).
The Discovery of ESI:
Preservation
The Preservation Obligation:
Litigation Hold Life Span
MAINTENANCE
1.
2.
3.
4.
Re-issue as needed
Remind of ongoing obligations
Continue to collect active data
Identify and store backup data
IMPLEMENTATION
1.
2.
3.
4.
5.
TERMINATION
Identify & preserve information
Draft a written hold
Communicate with “key players”
Collective active data
Identify and store backup data
1. Custodian and data cross check
2. Termination notice
3. Audits to ensure data is not
unnecessarily retained
MONITORING
1.
2.
3.
4.
Ongoing certifications from custodians
Penalties for non-compliance
Auditing and sampling procedures
Designating a hold monitor
The Discovery of ESI:
Preservation
The Preservation Obligation
Q. When do I discuss preservation with opposing
counsel?
A. As soon as possible prior to a 16(b) order.
1. Help prevent waiver of subsequent spoliation claims.
2. Addresses potentially hazardous issues, e.g. production format.
3. Can help you maintain “business as usual.”
The Discovery of ESI:
Preservation
The Preservation Obligation
Q. What are some other practices to follow?
1. Be careful when you move potentially discoverable information
subject to a preservation duty from accessible to less accessible
data stores.
2. You can take steps to minimize the accumulation of inaccessible
data, but keep your preservation duty in mind.
3. Encourage communication among your client’s business units.
The Discovery of ESI:
Preservation
The Preservation Obligation: The Debate
• Pension Committee v. Banc of America – specific conduct can support a per
se finding of gross negligence.
• Rimkus Consulting Group Inc. v. Nickie G. Cammarata - judging conduct turns
on what is reasonable under the circumstances and must be weighed in
proportion to the facts of the case.
• Orbit One Communs., Inc. v. Numerex Corp. – expressly rejected both
opinions - Until a more precise definition is created by rule, a party is welladvised to “retain all relevant documents (but not multiple identical copies) in
existence at the time the duty to preserve attaches.”
The Discovery of ESI:
The Rule 37 Safe Harbor
The “Safe Harbor” Provision – 37(e)
• No sanctions for data lost as a result of the “routine, good-faith operation of an
electronic information system”.7
• A “routine operation” is an automatic operation, without direct user interaction.8
• You cannot “exploit” these systems to thwart discovery.9
• The Sedona Conference “good-faith” factors.10
7. 2006 Advisory Committee Note to Fed. Rule Civ. P. 37(f).
8. Id.
9. Id.
10. The Sedona Principles: Second Edition: Best Practices Recommendations & Principles for Addressing Electronic Data Production
(June 2007 www.thesedonaconference.org), Cmt. 14.d.
The Discovery of ESI:
Collections – Domestic and Abroad
Collection
Taking possession of preserved ESI identified as potentially relevant to a
particular matter
=
The Discovery of ESI:
Collections – Domestic and Abroad
Data Collection Objectives
1. To develop a clear and defensible Data Collection
strategy.
2. To securely and accurately collect user created
data.
3. Minimize business disruption.
4. Move this collected data to a reviewable form.
SEE YOUR MATERIALS: Computer Systems Checklist (Administrator). Don’t forget to do a
checklist for individual custodians as well.
The Discovery of ESI:
Collections – Domestic and Abroad
Data Collection Considerations
Q. Is the collection for the purposes of litigation or an investigation?
A. A forensic collection is recommended.
Q. Is this collection for retention purposes?
A. A non-forensic image may suffice.
Q. Is this collection for business purposes?
A. Just making a simply copy may do the trick
Q. What type of data are you going to be collecting (i.e. active, archival,
backup tapes, metadata, legacy, paper, etc.)?
A. Depends – this will impact your methods
The Discovery of ESI:
Collections – Domestic and Abroad
Collection – Complicating Factors
•
•
•
•
•
•
Foreign Languages
Foreign Sources
Compressed Files
Encryption
Embedded Objects
Disparate systems / platforms /
file formats
• Paper (with hand-written, poorquality, or difficult-to-index
information)
• Disparate time zones
• Your client!
 BEST PRACTICE TIP:
If a client needs to use their device and discovery is limited to a prior time frame,
go ahead an get a forensic image of that device immediately. Then you have a
pristine copy to help prevent/respond to spoliation claims.
The Discovery of ESI:
Collections – Domestic and Abroad
Looking at the Big Picture
• Focus on potentially relevant data NOT the needle in the
haystack
• Minimizing risk, cost, and impact to “business as usual.”
• Forensic specialists are not required but recommended.
• What type of collection will you perform?
• Keep in mind that preservation efforts may be even broader than
collection. NARROWING SCOPE IS KEY!!
The Discovery of ESI:
Collections – Domestic and Abroad
What Type of Collection Will You Perform?
• Forensic vs. Non-Forensic
• Targeted collections & Remote Collections – Benefits and burdens
• Active Files Only
• Self-collection – Often performed but not recommended.
