records management for paper and esi document retention policies addressing creation, management and...
TRANSCRIPT
•Records Management for Paper and ESI
•Document Retention Policies addressing creation, management and disposition
•Minimize the risk and exposure
Information Management
•Process of learning where everything relevant may be located and who has access to where and what.
Identification
•When does duty arise through litigation hold
•Clearly defined, monitored, published process
•Must allow business to continue to operate, but avoid the spoliation and potential sanctions related to destruction
Preservation
•Must be comprehensive, maintaining integrity of data content and preserving its format.
•Close attention to metadata and chain of custody.
Data Collection
•.Where does ESI exist?
Data Collection- Complexity
•.Where does ESI exist?
Cell phones Business computers
Digital cameras Networks
Laptops Email accounts
Desktops Voicemail
Data Collection- Complexity
•The FRCP have created a need for a responsible and defensible process.
• Must move quickly when a new matter arises to collect and preserve data.
• Must follow a thorough and defensible process.
• An understanding of the unique nature of data in question will assist in determining the appropriate tools and methods to collect the data.
Data Collection-
What is a Defensible Data Collection Process?. Definition- use of defensible, court-validated tools, defensible protocols and defensible people to perform the collection.
Protocols- iterative, flexible process that considers who, what ,where, when and how and adapts as necessary to the ediscovery process.
Tools- the right tools are used based on the type of data being collected.
People- trained, certified and trustworthy collection consultants. Third parties are utilized when it is perceived as necessary.
What is a Defensible Data Collection Process?Meets a Daubert Challenge
The collection process is well documented.The collection process methodology is generally accepted by our
peers.The collection methodology has been tested and results documented
in similar matters.Data cannot be altered as a result of the collection process.The people that performed the collection can testify about the
process.
•Meet and Confer agreements are required to address how ESI will be handled.
Among the key effects of the 2006 amendments is the requirement that the parties communicate openly with one another early in the case. Rule 16 establishes a process for discussions related to disclosure and discovery of ESI and Rule 26 obligates the parties to reach agreements related to issues
thru formal planning conferences.
Collection- Meet and Confer
•Early Case Assessment- a consultation between the organization, its outside counsel and external resources to determine the goals for the data collection process as well as any issues that might effect preservation or accessibility of the data.
•Data Mapping and Analysis- a survey or interview process of the key system areas containing relevant data. Goal is to creatae a description of the information systems, record management procedures and an inventory of existing data.
Data Collection Process
•Preservation- an effective data preservation plan protects all potentially relevant information from risk of destruction and spoliation. Goal is to take custody of data and protect the data in a format that does not alter it and allows it to be extracted for review and production.
•Collection- the important goal is to collect data in a forensically sound manner, ensuring it is not altered and to create a complete defensible chain of custody to protect the admissibility of the data.
Data Collection Process
•Traditional method- Acquiring of “all” potentially relevant data
and processing it for review. $$$
•Interim method- Improved processing tools to dedup and neardup data= a smaller review pool of data. $$
•Targeted methods- Collecting only relevant items, using keywords, Boolean and other filtering methods. $
Collection- Data Acquisition
• Data Mapping – where is relevant data stored?
•Active records
•Offline data
•Third-party hosted storage
•Archived
•Backups
Collection- Targeted Methods
• Searching Techniques
•Custodian
•Date and Time
•Keyword
•Conceptual
•Privilege
Collection- Targeted Methods
• Reduced EDD Processing costs.
• Reduced hosting cost, typically charged by the GB.
• Reduced attorney review hours.
• Less (or no) down-time during data acquisition.
Collection- Targeted Methods- $$ Savings
•Scalability- the ability to expand or contract a search without significant financial or business impact.
Collection- Other Considerations
• Under-inclusive- focus is on exactness e.g “car” vs. “Mercedes”, Specialized vocabulary or acronyms are excluded. Spell-checking, texting shortcuts.
•Over-inclusive- many irrelevant documents may be collected e.g. “car” might bring up car seats, car pools, etc. Caselaw: In Re: Fannie Mae. 400 keywords.
TREC project and Verizon tests are demonstrating clear weaknesses in existing search methodologies.
Collection- Pitfalls- Keyword Searching weakness
•Familiar concept in criminal law, but historically rarely an issue in civil litigation.
• As a result of the ability to change ESI, the requirement to maintain a defensible chain of custody now applies to every stage of the eDiscovery process. This involves:
•Documenting the acquisition process.
•Documenting the chain of custody thru the entire process.
Collection- Chain of Custody and Authentication
•An electronic fingerprint.
•Can be applied to a file, a section of a hard drive, or an entire drive.
•If any item, even a single character is changed, the hash value will change.
Chain of Custody – Hash Values
•If opposing party objects to any ESI in a matter, it may be necessary to present a complete foundation for it.
•If the ESI was collected by someone lacking qualifications or someone who is party to the litigation and potentially biased, it may not satisfy the court and the evidence may be excluded.
Chain of Custody – Admissibility
•Regardless of whether a forensic or non-forensic collection is made you need to properly maintain the chain of custody, including:
•A description of devices from which data was copied.
•A list of folders that were copied.
•Your process for making the copies.
•Documentation of any hand-offs e.g. back to a law firm or to a processing company.
Chain of Custody – Log
• Computer Forensics- computer investigation and analysis techniques that involve the identification, preservation, extraction, documentation, and interpretation of computer data to determine potential legal evidence.
• eDiscovery- The process whereby electronic documents are collected, prepared , reviewed and distributed in association with legal and government proceedings.
Computer Forensics vs eDiscovery- definitions
•Forensic acquisitions- an exact image that includes everything on the hard drive such as slack space and deleted files not yet overwritten. Forensics tools utilized do not alter any data during the copying process (a bit by bit mirror image is created).
• Non-forensic acquisitions- Civil litigation requires preservation of data relevant to a litigation. A chain of custody will assist in the admission of evidence and s.b. maintained, but a bit image is not always necessary.
Collection –Forensic vs. Non-Forensic
•Forensic investigations – typically recover and analyze areas of a suspect media that is unavailable thru eDiscovery software.
•Some case categories Typical Tasks
•Employment disputes . Recovering deleted files and emails
•Contract disputes . Internet activity analysis
•Embezzlement . Cell phone analysis
•IP theft . Metadata analysis
•Insurance Fraud
Collection –When is a Forensic Investigation Needed?
•Forensic image- preserves everything, including metadata, whereas copying the drive or simply opening a file to copy it, can alter important metadata and change the evidence. If that data is important to a claim (date of memo, who last accessed it, where it was stored, etc) critical evidence may be lost.
•Additionally a forensic image captures deleted files, file fragments, and other data, including attempts to destroy evidence.
Collection –Forensic Images
Forensics