Your SlideShare is downloading. ×
0
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
EDRM - OLP
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

EDRM - OLP

1,383

Published on

0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
1,383
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
30
Comments
0
Likes
1
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. EDRM –Collection, Processing, Analysis Presented by: David Kearney www.linkedin.com/in/davidjkearney The Organization of Legal Professionals www.theolp.org February 2013
  • 2. The Phases of EDRMFour sessions – 90 minutes each sessionI. Overview/CollectionII. Collection/ProcessingIII. ProcessingIV. Analysis OLP - eDiscovery Certificate Program
  • 3. EDRM - Overview• http://www.edrm.net/• Stands for The Electronic Discovery Reference Model• First launched in 2005 and released publically in 2006• Developed to provide a standardized approach to e- Discovery related activities• Helps visually depict the movement of electronic discovery components from one phase to the next.• Contains 9 phases/stages; Information Management  Review Identification  Analysis Preservation  Production Collection  Presentation Processing OLP - eDiscovery Certificate Program
  • 4. EDRM - Overview• Stages standardize workflow• Stages are not fixed sequentially• Not meant as a literal, linear or waterfall model• The EDRM is meant to be iterative in nature OLP - eDiscovery Certificate Program
  • 5. EDRM - Overview Stages• Information Management – Getting your electronic house in order to mitigate risk & expenses should e-discovery become an issue, from initial creation of electronically stored information through its final disposition.• Identification – Locating potential sources of ESI & determining its scope, breadth & depth.• Preservation – Ensuring that ESI is protected against inappropriate alteration or destruction.• Collection – Gathering ESI for further use in the e-discovery process (processing, review, etc.).• Processing – Reducing the volume of ESI and converting it, if necessary, to forms more suitable for review & analysis.• Review – Evaluating ESI for relevance & privilege.• Analysis – Evaluating ESI for content & context, including key patterns, topics, people & discussion.• Production – Delivering ESI to others in appropriate forms & using appropriate delivery mechanisms.• Presentation – Displaying ESI before audiences (at depositions, hearings, trials, etc.), especially in native & near-native forms, to elicit further information, validate existing facts or positions, or persuade an audience. OLP - eDiscovery Certificate Program
  • 6. EDRM - Overview• Information Management – Many issues can be better managed if this stage is taken seriously and implemented with consistent & sound practices. – This is THE STARTING POINT for the entire process. Sound and comprehensive information management strategies aid organizations in the identification, preservation, and collection steps of the process and can lower the number of documents that need to be preserved, collected, reviewed and produced. This is where more organizations can GET IT RIGHT. Furthermore, risks and costs are reduced. OLP - eDiscovery Certificate Program
  • 7. EDRM - Overview• Identification – Locating potential sources of ESI & determining its scope, breadth & depth. OLP - eDiscovery Certificate Program
  • 8. EDRM - Overview• Preservation – Ensuring that ESI is protected against inappropriate alteration or destruction. OLP - eDiscovery Certificate Program
  • 9. EDRM - Overview OLP - eDiscovery Certificate Program
  • 10. EDRM - OverviewCommon TermsECA/EDA – 2 definitions  Legal – End-to-End  E-Discovery/Data - Analyze unstructured electronically stored informationProportionality  Ways to Limit Burdens  Court may look for ways to use proportionalityFRCP – Federal Rules of Civil Procedure  Governs all aspects of procedure for civil matters in United States District Courts  Rules 26 to 37 - Discovery1/21/2013 OLP - eDiscovery Certification Course
  • 11. EDRM - Overview OLP - eDiscovery Certificate Program
  • 12. COLLECTION OLP - eDiscovery Certificate Program
