10 Important Decisions for Effective E-discovery Part 1
from web site
10 Important Decisions for Successful E-discovery Part 1
The Information Management Journal/September/ October 2007- Today's explosion of electronic information, combined with the December 2006 changes to the Federal Rules of Civil Procedure (FRCP) worrying digitally stored information (ESI), requires information and attorneys to broaden their understanding about handling electronic discovery. The current changes to the FRCP include:
* Definitions and safe harbor provisions for the regular alterations of electronic files during regular operations such as back ups [Amended Rule 37( f)]
* Information about how to deal with information that is not reasonably available [Amended Rule 26( b)( 2 )( B)]
* How to deal with inadvertently produced privileged product [Amended Rule 26( b)( 5)]
* ESI conservation responsibilities and the pre-trial conference. [Amended Rule 26( f)]
* Electronic file production demands [Changed Rules 33( d), 34, 26( f)( 3 ), 34( b)( iii)]
There are numerous viewpoints about how ESI need to be planned for, managed, arranged, stored, and obtained. Some of the readily available choices are extremely costly in terms of their required financial and time commitments. Continuously changing technologies only contribute to the confusion. One area of confusion is the difference in between computer system forensics and electronic discovery; there is a substantial difference. These are described in the sidebar Computer Forensics vs. Electronic Discovery.
Making the Right Choices
Successfully reacting to e-discovery within the restrictions of the changed FRCP needs companies to make numerous critical choices that will impact the collection and processing of ESI.
Collection Decisions
The following concerns need immediate responses:
1. Are e-mail files part of this project? If so, do any essential people keep an Internet email account, in addition to their corporate accounts?
The sheer volume of transactions for large e-mail providers prohibits the storage of massive amounts of mail files. If a case might possibly need the exploration of email from Internet accounts, the discovery team should expeditiously request the records, or they may be gone permanently.
2. Is there any possibility prohibited activity may be discovered?
Lots of cases including electronic information uncover wrongdoings. These situations might involve a member of the technology department or a highly technical worker. In these cases, an organization's first inclination might be to end the staff member( s) involved and identify the extent of any damage prior to informing police.
If the wrongdoing is by a technical individual, there is an opportunity that he or she is the only person who understands how to access the files, discover the issue, or repair it. The technical worker typically has the capability to work and access company files remotely.
If the circumstance includes criminal matters, particularly if monetary or medical records have been jeopardized, a good decision is to include law enforcement as early as possible. Electronic lawbreakers often destroy all evidence and disappear of their activities.
3. Is it possible that deleted or concealed files may play an essential function in this case?
There are three ways to collect electronic apply for discovery:
* Forensically ะ ะ as described in the sidebar
* Semi-forensically ะ ะ utilizing non-validated approaches and applications to catch files
* Non-forensically using easy cut and- paste copy approaches to move copies of files from one location to another. These approaches do not include hashing files to guarantee the files have not changed, which involves using a hash algorithm to produce a mathematical finger print of several files that will change if any modification is made to the collection.
For some matters, the content of electronic documents is all that matters. The context of the files ะ ะ who created them, how they are kept, how they have been accessed, if they have actually been changed or erased ะ ะ is not as crucial.
For other cases, contextual info, including finding erased files, is important and requires a forensic collection. This consists of
* Ensuring legal search authority of the information
* Documenting chain of custody
* Creating a forensic copy utilizing verified forensic tools that create hash records
* Using repeatable processes to analyze and examine the information
* Creating a clinical report of any findings
Determining the value of electronic forensic file collection must be done prior to any data being caught. Once semi- or non-forensic methods have been utilized, it is impossible to return records to their original states.
4. Are backup tapes part of an active collection?
Some cases involve historical problems, making the method of dealing with computer system backups essential to deal with instantly.
A lot of services utilize a schedule of rotating their backup media. For instance, in a four-week rotation, daily backups are done for a week and after that those tapes (or drives) are taken offsite for storage. A brand-new set of media is utilized for the second, 3rd, and fourth weeks, and then those three tapes are stored offsite. On the 5th week, the tapes/drives from the very first week are recycled. This process is provided for financial factors, as it is exceptionally cost-efficient.
Backup tapes might become part of the active details required to be kept under a lawsuits hold. This needs cessation of any rotation schedule, and the 2006 changes to the FRCP make it vital for the legal team to communicate that details to the technology employees responsible for organisation connection processes.
* ESI preservation duties and the pre-trial conference. Are e-mail files part of this job? The sheer volume of deals for big e-mail service providers forbids the storage of huge amounts of mail files. If the wrongdoing is by a technical person, there is an opportunity that he or she is the only person who knows how to access the files, discover the problem, or repair it. The technical staff member normally has the capability to work and gain access to company submits from another location.