• Use tools that preserve metadata
• Copy Tools (i.e. Robocopy, Upcopy)
• Administrative Tools (i.e. Exmerge)
The Discovery of ESI:
Collections – Domestic and Abroad
Non-Forensic Collection - What You Do Get?
• You DO capture “system” files.
• You DO capture “user-created” files.
• You DO get what Windows “sees.”
• You DO get A SLOW PROCESS!
This may be enough, but…
• You DO NOT get slack, unallocated,
deleted, or swap space.
• You DO NOT necessarily maintain file
metadata.
Pre-Robcopy (this is the date/time
metadata for the original)
Post-Robcopy (this is the date/time
metadata for the copy)
The Discovery of ESI:
Collections – Domestic and Abroad
Forensic Collection - Imaging
• Bit stream imaging - sector-by-sector copy (includes systems files, slack
space, unallocated space, etc.)
• This process creates an exact copy of the drive
• May be physical or logical
• Captures active, deleted, altered, and even damaged files
• Most useful on workstations/laptops
• Requires proper hardware
• Requires trained forensic specialist
• Creates a “snapshot” of the contents of drive on that particular day
• Needed to recover hidden and deleted files
ALWAYS RECOMMENDED IN THE LEGAL CONTEXT!
The Discovery of ESI:
Collections – Domestic and Abroad
Remote Collection – Issues
• Chain of Custody/Validation
• Applets/Network Issues
– No clear way to link collected data to
a specific piece of media.
– Basically a “hacker” technique
– Could act like a virus - someone
could even use this avenue to inject
"evil" code into a user’s device
• Ever Changing Evidence
– Files may not be able to be “copied”
while in use.
– Files in use may be changing as the
collection is occurring.
• Long File Paths
– What do you do if the path is > 255
characters?
– This is how EnCase Enterprise and
EnCase eDiscovery work…some IT
admins may not trust this.
•
Complete Acquisition
–
You can't confirm that you actually
got everything.
The Discovery of ESI:
Collections – Domestic and Abroad
Various Forensics Tools
• Forensic Tool Kit (FTK) – Access Data
• EnCase – Guidance Software
• Paraben Suite of tools
• Blacklight 2011 R5 – Black Bag Technologies (Mac)
• Oxygen Forensic Suite 2012 (mobile devices)
• Password Recovery Tool Kit – Access Data
• Active Ports – SmartLine (Network Investigations)
MAKE SURE TO ANALYZE YOUR ANALYSIS TECH!
The Discovery of ESI:
Collections – Domestic and Abroad
“Informal” Collection
• FRCP 26(b)(1) – Broad scope of discovery
• Certain standards that you NEED to consider:
1. Record all hash values of original files/folders at acquisition.
2. Match these values against copied versions.
3. Maintain a detailed log.
4. Engage a third party to maintain a credible source of testimony.
YOU ARE SETTING A FOUNDATION FOR ADMISSIBILITY!
The Discovery of ESI:
Collections – Domestic and Abroad
Collection of New Media – Considerations
• Make sure to ask about cell phones, iPODs, PDAs, Digital
Cameras, GPS devices, websites, etc.
• Consider physical and technical characteristics as well as
expansion components (i.e. memory cards, external hardware).
• Voicemail is not something you can recover from a phone.
• Get it ASAP – this type of data is “easily lost”
• Social media collections are still in their infancy. You can use
printouts – just remember that you are aiming for admissibility.
• Remember to account for a custodians web based email accounts.
The Discovery of ESI:
Collections – Domestic and Abroad
Forensic Collection – Analysis and Extraction
•
•
•
•
•
•
•
•
•
•
•
. These steps occur after you have imaged a device.
Sort files into more manageable categories
View and extract deleted files
Streamline information – narrow focus
Pinpoint Critical – “Smoking gun” documents
Acquire and analyze Cell Phones, PDA’s BlackBerry devices and iPods
Recover lost password for many common applications
Targeted “keyword” searches
Email Specific culling and searching
Registry analysis
“More of an art than a science”
Chain of
Custody
A chain of custody is the
process of validating how a
piece of evidence has been
gathered, tracked, and
protected on its way to a
court of law. An unbroken
chain of custody shows:
• Where data has traveled
• Who touched it
• What was done to it
Chain of
Custody
WHAT TO EXPECT
•DO expect that chain-ofcustody evidence will end
up in court.
•DO expect the other side
will challenge your
evidence, its handling and
the chain of custody.
The Discovery of ESI:
Collections – Domestic and Abroad
Eight Steps for Helping Establish an Unbroken Chain of
Custody
1.
2.
3.
4.
5.
6.
7.
8.
9.
Forensic examiners take possession of media.
Identifying information is recorded.
Forensic image is generated.
Hash value taken of the forensic copy.
Evidentiary copy is preserved to maintain authenticity.
Working copy is made.