  • 13. EDRM - CollectionGathering ESI for further use in the e-discovery process (processing,review, etc.).  Once documents/files have been preserved (sometime one and the same), collection can begin  Transfer/acquisition of data for review  Includes; Servers, PCs, Macs, Linux, Windows, iOS, Android, handheld devices, flash/thumb drives tablets, MP3 players, phone systems, backup tapes, CD/DVD, databases (financial, CRM, ERP), structured/unstructured data, Cloud/Social Networking Sites  Proper planning and careful implementation can reduce time & money spent  Ensures integrity of evidence  Proper collection can guard against future disputes (discovery about discovery – causes unneeded rancor between parties)  Process must be defensible, proportionate, efficient, auditable, and targeted.  May impact and expand the scope of the discovery process  Collection costs can be significant OLP - eDiscovery Certificate Program
  • 14. EDRM - CollectionYou Oughta Know…In an Exchange/Outlook E-Mail environment, if auser deletes E-Mail from the deleted items folder(sometimes called double-deleting) the E-Mail isthen stored in the Dumpster on the Exchange Server.The administrator can set the Dumpster to retaindeleted E-Mail for a specified period or indefinitely.This should be a discussion point when looking tocollect data from an Exchange Server. OLP - eDiscovery Certificate Program
  • 15. EDRM - CollectionThe collection methodology for acquiring ESI in a legally defensible manner OLP - eDiscovery Certificate Program
  • 16. EDRM - CollectionA reasonable collection strategy must addresswhat ESI should be collected, when, and how What: The total corpus of potentially collectible ESI will usually have been defined during the process of formulating the internal preservation directive/litigation hold. Usually consists of four main categories of data locations: 1. Individual employee files 2. Department/group files 3. Enterprise databases 4. Backup Media OLP - eDiscovery Certificate Program
  • 17. EDRM - Collection When: Not all data identified for preservation needs to be collected right away. Some data may never need to be collected. Collecting all data that has been preserved may unnecessarily inflate costs and overwhelm the case team with irrelevant data How: Once the timing of collection from a data location has been decided, the team must assess what level of forensic defensibility should be employed for the collection OLP - eDiscovery Certificate Program
  • 18. EDRM - CollectionNormal collection processes generally involve straightforward copying, that maintains the integrity of themetadata, of the ESI as it exists on the systemA forensic protocol must ensure that the process iscarried out in a way that will produce reliableinformation consistently, so the individual conductingthe collection can testifyThe protocol must also provide for a means of verifyingthe integrity of the work that has been done bymaintaining an untouched mirror copy of the inspectedmaterials OLP - eDiscovery Certificate Program
  • 19. EDRM - CollectionMaintaining Integrity of Metadata…The single most important thing that can be done is to use a software or hardware write blocker. OLP - eDiscovery Certificate Program
  • 20. EDRM - CollectionMetadataSystem Metadata - Data about the architecture of the systemFile Metadata - Data about the data in a specific file that is recorded internal to that file OLP - eDiscovery Certificate Program
  • 21. EDRM - CollectionYou Oughta Know…Acquisition is actually the proper term forcollecting electronic data. In digitalforensics, examiners refer to the copying ofdata as acquiring to avoid any confusionthat might be caused by using “copying”,since copying doesn’t imply that the copywas made in a forensically sound manner. OLP - eDiscovery Certificate Program
  • 22. EDRM - CollectionTools Used During Collection:Write BlockerLEOSuitesTask SpecificSoftwareHardware OLP - eDiscovery Certificate Program
  • 23. EDRM - Collection• Forensically Defensible Collection – a forensically sound collection will preserve all potentially relevant metadata that may be of use to the trial team in its claims. This collection type utilizes a “write-blocker” to prevent alteration of source media when a device is attached to retrieve the data.• Maintains rigorous chain-of-custody controls that document all collection steps, from initial access to the point of storage or processing.• Ensures that nothing about the data is altered or degraded• A collection by a third-party vendor will often be the best method.• Typical of a targeted collection OLP - eDiscovery Certificate Program
  • 24. EDRM - Collection• Forensic Collection – a forensic copy of a hard drive will include every byte of data on that drive, including data in unallocated space and slack space. Forensic inspection of a party’s computer system is rarely necessary.• Because forensic collections are much more invasive and inclusive, there is a greater risk of disclosure of information that is either irrelevant to the matter or protected by privilege claims. The forensic protocol must therefore take steps to mitigate risks and protect the producing party. OLP - eDiscovery Certificate Program