The Information Management Journal/September/ October 2007- Today's explosion of electronic information, combined with the December 2006 changes to the Federal Rules of Civil Procedure (FRCP) worrying digitally stored information (ESI), requires information and attorneys to broaden their understanding about handling electronic discovery. The current changes to the FRCP include:
* Definitions and safe harbor provisions for the regular alterations of electronic files during regular operations such as back ups [Amended Rule 37( f)]
* Information about how to deal with information that is not reasonably available [Amended Rule 26( b)( 2 )( B)]
* How to deal with inadvertently produced privileged product [Amended Rule 26( b)( 5)]
* ESI conservation responsibilities and the pre-trial conference. [Amended Rule 26( f)]
* Electronic file production demands [Changed Rules 33( d), 34, 26( f)( 3 ), 34( b)( iii)]
There are numerous viewpoints about how ESI need to be planned for, managed, arranged, stored, and obtained. Some of the readily available choices are extremely costly in terms of their required financial and time commitments. Continuously changing technologies only contribute to the confusion. One area of confusion is the difference in between computer system forensics and electronic discovery; there is a substantial difference. These are described in the sidebar Computer Forensics vs. Electronic Discovery.
Making the Right Choices
Successfully reacting to e-discovery within the restrictions of the changed FRCP needs companies to make numerous critical choices that will impact the collection and processing of ESI.
Collection Decisions
The following concerns need immediate responses:
1. Are e-mail files part of this project? If so, do any essential people keep an Internet email account, in addition to their corporate accounts?
The sheer volume of transactions for large e-mail providers prohibits the storage of massive amounts of mail files. If a case might possibly need the exploration of email from Internet accounts, the discovery team should expeditiously request the records, or they may be gone permanently.
2. Is there any possibility prohibited activity may be discovered?
Lots of cases including electronic information uncover wrongdoings. These situations might involve a member of the technology department or a highly technical worker. In these cases, an organization's first inclination might be to end the staff member( s) involved and identify the extent of any damage prior to informing police.
If the wrongdoing is by a technical individual, there is an opportunity that he or she is the only person who understands how to access the files, discover the issue, or repair it. The technical worker typically has the capability to work and access company files remotely.
If the circumstance includes criminal matters, particularly if monetary or medical records have been jeopardized, a good decision is to include law enforcement as early as possible. Electronic lawbreakers often destroy all evidence and disappear of their activities.
3. Is it possible that deleted or concealed files may play an essential function in this case?
There are three ways to collect electronic apply for discovery:
* Forensically ะ ะ as described in the sidebar
* Semi-forensically ะ ะ utilizing non-validated approaches and applications to catch files
* Non-forensically using easy cut and- paste copy approaches to move copies of files from one location to another. These approaches do not include hashing files to guarantee the files have not changed, which involves using a hash algorithm to produce a mathematical finger print of several files that will change if any modification is made to the collection.
For some matters, the content of electronic documents is all that matters. The context of the files ะ ะ who created them, how they are kept, how they have been accessed, if they have actually been changed or erased ะ ะ is not as crucial.
For other cases, contextual info, including finding erased files, is important and requires a forensic collection. This consists of
* Ensuring legal search authority of the information
* Documenting chain of custody
* Creating a forensic copy utilizing verified forensic tools that create hash records
* Using repeatable processes to analyze and examine the information
* Creating a clinical report of any findings
Determining the value of electronic forensic file collection must be done prior to any data being caught. Once semi- or non-forensic methods have been utilized, it is impossible to return records to their original states.
4. Are backup tapes part of an active collection?
Some cases involve historical problems, making the method of dealing with computer system backups essential to deal with instantly.
A lot of services utilize a schedule of rotating their backup media. For instance, in a four-week rotation, daily backups are done for a week and after that those tapes (or drives) are taken offsite for storage. A brand-new set of media is utilized for the second, 3rd, and fourth weeks, and then those three tapes are stored offsite. On the 5th week, the tapes/drives from the very first week are recycled. This process is provided for financial factors, as it is exceptionally cost-efficient.
Backup tapes might become part of the active details required to be kept under a lawsuits hold. This needs cessation of any rotation schedule, and the 2006 changes to the FRCP make it vital for the legal team to communicate that details to the technology employees responsible for organisation connection processes.
* ESI preservation duties and the pre-trial conference. Are e-mail files part of this job? The sheer volume of deals for big e-mail service providers forbids the storage of huge amounts of mail files. If the wrongdoing is by a technical person, there is an opportunity that he or she is the only person who knows how to access the files, discover the problem, or repair it. The technical staff member normally has the capability to work and gain access to company submits from another location.