Evidentiary copy stored in a secure environment.
Working copy used for all access.
All transfers (even in-house) are documented.
The Discovery of ESI:
Collections – Domestic and Abroad
Admitting & Objecting to ESI
• Request Chain of Custody Logs
• Argue changes in metadata
• Document your process
• Find breaks in the chain
• Ensure discovery of metadata
• Ask about how data is stored.
• Request registry files
• Could data have been manipulated,
altered, replaced or changed?
• Vet your experts and vendors
The Discovery of ESI:
Admissibility in Brief
A Quick Note on Admissibility
The rules of evidence are not suspended because the matter sought to be
admitted is in electronic format, rather than paper.
Is the ESI: (1) Relevant, (2) Authentic, (3) Reliable, (4)
Non-Hearsay or an exception, (5) acceptable under the
Original Evidence Rule, and (6) more probative than
prejudicial.
A “MUST READ” CASE: Lorraine v. Markel American Insurance Co.,
2007 241 F.R.D. 534, U.S. Dist. LEXIS 33020 (D. Md. May 4, 2007).
The Discovery of ESI:
Collections – Domestic and Abroad
How to Chain of Custody Issues
You will typically face a 2-pronged attack
with regards to chain of custody issues:
1. What is your process?
2. Did you follow your process?
The Discovery of ESI:
Collections – Domestic and Abroad
What is Your Process?
When this prong the process comes under attack what do you need
to answer?
1.
2.
3.
4.
5.
6.
7.
What do you do?
How do you do it?
Who keeps custody the evidence?
Where and how is it kept? Is it stored in a locked container?
Can the data be altered?
Can you prove the data has not been altered in your custody?
What changes are made to your data during your process?
The Discovery of ESI:
Collections – Domestic and Abroad
How to Defend Against Prong 1 of the Attack?
• Establish a standard operating procedure.
• Do the exact same thing each time you affect a collection.
• Establish a clearly delineated workflow.
– Who does What.
• Assign evidence handling responsibilities only to certain limited
evidence custodians.
• Use court challenged industry standard tools and procedures.
The Discovery of ESI:
Collections – Domestic and Abroad
Did You Follow Your Process?
Use a Chain of Custody Form
• Confirms that evidence was not altered
• Follows the evidence during the entire data gathering lifecycle
• Describes who handled the evidence and why
• Must be kept and available for review
Have Documented Procedures (i.e. escalation, retention, disaster
recovery, etc.)
The Discovery of ESI:
Collections – Domestic and Abroad
How to Defend Against Prong 2 of the Attack?
• Repeat your successes, do the same thing, each and every time.
• Maintain your chain of custody throughout the lifecycle of the case
or litigation.
• Keep the evidence stored securely with very limited access.
AND IF YOU DON’T FOLLOW THESE STEPS…
The Discovery of ESI:
Collections – Domestic and Abroad
Keep detailed documentation
throughout the collections process:
•
•
•
•
Computer Systems Checklist (Administrator)
Computer Systems Checklist (Employee)
Chain of Custody Forms
Media Intake Reports and Tracking
The Discovery of ESI:
Collections – Domestic and Abroad
DISCOVERY OF CLOUD DATA ORIGINATING OUTSIDE U.S
Privacy Laws, Data Protection Laws and Blocking Statues may
impede discovery
– Server locations may be an issue. See, Columbia Pictures v.
Bunnell (data with company in Netherlands but servers in U.S.)
• Germany: DPA of Schleswig-Holstein announced sending data to
Cloud violates German Data Privacy Act, unless servers are
within borders of Germany
The Discovery of ESI:
Collections – Domestic and Abroad
DISCOVERY OF CLOUD DATA ORIGINATING OUTSIDE U.S
How to collect data from the Provider?
• Does the SLA provide for collection methods and timing? Examples:
format (Native vs. TIFF), metadata preservation
• Identification of data and search modalities
• Where will the review be conducted? Restrictions apply to unfiltered
personal data in the European Union and elsewhere.
• Evidentiary Issues: Foundation for ESI
The Discovery of ESI:
Collections – Domestic and Abroad
ADDITIONAL CONCERNS
•
Complex pre-trial discovery slows down the case
•
Judges frequently have outdated equipment, reduced staff and little real-world experience
with ESI
•
“The technology of the digital revolution is forbidding to most lawyers, who after all went to law
school because they could not do math or science.” Goode, Steven, The Admissibility of
Electronic Evidence, 29 Rev. Litig. 1 (2009)
•
Most lawyers as a result, DO NOT ADEQUATELY EDUCATE THE COURT; they do not give
the court the basis for favorable rulings.
The Discovery of ESI:
Collections – Domestic and Abroad
NOW WHAT? PRACTICAL ACTION LIST
Plan Prior to Collection:
1.
2.
3.
4.
5.
6.
7.
8.
9.
What is needed?
Where is it (Cloud? Servers? Laptops?)