  • 25. EDRM - Collection• Unallocated Space – The area of computer media, such as a hard drive, that does not contain normally accessible data. Unallocated space usually occurs as the result of a file being deleted. Until portions of the unallocated space are used for new data storage, in most instances, the old data remains and can be retrieved using forensic techniques.• Slack Space – The space that remains on a hard drive when a file is saved that does not take up one or more complete clusters of space on the drive. Slack Space is part of the Unallocated space on a hard drive OLP - eDiscovery Certificate Program
  • 26. EDRM - CollectionYou Oughta Know…Re-booting, Defragging, or running other disk managementutilities may clear some data from the unallocated space on astorage device.Some MAC systems, the later ones, are installed with a securedelete function that deletes a file and then goes in behind theactual deletion and overwrites with zeros the space that wasoccupied by the file.Also, there are third party applications, know as File Wipingapplications that can obliterate a file, within reason. Onecannot delete or overwrite a file that is being used by anotherpart of the system. OLP - eDiscovery Certificate Program
  • 27. EDRM - Collection The decision regarding the degree of forensic defensibility will be required for ESI collection. This decision must be made on an individual basis depending on the cost, accessibility, and needs of the case. The software & process used must, at least, be capable of write protecting the files during the collection process and maintaining the integrity of both the system and file metadata associated with each file/document One constant is the need to have detailed and complete documentation of the critical decisions and actions made during the collection process OLP - eDiscovery Certificate Program
  • 28. EDRM - CollectionWhether or not a file server should be forensically collected depends on the nature of the investigation. More often than not, collecting the active data and relevant network shares is appropriateIf extracting an event, log, intrusion, or other time critical event, forensic imaging of the entire server may be necessary OLP - eDiscovery Certificate Program
  • 29. EDRM - Collection• Collection can be accomplished by: – The Client – Corporate/IT Personnel – Custodians – Potential dangers when custodians/clients try to collect their own data – especially when seeking consistency and unbiased process, e.g. 10, 25, 50 custodians and a delete key. – Outside Law Firm – Vendor OLP - eDiscovery Certificate Program
  • 30. EDRM - Collection• Forensic inspection protocols – There are no “standard” protocols for forensic inspection, but at least must mitigate the risk of disclosure of irrelevant or protected information – Parties and courts generally consider the same issues when crafting protocols: • Qualifications and objectivity of the inspector • Methods that the inspector(s) will use • Detailed set of instructions for exactly what is subject to inspection and copying • A means of verifying the integrity of the work OLP - eDiscovery Certificate Program
  • 31. EDRM - Collection The court may limit discovery and shift costs when ESI is not reasonably accessible because of undue burden or cost Rule 26(b)(2)(B) of the FRCP states: A party need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost The Federal Rules also provide an outline of how objections are to be me made and resolved OLP - eDiscovery Certificate Program
  • 32. EDRM - Collection• Not Reasonably Accessible – Balancing Test: • Cost of converting data into more accessible format • Cost to review the data for responsiveness, privilege, or other concerns • Business disruption and other internal costs – Other issues to address: • Relevance of data residing on the source • Overall litigation value of the data at issue • Other means to get information OLP - eDiscovery Certificate Program
