10 Critical Decisions for Successful E-discovery Part 2

Title:10 Critical Decisions for Successful E-discoveryPart 2Word Count:1138Summary:The Federal Rules of Civil Procedureีsrecent emphasis on producing electronicallystored information requires that the e-discoveryteam understands the collection and processingchoices to be made and their ramifications.

Keywords:computer forensics, electronic discovery,litigation support, document imaging, documentscanning, form processingArticle Body:The Information Management Journal/September /October 2007- Todayีs explosion ofelectronic data, coupled with the December 2006amendments to the Federal Rules of CivilProcedure (FRCP) concerning electronicallystored information (ESI), requires informationand legal professionals to expand their knowledgeabout handling electronic discovery. The recentchanges to the FRCP include:* Definitions and safe harbor provisions for theroutine alterations of electronic files during

routine operations such as back ups [Amended Rule37(f)]* Information about how to deal with data that isnot reasonably accessible [Amended Rule26(b)(2)(B)]* How to deal with inadvertently producedprivileged material [Amended Rule 26(b)(5)]* ESI preservation responsibilities and thepre-trial conference. [Amended Rule 26(f)]* Electronic file production requests [AmendedRules 33(d), 34, 26(f)(3), 34(b)(iii)]There are many opinions about how ESI should beplanned for, managed, organized, stored, andretrieved. Some of the available options areextremely costly in terms of their requiredfinancial and time commitments. Constantlychanging technologies only add to the confusion.

One area of confusion is the distinction betweencomputer forensics and electronic discovery;there is a significant difference. These aredescribed in the sidebar Computer Forensics vs.Electronic Discovery.Making the Right ChoicesSuccessfully responding to e-discovery withinthe constraints of the amended FRCP requiresorganizations to make many critical decisionsthat will affect the collection and processing ofESI.Processing ChoicesBecause of the volume of information available ineven the smallest of collections, it becomesnecessary to manage the process to control timeand budget. The following questions need to be

answered:1. Who are the key people?The people important to a case should beidentified. These key individuals include notonly executives, but also assistants and othersupport personnel from the technology,accounting, sales and marketing, operations, andhuman resources departments.2. Where are the files located?All the potential locations of electronicevidence should be identified. These include homecomputers and all computers that a key personwould use elsewhere (such as a girlfriend orboyfriendีs home), cell phones, PDAs,Blackberries, and any other digital device thatmight be used. It is important to note that MP3players, such as iPods, can also be used to storedocuments or important files.

3. How can the collection be culled?Methods for limiting the number of filescollected may include collecting only those incertain date ranges or only those containingselected key words or terms. This can be doneeither before or after an entire hard drive iscollected forensically. Known file filtering canalso reduce the collection by removing standardapplication files common to all computers (suchas the Microsoft Windowsจ logo file).4. How should password-protected/encrypted filesbe handled?Encrypted files cannot be processed until theencryption is broken. In some instances, fileswith exact or similar names may be availablewithout using passwords or encryption. Filelocations may also provide information about thevalue decryptions provide. Decryption may

require significant time. Sometimes a passwordcan be obtained simply by asking for it, so thisshould be the first step. If that fails, using asubpoena may be successful.5. How should duplicate and near-duplicatedocuments be handled?Electronic file collections almost alwaysinclude duplicates. Multiple individuals mayhave the same e-mail, with the same attachments.Two or more people may have reviewed key documents,saving them on their hard drives during theprocess. In processing electronic collections,it is possible to identify exact duplicate filesand limit the number of documents that requirereview.Identifying exact duplicates usually occursduring the phase in which the metadata isidentified and extracted from the files.De-duping the collection will minimally delay the

processing.Standard de-duping involves identifying filesthat are exact duplicates and eliminating them.If anything has changed within a document,including formatting such as a change of font, itis no longer an exact duplicate and is notde-duped.It is imperative that both sides of a case agreeon what is meant by าde-duping.ำ Manyelectronic discovery systems literally deletethe files so they are gone from the collection.The forensic tools used in law enforcement,however, usually do not delete the duplicates,but merely identify them for future use.Discussing this definition during the pre-trialconference to ensure that all sides of a case usethe same definition is imperative to ensuringthat there is not a discrepancy in the number offiles that each side later has.

A more significant portion of any collection willbe าnear duplicates.ำ This includesfiles that have been significantly altered orcontain only a portion of the main document. Forsome projects, the sheer file volume requiresthat near duplicates be identified and reviewedas a group. This significantly reduces reviewtime and costs when compared to traditionallinear review.Identifying near duplicates requires comparingeach document to every other document or usingsophisticated software applications that requireadditional processing time. This technologyincreases consistency of review categories,reducing the chance of near-duplicate documentsbeing identified as both privileged andnon-privileged.6. What form should the collection take?

The new rules state that the parties will meet anddetermine the format in which they wish to receiveelectronic evidence. In the absence of anagreement, the format will be that าinwhich it is ordinarily maintainedำ or in aาreasonably usableำ format.The choices a legal team has include whether eachside prefers to receive the electronic evidencein native file format, converted to TIF or PDF,or in some other form. Often, this will dependupon the teamีs standard litigation reviewsystem.Such systems handle both native and convertedfiles, with or without associated metadata andfull text. There are pros and cons for bothoptions. Native files with extracted metadatareflect the exact original file; however, theycannot be Bates labeled, which is a technique tomark documents with a unique identification codeas they are processed, and are subject to

inadvertent change.Converting native files to TIF or PDF istime-consuming and is the most expensive task inelectronic discovery. Because 60 to 80 percent ofthe files in a collection may be non-responsiveor irrelevant, both the time and financesexpended in conversion may be counter-productive.The best compromise involves receiving files innative format, reviewing them for relevancy, andchoosing only those that may be produced or usedextensively for conversion to image format.Managing the vast amount of electronic files forlitigation requires preparation planning for theproduction, organization, and retrieval ofpertinent and relevant documents and managingboth cost and time budgets. Because every casepresents unique circumstances, there are noabsolute correct answers to the questions above.

But a team that understands the choices and theirramifications is prepared to make the informeddecisions that will result in the best possibleoutcomes for the case and the organization.