Is it Protected?
Are there Data Protection Agreements?
What are the language issues?
Permissions/notifications needed?
Is it here already and if so, is onward transfer permitted?
Where should the review be established?
What are the protocols needed for on-site initial review?
The Discovery of ESI:
Collections – Domestic and Abroad
ASSEMBLE THE COLLECTION TEAM
• Client representatives in U.S. and host country; local
counsel; experienced cross-border discovery U.S.
outside counsel; third-party consultant
• Make the process defensible here and in the host
country:
– Local counsel should advise whether local data protection
authority requires permission, notice, or neither
– There will usually be some risk but, with adequate
protocols and documentation of process, it can be reduced
to an acceptable level
The Discovery of ESI:
A Quick Peek at the Costs
Riskiest Area
Costliest Area
15% of Cost
Processing
25% of Cost
Preservation
Information
Managemen
t
Review
Identification
Production
Presentation
Collection
Analysis
Planning
Electronic Discovery Reference Model / © 2009 / edrm.net
60% of Cost
Execution
The Discovery of ESI:
Best Practices & Cost Cutting Throughout the Process
Culling Data Prior to Review
Set boundaries to narrow scope:
• Have limits been agreed to by the parties?
• Can you start with a sample?
• Can you test a handful of custodians to gain a better understanding of the volume
and data types you can expect?
• Can you eliminate certain file types?
• Can you eliminate certain groups of employees?
• Can you identify a defensible date range?
NOTE: These boundaries can help narrow collection as well as review BUT keep in
mind that preservation still applies.
The Discovery of ESI:
Processing
The Processing Stage
The Steps of Processing
1. Document extraction
2. Dealing with metadata
3. Deduplication
a. Types
i.
Global
ii. Custodian
b. Near Deduplication
4. Data Culling
The Discovery of ESI:
Processing
The Processing Stage
Best Practices for Dealing with Backup Tapes
• Gain a firm understanding of your client’s data retention policy.
• Find the data elsewhere.
• Sampling: Searching a small collection of sources for relevant
information before the resources are expended to collect, review and
produce.
The Discovery of ESI:
Processing
The Processing Stage
How to Keep Tabs on Data Processing?
REPORTS!!
1.
2.
3.
4.
5.
6.
Media Reports
Custodian Reports
Chain of Custody Documentation
Data Culling Reports
Error/Exceptions Reports
Status Reports
The Discovery of ESI:
Processing
The Processing Stage
Native Review vs. TIFF Review
Cut unnecessary TIFFing costs
View hidden data
Review faster
Redact and endorse
Preferred by regulatory bodies
Create static images
The Discovery of ESI:
Processing
Processing – Collection to Production
1. DeNISTing - Removal of systems files and other unusable file
types
2. Pre-Processing - Deduplication, date filtering, key terms
3. Native Processing for Review - Process resultant set for
native review
4. Production Processing - Only TIFF, redact, and endorse
responsive set.
The Discovery of ESI:
Processing
Example of Cumulative Effect of Successive Reductions in Volume
Process
Original Volume
% Savings
GB Savings
Volume Left to
Examine (GB)
500
--
--
De-NISTing
(removing system
files)
Duplicate
Consolidation
Email Threading
20%
100
400
40%
160
240
30%
72
168
Domain Name
Analysis
Predictive Coding
60%
101
67
50%
38
39
92.2%
453
39 (just 7.8% of
original)
Overall Reduction
The Discovery of ESI:
Review & Analysis
State of Search and Retrieval Today
• Where were once were – the Papyrus Age.
• Legal professionals are used to many search and retrieval
technologies (this is good & bad):
– Google, Yahoo, and other search engines
– LexisNexis and Westlaw
– PACER
– De-duplication (LAW, Extractiva, Trident, Equivio)
• Keyword searching is the most common search technique for
analysis, ECA, and culling.
The Discovery of ESI:
Review & Analysis
Trends in Advanced Search Methodology
– Artificial Intelligence & Machine Learning
– Automated Review:
• Predictive Coding
– Concept Searching
– Categorization:
• Taxonomies/Ontologies
– Probabilistic Models
– Mathematical Methods:
• Latent Semantic Indexing (LSI)
– Relationship Forensics
– Email Analytics
The Discovery of ESI:
The First Step in Search and Retrieval: Indexing
• An index gives you the ability to search a particular set
of data or documents.
• An index is built from extracted text and/or OCR.
– Extracted text – native files.
• NOTE: Non-searchable PDFs require OCR.
– Optical Character Recognition (OCR) – image based files.
• 80%-85% accuracy depending on file quality.
• Your ability to search is only as good as your index.
Garbage In = Garbage Out.
– Files may be processed but not indexed.
• Different technologies index in different ways.
The Discovery of ESI:
Optimizing an Index for Searching
•
Know your technology.
– Searching functionality, and
– Internal network limitations.
•
•
•
Know your data.