  • 33. EDRM - CollectionOn motion to compel discovery or for a protective order, theparty from which discovery is sought must show thatinformation is not reasonably accessible because of undueburden or cost. If that showing is made, the court maynonetheless order discovery from such sources if therequesting party shows good cause. However, the court mayput conditions on the discovery from the source, such ascost-shifting.Legacy data is frequently the subject of claims that it is “notreasonable accessible”. Backup tapes are being consideredmore-and-more as reasonably accessible, but havehistorically been classified a not reasonably accessible. OLP - eDiscovery Certificate Program
  • 34. EDRM - Collection• Sources of ESI – Shared network resources are resources, files, or other data shared throughout the network being examined, such as • E-Mail servers • Document Servers • Files Servers • Other resources shared across the network OLP - eDiscovery Certificate Program
  • 35. EDRM - Collection• Other sources – Cloud/web-based storage and E-Mail (e.g. Gmail, Yahoo, Box, Dropbox, Facebook… • Absent a subpoena or court order, it is nearly impossible to collect the data held by an ISP • Flash, temporary, and ephemeral data storage (e.g., thumb/external drives leave data droppings) • Social Networking applications • Databases (reports v. exporting the data) OLP - eDiscovery Certificate Program
  • 36. EDRM - Collection• Structured v. Unstructured data • Differences & Specifics – Structured Data - Information with a high degree of organization » Relies on users » Legal Hold at application level – Unstructured Data » No identifiable structure » Potential large number of users » May be largely duplicative • How it is applied to e-Discovery – Structured Data – e-Discovery expenses are IT & User costs for identification, Collection, and Legal Hold – Unstructured Data – Costs are for Processing, Analysis & Review OLP - eDiscovery Certificate Program
  • 37. EDRM - Collection• Cost Factors – Travel to different locations to have personnel on-site to perform collection – Whether the collection is performed by use of an automated script that can run remotely or without manual operation – Custodian interviews at the time of the collection may raise initial costs, but are more efficient in the long run since such interview will likely to be ultimately needed – Forensic collection require the use of different, more complicated techniques, and the collected data will need extra handling during processing and review OLP - eDiscovery Certificate Program
  • 38. EDRM - Collection• Cost Factors – Impacted by the number of megabytes, gigabytes, terabytes, Petabytes, Exabytes, etc. needed to be collected – The human review, which can be the most time consuming and expensive part of the entire e-discovery process…even if using Technology Assisted Review…volume of review becomes larger with the amount of data collected, just by basic nature of more… – Controlling, Monitoring, and being able to justify a sound stepped approach to limit the data being collected (custodians, data range, etc.) OLP - eDiscovery Certificate Program
  • 39. EDRM - CollectionQuality Control Validating that all ESI has been collected. In general, over-inclusive collections, coupled with repeatable, documented, and defensible methods to cull and search ESI will be most effective at validating the collection of ESI. Court are increasingly sensitive to the costs of electronic discovery and the concept of proportionality, which should be taken into account when assessing the scope of the collection In some cases, the use of software tools will aid in validating the collection of ESI. Failure to use commonly accepted methods and technologies may expose the client to additional risk In addition, each piece of digital data can generate a unique value, known as a HASH VALUE. Commonly used hash formats are “MD5” and “SHA-1”. If a dispute arises about the integrity of a piece of information, the hash value of the original data can be compared with the originals has value. OLP - eDiscovery Certificate Program
  • 40. EDRM - CollectionA word about foreign data discovery… What is routine and mandated practices in the U.S. may amount to criminal conduct abroad. Counsel must consult local authorities before engaging in discovery related activities. Absent a connection with a party to the U.S.-based litigation, obtaining ESI in a foreign country requires resort to the Hague Convention, the Data Protection Directive, or local laws of the particular jurisdiction Foreign countries are extremely sensitive to privacy OLP - eDiscovery Certificate Program
