The Information Management Journal/September / October 2007- Today explosion of electronic data, coupled with the December 2006 amendments to the Federal Rules of Civil Procedure (FRCP) concerning electronically stored information (ESI), requires information and legal professionals to expand their knowledge about handling electronic discovery. The recent changes to the FRCP include:
* Definitions and safe harbor provisions for the routine alterations of electronic files during routine operations such as back-ups [Amended Rule 37(f)]
* Information about how to deal with data that is not reasonably accessible [Amended Rule 26(b)(2)(B)]
* How to deal with inadvertently produced privileged material [Amended Rule 26(b)(5)]
* ESI preservation responsibilities and the pre-trial conference. [Amended Rule 26(f)]
* Electronic file production requests [Amended Rules 33(d), 34, 26(f)(3), 34(b)(iii)]
There are many opinions about how ESI should be planned for, managed, organized, stored, and retrieved. Some available options are extremely costly in terms of their required financial and time commitments. Constantly changing technologies only add to the confusion. One area of confusion is the distinction between computer forensics and electronic discovery; there is a significant difference. These are described in the sidebar Computer Forensics vs. Electronic Discovery.
Making the Right Choice
Successfully responding to e-discovery within the constraints of the amended FRCP requires organizations to make many critical decisions that will affect the collection and processing of ESI.
Processing Choice
Because of the volume of information available in even the smallest of collections, it becomes necessary to manage the process to control time and budget. The following questions need to be answered:
Who are the key people?
The people important to a case should be identified. These key individuals include not only executives, but also assistants and other support personnel from the technology, accounting, sales and marketing, operations, and human resources departments.
Where are the files located?
All the potential locations of electronic evidence should be identified. These include home computers and all computers that a key person would use elsewhere (such as a girlfriend or boyfriends home), cell phones, PDA, Blackberries, and any other digital device that might be used. It is important to note that MP3 players, such as iPods, can also be used to store documents or important files.
How can the collection be culled?
Methods for limiting the number of files collected may include collecting only those in certain date ranges or only those containing selected keywords or terms. This can be done either before or after an entire hard drive is collected forensically. Known file filtering can also reduce the collection by removing standard application files common to all computers (such as the Microsoft Windows logo file).
How should password-protected/encrypted files be handled?
Encrypted files cannot be processed until the encryption is broken. In some instances, files with exact or similar names may be available without using passwords or encryption. File locations may also provide information about the value decryption provide. Decryption may require significant time. Sometimes a password can be obtained simply by asking for it, so this should be the first step. If that fails, using a subpoena may be successful.
How should duplicate and near-duplicate documents be handled?
Electronic file collections almost always include duplicates. Multiple individuals may have the same e-mail, with the same attachments. Two or more people may have reviewed key documents, saving them on their hard drives during the process. In processing electronic collections, it is possible to identify exact duplicate files and limit the number of documents that require review.
You must be logged in to post a comment.