OCR / Extracted Text = .txt files.
To QC your index for exceptions:
– Compare .txt files against total documents for document level extraction, or
– Compare .txt files against page count for page level extraction.
•
•
•
Run a search on empty text fields.
Different indexes are required for different functionality e.g. keyword index, DT
index, concept index.
When indexing a concept index, filter the data to remove any “noise” (e.g. remove
email headers, poor OCR, standard language, and footer information, etc.).
The Discovery of ESI:
Keyword Searching
• Keyword searching is set-based searching
using simple words and word combinations,
with or without Boolean and related
operators.
• Traditional approach accepted by and often
ordered by the courts.
The Discovery of ESI:
Keyword Searching
• Boolean Searching Basics:
– Attempts to mimic how humans use language.
– Results match terms and parameters exactly.
– Common Operators:
•
•
•
•
•
•
•
OR – expands the resultant set.
AND – restricts the resultant set.
NOT (BUT NOT, AND NOT) – eliminates ambiguity.
( ) – forces order and creates flexibility.
W/ - increases the accuracy of results.
“ ” – phrase searching.
Wildcards, e.g. ?, ! or * - widens or restricts a search through “stemming.”
• “Fuzzy” Searching
– Reduces words to their root and then matches up word forms.
– Similar to “stemming” in Boolean Searching.
The Discovery of ESI:
The Benefits of Keywords
• Works very well when you know exactly what language you want to
find (e.g. individual names, dates, complex IP cases, deal names).
• Helps you cut costs and support cost-shifting arguments.
• Readily accepted by the courts and conducive to agreement by
opposing counsel.
“It is universally acknowledged that keyword searches are useful tools
for search and retrieval of ESI…”
• The Hon. Paul W. Grimm, Magistrate Judge for the
United States District Court for the District of Maryland
in Victor Stanley, Inc. v. Creative Pipe, Inc (2008).
The Discovery of ESI:
The Problems with Keywords
• Depends on lawyers having to think of all the
ways language was used.
– THE KEYWORD GAME
– Raises issues with:
•
•
•
•
Culture
Geography
Lexicon
Knowledge-base
• Words are easily mizspelled.
The Discovery of ESI:
The Problems with Keywords
Let’s review the following forms of ambiguity:
• Lexical Ambiguity
– Lie, Note, Fish
• Structural Ambiguity
– Kids make nutritious snacks.
– Put the box on the table by the window in the kitchen.
• Polysemy
– Bake vs. Bake
• Denotation, Connotation, Implication
• Tropes
– Metaphor, Allegory, Homonym, Paradox, Irony
The Discovery of ESI:
The Problems with Keywords
• Language is ambiguous.
“Simple keyword searches end up being both over and under-inclusive in
light of the inherent malleability and ambiguity of spoken and written
English.”
•
The Hon. Paul W. Grimm, Magistrate Judge for the United States
District Court for the District of Columbia in Victor Stanley, Inc. v.
Creative Pipe, Inc. (2008) (citing the Sedona Conference Best
Practices Commentary on the Use of Search and Retrieval Methods
in E-Discovery (2007)).
– Keyword searches do not account for context.
• OVER-INCLUSIVE results
– Keyword searches do not account for multiple words defining a
particular concept.
• UNDER-INCLUSIVE results
The Discovery of ESI:
Keywords – What Jurists Think
“For lawyers and judges to dare opine that a certain search term or
terms would be more likely to produce information than the terms
that were used is truly to go where angles fear to tread.”
“This topic is clearly beyond the ken of a layman and requires that
any such conclusion be based on evidence that, for example, meets
the criteria of Rule 702.”
• The Hon. John M. Facciola, Magistrate Judge for the
United States District Court for the District of Columbia in
United States v. O’Keefe (2008).
Contrast: U.S. District Judge Ann Montgomery’s approach in
In re: Zurn Pex Plumbing Products (June 2009).
Keywords – What Jurists Think
“…all keyword searches are not created equal.”
“…there are well know limitations and risks associated with [keywords], and proper selection
and implementation involves technical, if not scientific knowledge.”
“Selection of the appropriate search and information retrieval technique requires careful
advance planning by persons qualified to design effective search methodology.”
“…the methodology should be tested for quality assurance.”
“…the party selecting the methodology must be prepared to explain the rationale for the
method chosen to the court, demonstrate that it is appropriate for the task, and show that it
was properly implemented.”
• Magistrate Judge Paul W. Grimm in Victor Stanley
(2008).
Keywords – What Jurists Think
“This Opinion should serve as a wake-up call to the
Bar…about the need for careful thought, quality
control, testing and cooperation with opposing counsel
in designing search terms or “keywords” to be used to
produce emails or other electronically stored
information...”
• The Hon. Andrew J. Peck, Magistrate Judge for
the United States District Court for the
Southern District of New York in William A.
Gross Construction Assoc. v. American
Manufactures Mutual Insurance Co. (2009).