  • 41. EDRM - Collection…Outside of the U.S.Special attention should go to the collection of datafrom sources outside of the United States. Manycountries, including the European Union have laws,regulations, and policies that restrict a company’sability to collect and transmit data outside of thejurisdiction for use in legal proceedings in the U.S.Careful evaluation should be given to collection ofdata outside of the U.S. and extra time needs to beallocated for such collections OLP - eDiscovery Certificate Program
  • 42. EDRM - Collection• Other commonly used tools and devices for collection – Faraday Bags – Inventory & Tracking System – Check-in & Check-out Procedures – Cameras and Video Recording OLP - eDiscovery Certificate Program
  • 43. EDRM - CollectionResource:Digital Forensics for Legal Professionals - UnderstandingDigital Evidence From the Warrant to the CourtroomLarry E. DanielLars E. Daniel OLP - eDiscovery Certificate Program
  • 44. EDRM - CollectionTips  When wrongdoing is suspected, don’t “take a quick peak” at a computer without forensic collection  Don’t delay to preserve a device  Don’t assume that all devices are the same a PCs  Always document the process  Don’t assume that the device is not encrypted  Do not save time/money but using traditional file copy methods  Don’t process everything at one time  Test and sample search terms and expressions  Examine foreign language types OLP - eDiscovery Certificate Program
  • 45. PROCESSING OLP - eDiscovery Certificate Program
  • 46. EDRM - ProcessingProcessing Reducing the volume of ESI and converting it, if necessary, to forms more suitable for review & analysis. OLP - eDiscovery Certificate Program
  • 47. Native Format• Documents in native format: – Have not been converted in any way from its original form – Will appear and behave exactly as they did at the point of creation – If produced in native form, no costs incurred to convert into another format – Contains full metadata, which often includes privileged or sensitive information (subject, author, date, tracking changes, etc.) OLP - eDiscovery Certificate Program
  • 48. Imaged Format• Documents in imaged format: – Equivalent to printing a document and creating a static page image – Can be time-consuming, expensive to process – Can lead to loss of information useful to requesting party, i.e. the loss of metadata OLP - eDiscovery Certificate Program
  • 49. Metadata• Metadata, which is a part of all types of ESI, exists in fields that can be used to populate a load file database created by the requesting party.• Examples of metadata fields are: – Names (author, sender, recipient, blind recipients) – Dates (create date, sent, received, modified) – Subject (primarily for e-mail) – Document type – “Text” (searchable field containing the text or body of the document itself) – OLP - eDiscovery Certificate Program
  • 50. EDRM - ProcessingYou Oughta Know…“Text” field needs to be removed when redactingOCR needed re-done after redactions applied – Maybe a You Oughta Know slide OLP - eDiscovery Certificate Program
  • 51. EDRM - Processing OLP - eDiscovery Certificate Program
  • 52. EDRM - ProcessingAssessment• Assessment is a critical first step in the workflow as it allows the processing team to ensure that the processing phase is aligned with the overall e-discovery strategy, identify any processing optimizations that may result in substantive cost savings and minimize the risks associated with processing. A critical aspect of this step is to ensure that the processing methodology will yield the expected results in terms of the effort, time and costs, as well as expected output data streams. OLP - eDiscovery Certificate Program
  • 53. EDRM - ProcessingPreparation• During assessment a determination is made as to which classes of data need to be moved forward through processing. At that point there may be a number of activities required to enable handling and reduction of that data. OLP - eDiscovery Certificate Program
  • 54. EDRM - ProcessingSelection• One of the primary reasons for “processing” data in an e-discovery project is so that a reasonable selection can be made of data that should be moved forward into an attorney review stage OLP - eDiscovery Certificate Program
  • 55. EDRM - ProcessingOutput• The data that has been selected to move forward to review is transformed into any number of formats depending on requirements of the downstream review platforms, or in certain circumstances simply passed on to a review platform in its existing format; or it may be exported in a native format. OLP - eDiscovery Certificate Program
