SPEAKING EDISCOVERY L ANGUAGE

BY ELVIDENCE

ELVIDENCEC O M P U T E R F O R E N S I C

I N V E S T I G A T I O N S

www.elvidence.com.au

Elvidence is based in Sydney, Australia. The company was created to help Australian businesses deal with the complexity of digital investigations.

ABOUT OUR COMPANY

We use our knowledge, experience

and modern technology to deliver

quality forensics services.

? COMPANY FOUNDER

We provide a full range of digital forensic services usually associated with the ?Big Four? consulting firms.

EDISCOVERY

Anton Piller, often misspelled as Anton Pillar, order takes its name from an English court case of Anton Piller KG v. Manufacturing Processes Limited in 1976.

The Anton Piller Order is a powerful and effective tool which forces a defendant to comply with an order. Those who obstructs its due execution are faced with a real risk of being charged of a contempt of court.

Definition of Electronic Discovery (eDiscovery): is the process of identifying, collecting and producing RELEVANT electronically stored information (ESI) in response to eDiscovery request or its Australian equivalent namely an Anton Piller order.

Anton Piller Order

eDiscovery professionals speak technical lingo that often sounds like foreign language.

Handling electronic discovery requires good understanding of basic computer and eDiscovery terms.

Lingo

EDISCOVERY T ERMS & EXPL ANAT IONS

Electronically Stored Information (ESI)

ESI is simply information or records stored in an electronic format.

Sources of ESI

Any device, which contains electronic storage media to store electronic information.

Examples: server, desktop laptop computers and mobile phones.

Structured Data

Data is organised within a formal structure using predefined fields, rows or

tables. Common examples are: HR or accounting database systems. T he primary feature of structured ESI - it can easily be searched, and the results retrieved, by use of the system itself.

Unstructured Data

All other ESI that are not contained within formal structure. Folders or directories are not sufficiently ?structured? for these purposes. Examples are: email, word processing documents or spreadsheets. Unstructured data is not easy to search or retrieve.

Classification

Many organisations will classify ESI as Confidential, Sensit ive, Personal, Open, etc. T he classification is used to determine which controls to implement for ensuring security. Example: medical records may be classified as sensit ive personal information and therefore addit ional precautions must be applied.

Sampling

T he process of testing a large volume of ESI for existence or frequency of relevant information.

Review Bundles

In large reviews, it is often necessary to break the ESI set into smaller bundles in order to allow more than one reviewer complete the review . Quality Control (QC) is essential to ensure that conf lict ing annotations are not applied to the same document.

Native format

Native format refers to the electronic format which the ESI was stored in the normal course of business. Example: Microsoft Word .DOC, Adobe PDF.

Data Redaction

A portion of an image or document is intentionally concealed to prevent disclosure of specific portions. I t is usually accomplished by applying an overlay and often performed to protect privileged or irrelevant portions of the document,.

Production format

Production format used to present located relevant documents to the requesting party. T his can be in native or in other formats which the ESI have been converted to.

Load files

An electronic file which is used to define a set of ESI in order that it be easily imported into a document review platform, or other such system.

I t typically contains a copy of the metadata of each file in the ESI set, amongst other information. Such load files typically allow the recipient of ESI to import it directly into their document review platform without any further processing. Formats: XML , CSV, Relativity L oad file, Concordance etc.

EDISCOVERY T ERMS & EXPL ANAT IONS

EDISCOVERY T ERMS & EXPL ANAT IONS

Metadata

Information about a piece of ESI , such as creation date & time, its author and last t ime the document was printed. T his is as opposed to the actual content of the ESI itself.

In simple terms metadata is Data about Data.

ESI retention & deletion policy

Many organisations, especially in regulated environments, are required to retain records for certain periods of t ime. T hese organisations must have a documented policy describing what records are required to be retained, for how long. & how ESI is to be destroyed when no longer needed.

Custodian

T he data custodian is the person or organisation, which has custody or administrative control of ESI .

Readily accessible or active ESI

ESI which is stored on a computer system and is easily accessible without any data restoration steps.

Legacy system

T ypically refers to old computer systems that are no longer in operation. I t is often necessary to invest addit ional resources in order to recover ESI

Deduplication

T he process of identifying and suppressing duplicate, or near duplicate ESI .

Chain of custody

Refers to recording of all custodians of a piece of ESI from the time it was first

obtained to the t ime where it is presented as evidence in formal proceedings. W hen a chain of custody is broken, evidence can

be rendered ?inadmissible? in court.

Non-searchable files

W hen processing ESI , it is expected that the system used to process each piece of ESI , will be able to read that ESI automatically and allow further filtering, by date range and keywords be applied to it.

Exceptions to this include image, sound or video files, in addit ion to scanned copies of hard copy documents.

Optical Character Recognit ion (OCR) is required to process scanned documents. Others can only have text metadata to be indexed and later searched.

EDISCOVERY T ERMS & EXPL ANAT IONS

Hold order or notice

A legal hold is a communication issued as a result of current or anticipated:

lit igation, government investigation, audit, or other such matters that suspends the normal disposit ion or processing of records.

Other names for the same: ?hold,? ?preservation order?, ?suspension order?, ?freeze notice?, ?hold order?, or ?hold notice?.

SYDNEY, AUST RAL IA

1300-170-017

www.elvidence.com.au

ELVIDENCEC O M P U T E R F O R E N S I C

I N V E S T I G A T I O N S