The Discovery of ESI:
10 steps to UNDERSTANDing How to Craft Effective &
Defensible Keyword Searches
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
Understand the capabilities/limitations of tech.
Narrow the scope through filtering/de-duplication.
Design around ambiguity.
Engage key players.
Review methods and terms with opposing counsel.
Study the request for production.
Test your results.
Analyze hits.
Non-hits should be sampled.
Define new queries and test again.
The Discovery of ESI:
Trends in Search Methodology
• The move towards alternative methods.
• Generally, courts are looking into the mechanics of eDiscovery.
• Courts are refusing to compel productions where
requesting party cannot justify search terms.
– Seger v. Ernest Spencer, Inc. (D. Neb. Jan. 26, 2010).
– Bellinger v. Astrue (E.D.N.Y. Apr. 1, 2010).
– Sanctions issued in Edelen v. Campbell Soup Co. (N.D. Ga. 2010)
for party’s failure to “reasonably narrow” request through
search terms.
• Specifically, courts are steering clear of getting involved in
search methodology.
– Eurand, Inc. v. Mylan Pharms., Inc. (D. Del. Apr. 13, 2010).
The Discovery of ESI:
How Would You Respond?
Imagine your are a librarian. I come into the
library with a big smile and a readiness to dive
into the stacks. As I approach your desk you
ask, “how may I help you today sir?” I reply:
“BOOK”
The Discovery of ESI:
How Would You Respond?
A more defined response:
“I am looking for a non-fiction book that
addresses the various factors that John F.
Kennedy and EXCOMM considered during the
Cuban Missile Crisis in 1962.”
The Discovery of ESI:
Concept Searching
• Concept Searching uses various technologies
to understand the meanings and relationships
of words in a dataset and classify data
according to a “concept” or retrieve
information that is conceptually similar to text
submitted in a query.
The Discovery of ESI:
12 Benefits of Concept Searching
1. Results are based on relevancy instead of specific keywords or metadata.
2. Increases review speed by breaking from the linear tradition.
3. Allows users to find information without knowing exactly how to phrase a query.
4. Increases ability to quickly learn about a case.
5. Finds documents with terms that may not have been selected as keywords.
6. Equalizes the keyword “game.”
7. Reduces the risk of overlooking documents not found by traditional methods.
8. Identifies “code” words or other novel or non-traditional uses of language.
9. Pin-points similar documents once you find a particularly “hot” document.
10. Excludes “noise” effectively.
11. “Dumbs-down” the complexity of a particular lexicon.
12. Allows you to prioritize documents and optimize the skills of litigators.
The Discovery of ESI:
Concept Searching – Concerns
• Newness = Uncertainty
• I’m a legal professional not a mathematician!
• Will judges accept it?
– Prove your methods/offer up your processes.
– Show that it is reasonable.
– Judges like efficiency – so make it efficient.
• NOTE: Judge Grimm endorsed the Sedona Conference Cooperation
Proclamation in Mancia v. Mayflower Textile Services Co. (Oct. 15,
2008).
• We aren’t going to see all the documents.
The Discovery of ESI:
Alternate Methods of Search and Retrieval:
“Concept” Search
• Clustering – Retrieves documents based on the statistical
relationships between the words they contain and forms concept
clusters.
• Thesauri, Taxonomies & Ontologies – Relies on commercially
available data or specifically compiled information.
• Bayesian Classifiers – Uses probability theory to categorize
documents according to word “value.”
• Machine-Learning Approaches – Uses various models to determine
the correlations between words. Techniques include Latent
Semantic Indexing.
The Discovery of ESI:
Latent Semantic Indexing (LSI)
• A method of information retrieval that relies on
sophisticated mathematics as opposed to
ancillary linguistic references.
• Overcomes issues with synonymy and polysemy.
• LSI allows a tool to “learn” both the language and
the conceptual nature of a document by first
processing a “training set.”
• The “training set” creates the concept space in
which all other documents are mapped.
The Discovery of ESI:
Latent Semantic Indexing (LSI)
• The concept space
can represent
hundreds of
dimensions.
• All other documents
are mapped into this
space.
• Documents that are
closer together in
the space are more
conceptually similar.
The Discovery of ESI:
Search Index vs. Categorization Index
• Search Index – Machine Defined
–
–
–
–
Maps each document permanently into the concept space.
Larger disk and RAM footprint.
Takes longer to build.
Can be done with little to no knowledge of the case.
The Discovery of ESI:
Search Index vs. Categorization Index
• Categorization Index – User Defined
– Only exemplars are mapped permanently into the concept
space.
– When a data set is Categorized, each document is
temporarily mapped with the closest exemplar creating
the categorical designator.
– Requires knowledge of the case because you must choose
the exemplars.
– Requires a much smaller RAM footprint and less RAM to
be loaded into memory.
– Can be run on very large data volumes quickly.