  • 56. EDRM - ProcessingOverall Analysis / Validation• Throughout the four phases of processing there are opportunities to analyze the data or results of certain sub-processes to ensure that overall results are what was intended, or that decisions as to the handling of the data are valid and appropriate. OLP - eDiscovery Certificate Program
  • 57. EDRM - ProcessingOverall Quality Control• Validation is the testing of results to ensure that appropriate high level processing and selection decisions have been made, and ensuring that ultimate results match the intent of the discovery team. Quality Control (“QC”) involves testing to see that specific technical processes were performed as expected, regardless of what the results show. OLP - eDiscovery Certificate Program
  • 58. EDRM - ProcessingOverall Reporting• To meet the needs of project management; status reporting; exception reporting; chain of custody and defensibility it is important that processing systems track the work performed on all items submitted to processing. OLP - eDiscovery Certificate Program
  • 59. EDRM - Processing• Collected ESI must first be entered into an appropriate software program or tool with processing ability• Regardless of who processes the data, it is imperative that the resulting data sets are reviewed and that the process is validated• The processing software must provide logs of what was accomplished and what failed during processing. OLP - eDiscovery Certificate Program
  • 60. EDRM ProcessingTools Used for Processing  PC/Server-Based  Cloud-Based  Vendor-Based OLP - eDiscovery Certificate Program
  • 61. EDRM - Processing• Methods for limiting volume include: – Culling to exclude particular document types – De-duplication – Elimination of system files – Application of search terms and date limitations OLP - eDiscovery Certificate Program
  • 62. EDRM – Processing• Culling – Processing methods must account for and remove irrelevant data – Before data is indexed for processing, it can be culled by the following criteria: • Remove all files of file types deemed to have not evidentiary value • Remove documents with certain file paths • Eliminate files that fall below a size threshold OLP - eDiscovery Certificate Program
  • 63. EDRM - Processing• Common Search Techniques: – Used to locate relevant and eliminate irrelevant – Keyword • List of words likely to be contained in relevant documents – Boolean • cat AND dog • cat NOT lion – Proximity searches • cat /10 scratch • cat /p scratch OLP - eDiscovery Certificate Program
  • 64. EDRM - Processing• Search terms (cont.): – What is being searched? • Text of document? • Metadata? • Attachments? • Images? – Formulating terms • Witness interviews • Names of key persons • Product/project/code names and numbers • Consider input from opposing party OLP - eDiscovery Certificate Program
  • 65. EDRM - Processing• De-duplication: – The process of removing exact copies of the same message or file from a data set, thus reducing the number of files that need to be reviewed. – Within-custodian – Across-custodian – “Near duplicates” – slight changes to a document; different hash values OLP - eDiscovery Certificate Program
  • 66. EDRM - ProcessingCulling Methods• Deduplication• DeNISTing• Paths• Size• No evidentiary value OLP - eDiscovery Certificate Program
  • 67. EDRM - Processing• Deduplication• DeNISTing OLP - eDiscovery Certificate Program
  • 68. EDRM - Processing• Budget based on assumptions from actual data – Client should have a good idea of custodian data – Know the data being worked with, e.g. E-mail will have a much different volume vs. databases/spreadsheets – Having more time permits greater cost control, & consistency – Open communications and discussions with opposition to agree on scope and methods – Collecting all data that has been preserved may inflate costs unnecessarily OLP - eDiscovery Certificate Program
  • 69. EDRM - ProcessingYou Oughta Know…Foreign Language DocumentsUnless your software application understands Unicode, it will not handle foreign language documents easily.In order to successfully search and review foreign language documents, you need to make sure the software used to collect and process them is Unicode compliant. OLP - eDiscovery Certificate Program
  • 70. ANALYSISOLP - eDiscovery Certificate Program
  • 71. EDRM - AnalysisAnalysis Evaluating ESI for content & context, including key patterns, topics, people & discussion. OLP - eDiscovery Certificate Program
  • 72. EDRM - Analysis OLP - eDiscovery Certificate Program
  • 73. EDRM - Analysis• Fact Finding OLP - eDiscovery Certificate Program
  • 74. EDRM - Analysis• Search Enhancement OLP - eDiscovery Certificate Program
  • 75. EDRM - Analysis• Review Enhancement OLP - eDiscovery Certificate Program
  • 76. EDRM - Analysis• Process Analysis OLP - eDiscovery Certificate Program
  • 77. EDRM - Analysis• Validation/Quality Assurance OLP - eDiscovery Certificate Program
  • 78. Analysis• Evaluating ESI for relevance & privilege. – Privilege issues – Review methods – Budgeting and costs• Evaluating ESI for content & context, including key patterns, topics, people & discussion. OLP - eDiscovery Certificate Program
  • 79. Review & Analysis: Privilege Issues• Rule 26: “Parties may obtain discovery regarding any non-privileged matter that is relevant to any party’s claim or defense…”• We review to: – Distinguish relevant from irrelevant – Protect privileged material • Attorney-client communications • Attorney work product OLP - eDiscovery Certificate Program
  • 80. Review & Analysis: Privilege Issues• Waiver of privilege• Clawback agreements – Agreement that inadvertent production of privilege material will not constitute a waiver• Quick peek agreements – No effort to weed out privileged material up front• Evidence Rule 502 – Generally establishes that inadvertent production will not result in waiver – Encourages use of protective orders including clawback agreements OLP - eDiscovery Certificate Program
  • 81. Review & Analysis: Privilege IssuesAlers v. City of Philadelphia, No. 08-4745, 2011 WL 6000602 (E.D. Pa. Nov. 29, 2011)• Where defendants inadvertently produced a privileged memorandum as part of a multi-page document amid more than 2000 pages of document production and where they requested return of the document four days after learning of its disclosure at a deposition (where there was no objection made), the court found that privilege was not waived (despite defendants’ choice to attach the memorandum to a publically available motion) OLP - eDiscovery Certificate Program
  • 82. Review & Analysis: Review Methods• Coding – Responsive or non-responsive – Privileged – Confidentiality – “Key” documents• Basic linear review• Concept searching• Clustering (uses linguistic, latent semantic technologies) – E.g., when searching the term “diamond,” clustering will allow you to distinguish between “baseball” diamond and diamond “ring.”• Predictive coding OLP - eDiscovery Certificate Program
  • 83. Technology Assisted Review• …or Predictive Coding • …or Computer Assisted Review • …or Intelligent Review • …or ???? Review OLP - eDiscovery Certificate Program
  • 84. EDRM - CARRM• EDRM’s Computer Assisted Review Reference Model1/21/2013 OLP - eDiscovery Certification Course
  • 85. Review & Analysis: Review Methods• Predictive coding• Da Silva Moore v. Publicis Groupe & MSL Group, No. 11 Civ. 1279, 2012 WL 607412 (ALC) (AJP) (S.D.N.Y. Feb. 24, 2012) – Magistrate Judge Andrew Peck approved use of computer-assisted review (predictive coding) to locate responsive documents – “*C+omputer-assisted review is an acceptable way to search for relevant ESI in appropriate cases.” – “As with keywords or any other technological solution to e- discovery, counsel must design an appropriate process, including use of available technology, with appropriate quality control testing, to review and produce relevant ESI while adhering to Rule 1 and Rule 26(b)(2)(C) proportionality. ” OLP - eDiscovery Certificate Program
  • 86. Review & Analysis: Budgeting and Costs• Discovery costs may well be the largest budget item, other than trial• Since few cases ever get to trial, discovery is often the single most expensive part of any litigation matter OLP - eDiscovery Certificate Program
  • 87. Review & Analysis: Budgeting and Costs• Understand the cost drivers – Number of custodians – Volume of ESI each custodian will handle – Review of ESI• Create a budget of the estimated costs as early as possible• All assumptions should be stated explicitly in the budget so that variances can be noted and the client can adjust expectations accordingly OLP - eDiscovery Certificate Program
  • 88. Review & Analysis: Budgeting and Costs• The complexity of the case will have a direct impact on the cost of e-discovery – Complexity of the coding schema (number of tags the reviewers will be applying) – Sophistication of the privilege issues presented by the facts of the case – Number of passes of review that are anticipated• The most efficient way to organize a review is with numerous decisions during a single pass review rather than through separate review phases of the same material OLP - eDiscovery Certificate Program