The Discovery of ESI:
Using Concept Search to Categorize
• Clustering
– No user input is required to determine the organizational structure or
define categories.
– Beneficial if you know little about your dataset.
– The technology inspects the spatial relationships of all documents
within the index.
– Algorithms are used to identify sensible groupings.
– The groupings are labeled to facilitate understanding of each category.
– All documents are clustered once.
The Discovery of ESI:
Using Concept Search to Categorize
• Categorization
– Requires upfront user input to achieve a much more focused result. This
user input may consist of:
• A specifically created taxonomy.
• Selecting exemplar documents to define categories.
– Categorization is a break from the linear review model.
– Proven to increase the efficiency of a review.
– Documents can be placed into multiple categories as opposed to
Clustering.
– Beneficial if you:
•
•
•
•
know the categories of interest,
know what you want to title the categories,
have definitive exemplars, and
have large amounts of data to auto-categorize once you define the categories.
The Discovery of ESI:
12 Tips for Choosing a Conceptual Searching
Technology
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
Result items should be relevant to the information expressed by the concepts contained in the query
not on the specific terminology used.
Results are sorted and ranked by relevance.
Relevant result items should be quickly located and displayed regardless of complexity.
Query length is key. A sentence, a paragraph or even an entire document can be submitted as a query.
A concept query should be generated using natural language and not require any special or complex
syntax.
Combining queries using concepts, keywords and other filters should be allowed.
Relevant portions of result items should be usable as query text simply by selecting that text.
Query-ready indexes should be created quickly.
The search engine should be capable of performing concept queries across data sources, the results of
which are then merged, sorted and displayed (i.e. federated search).
Misspelled words, typographical errors or OCR scanning errors in either the query text or in the text of
the searchable dataset should not impact the concept query.
Know your vendor.
Demo the technology on your own data.
The Discovery of ESI:
How Concept Searching Can Cut Costs
• Spend money upfront to save it downstream.
– Remember the difference in cost of storage/cost of review.
• Use it as a preliminary assessment tool.
• Prioritize hourly rates.
• Limit your search to narrow the scope of discovery:
– Key custodians
– Key dates
– Key issues
• Uncover custodian relationships which can help eliminate
unnecessary review, evaluate preservation obligations and
eliminate unnecessarily burdensome litigation holds.
The Discovery of ESI:
Concept Search – What Jurists Think
“…concept searching, as opposed to keyword
searching, is more efficient and more likely to
produce the most comprehensive results.”
• The Hon. John M. Facciola, Magistrate
Judge for the United States District Court for
the District of Columbia in Disability Rights
Council of Greater Wash. v. Wash. Metro.
Area Transit Auth. (2007).
The Discovery of ESI:
Concept Search – Other Thoughts
“A party that uses advanced analytical
software applications and linguistics tools in
screening for privilege and work product may
be found to have taken “reasonable steps” to
prevent inadvertent disclosure.”
Explanatory Note to FRE 502
The Discovery of ESI:
Keywords are Not Obsolete:
Leveraging Multiple Methodologies
• Concepts are essentially
groups of keywords.
• Look for a tool that allows
you to leverage multiple
search methods.
• Employing multiple search
methodologies is proven to
be the most effective
approach.
Source: http://ralphlosey.files.wordpress.com/2009/03/jasonbaronpptlegaltrec.jpg
The Discovery of ESI:
Building a Process is Key
• Think of process as another “tool.”
• Building a process around your search methodology promotes:
–
–
–
–
Consistency,
Reliability,
Predictability, and ultimately,
DEFENSIBILITY.
• Make sure everything is documented. Remember Qualcomm!
• Case after case shows parties in trouble for failure to craft a viable search
strategy (e.g. Victor Stanley, Rhoads Indus., Inc., etc.).
– Ex. Basic Concept Search Process:
Analyze
Case
Index Data
Build
Categories
Select
Exemplars
Review
Results
Test
Results
Revise
Exemplars
The Discovery of ESI:
Production
Production Formats - 34(b)
• Rule 34(b) provides for a party to request the “form or forms” in which
electronically stored information is to be produced.
• Procedure:
 A party requests a particular format.
 Producing party complies or has 30 days to object.
 If producing party objects, it states the form(s) in which it intends to produce.
 If requesting party objects, the parties must meet and confer prior to filing a
motion to compel.
 If no form is requested then a producing party must “produce the information in
form or forms in which it is ordinarily maintained or in a form or forms that are
reasonably usable.”
The Discovery of ESI:
Production
Production Formats - 34(b) – Key Points
1. Knowing your client’s “information ecosystem” gives you
the advantage.
2. The production of metadata is NOT mandated.
3. Be prepared to produce in the format you request.
4. Only agree to a native production when there is a clear
rationale.
5. Be as specific as possible and request information to
prove compliance with Rule 34(b)(2)(E).
The Discovery of ESI:
Production
Production Formats:
“Reasonably Usable” or “Ordinarily Maintained”
• You can convert to various formats.