  • 89. Review & Analysis: Budgeting and CostsRace Tires Amer., Inc. v. Hoosier Racing Tire, Corp., 674 F.3d 158 (3d Cir. 2012)• On appeal, the Third Circuit vacated the District Court’s approval of taxable costs related to electronic discovery and remanded with instruction to re-tax in accordance with this opinion. Specifically, the court concluded that the relevant vendors’ charges “would not qualify as fees for ‘exemplification’” and that “of the numerous services the vendors performed, only the scanning of hard copy documents, the conversion of native files to TIFF, and the transfer of VHS tapes to DVD involved ‘copying’” and were thus recoverable. OLP - eDiscovery Certificate Program
  • 90. Production• Delivering ESI to others in appropriate forms & using appropriate delivery mechanisms. OLP - eDiscovery Certificate Program
  • 91. Production• Parties should agree on a form of production at the outset of discovery, ideally at the earliest stage of discovery.• Under Rule 34, the requesting party may specify a format to which the producing party may object and offer an alternative format.• Rule 34 of the FRCP states that the format must be either the form in which it is ordinarily maintained in the usual course of business or a reasonably usable form. OLP - eDiscovery Certificate Program
  • 92. Production• Native format – The form in which the document is maintained in the system where it was created• Reasonably useable formats – Any imaged format of the ESI such as TIFF or PDF – Should include metadata OLP - eDiscovery Certificate Program
  • 93. Production: Native Format• Documents in native format: – Have not been converted in any way from its original form – Will appear and behave exactly as they did at the point of creation – If produced in native form, incur no cost to convert into another format – Contain full metadata, which often includes privileged or sensitive information (subject, author, date, tracking changes, etc.) OLP - eDiscovery Certificate Program
  • 94. Production: Imaged Format• Documents in imaged format: – Equivalent to printing a document and creating a static page image – Can be time-consuming, expensive to process – Can lead to loss of information useful to requesting party, i.e. the loss of metadata OLP - eDiscovery Certificate Program
  • 95. Production: Metadata• Metadata, which is a part of all types of ESI, exists in fields that can be used to populate a load file database created by the requesting party.• Examples of metadata fields are: – Names (author, sender, recipient, blind recipients) – Dates (create date, sent, received, modified) – Subject (primarily for e-mail) – Document type – “Text” (searchable field containing the text or body of the document itself) –• TIP: “Text” field needs to be removed when redacting OLP - eDiscovery Certificate Program
  • 96. Documenting Production• ESI productions should include correspondence, production shipments, confirmation and shipping receipts, and a tracking log showing: – What material was produced – On which type of storage media (CD, DVD, hard drive) – How it was transmitted OLP - eDiscovery Certificate Program
  • 97. Documenting Production• The production media should be subject to quality-control checks to: – Assure completeness – Show lack of corruption – Conform with production format (as agreed upon in the parties’ 26(f) discovery plan)• Documentation of these processes should be kept to show timely and accurate compliance with production requests. OLP - eDiscovery Certificate Program
  • 98. Overall Tips• Consult FRCP and local rules of pertinent jurisdiction• Stay organized and keep complete records, specifically about critical decisions and actions during the processes• Track what was done, by whom, when & how it was done• Maintain specific routine practices across cases/projects to increase efficiency and ensure critical steps are not missed IT IS NOT IF PROCESSES/ACTIONS WILL BE SCRUTINIZED… …BUT WHEN BE PREPARED! OLP - eDiscovery Certificate Program
  • 99. Additional Resources• E-Discovery and Electronic Records - Healthcare Resource Guide to e-Discovery and Electronic Records - Focuses on the process of electronic discovery (e-discovery) and electronic records management for healthcare document retention and production. – Authors: Kimberly A. Baldwin-Stried Reich Katherine Ball, Michelle Dougherty, Ronald J. Hedges1/21/2013 OLP - eDiscovery Certification Course
  • 100. THANK YOU David J. Kearney www.linkedin.com/in/davidjkearney

×