• Producing ESI in an electronic format is not mandated.
- Is it “reasonably usable” – The Scotts Co. v. Liberty Mutual Ins. Co. (S.D.
Ohio June 12, 2007).
• However, you cannot convert to a format that impairs a party’s ability
to use the ESI.
• Metadata stripping for purposes of litigation can be problematic under
Rule 34(b).
- In Re Payment Card Interchange Fee and Merchant Discount Antitrust Litig., 2007
WL 121426 (E.D.N.Y. Jan. 12, 2007).
The Discovery of ESI:
Production
Producing Metadata - Generally
KEY POINTS:
1. Courts usually order production when metadata is requested in
initial requests and no production has occurred in any form.
2. Later requests are often denied if productions have been made
and a request is not timely.
Metadata cases are very fact specific and courts often reject overly broad
requests for more tailored approaches:
In re Seroqual Prod. Liab. Litig., Slip Copy, 2007 WL 219989 (M.D. Fla. Jan. 26, 2007).
Dahl v. Bain Capital Partners, LLC, 2009 U.S. Dist. LEXIS 52551 (D. Mass. Jun. 22,
2009.
NOTE: The trend is to produce spreadsheets natively.
The Discovery of ESI:
Production
The Standards for Producing Metadata
The Discovery of ESI:
Privileged Data & Work Product
Handling Privileged Data / Work Product
• Large amount of risk when dealing with ESI – increased costs.
• Inadvertent Production – The FRCP 26(b)(5) “claw back” procedure.
• Incorporate agreements into a 16(b) scheduling order.
• FRE 502.
• Metadata can contain privileged material.
PRACTICE TIP – Provide notice of a claim of privilege in writing and as
promptly as possible.
The Discovery of ESI:
Deal with it Early!
Dealing with ESI Early
• Rule 16(b) – Scheduling Conference
• Allows the courts to set rules around disclosure, privilege and other eDiscovery
issues prior to discovery.
• The intent is to streamline the process, but in in essence it puts the burden on
counsel.
• Rule 26(f) – Pretrial Conference
• Think of this as a PROCESS
The Discovery of ESI:
The Meet & Confer Process
“Meet & Confer” - 26(f)
Q. When does the “Meet & Confer” take place?
A. ASAP! Or at least 21 days before FRCP 16(b) conference/order.
Q. What is discussed at the “Meet & Confer”?
A. The following should be discussed at the “Meet & Confer”:
•
•
•
•
•
•
ANY issues related to ESI – 26(f)(3);
Preservation issues;
Production formats – 26(f)(3);
“Claw back” procedures;
Best Practices in general;
Cost allocation
The Discovery of ESI:
The Meet & Confer Process
Duty to
Preserve
Zubulake
Complaint Served
26(f) Ticking
Day 1
Assess information ecosystem
Begin preservation efforts
Determine the scope of the matter
Devise a budget
Determine case plan/workflow
Meet and Confer
21 Days Prior to 16(b)
Scheduling
Conference
Within 120 Days
of Complaint
Day 120
Conduct all discovery tasks
Collection
Processing
Review & Analysis
Production
FRCP 16, 26(b)(2)(B), 26(b)(5)(B), 26(f), 33, 34, 37, 45 & Form 35
NY Uniform Rules 202.12(c)(3), 202.10(b), 202.70(g)
The Discovery of ESI:
The Meet & Confer Process
“Meet & Confer” - 26(f)
DON’T BE AFRAID OF THE
CHECKLIST
SEE YOUR MATERIALS: CDS Meet and Confer Checklist
The Discovery of ESI:
Best Practices & Cost Cutting Throughout the Process
Riskiest Area
Costliest Area
15% of Cost
Processing
25% of Cost
Preservation
Information
Managemen
t
Review
Identification
Production
Presentation
Collection
Analysis
Planning
Electronic Discovery Reference Model / © 2009 / edrm.net
60% of Cost
Execution
The Discovery of ESI:
Best Practices & Cost Cutting Throughout the Process
eDiscovery Costs Again:
10 Tips to Control Costs - $$$
1. Take control early.
2. Reduce the scope.
3. Try a phased approach
4. Set clear budgets and objectives.
5. Use standardized protocols
6. Review natively whenever possible.
7. Optimize your review using technology.
8. Use metrics.
9. Identify hidden costs.
10.MEET-and-CONFER
The Discovery of ESI:
Predictions
What to Expect in 2012
THANK YOU!!
FOR ANY FOLLOW-UP QUESTIONS PLEASE CONTACT:
Matthew F. Knouff / General Counsel / eDiscovery Attorney
Complete Discovery Source, Inc. / Electronic Discovery Solutions
(212) 813-7006 – Direct / (646) 660-4313 - Mobile
345 Park Avenue / New York, NY 10154
mknouff@cdslegal.com / mywork3@cdslegal.com