Monthly Archives: January 2024

Everyone talks about the ‘explosive growth’ of discovery collections. Every once in a while we get a glimpse behind the curtain at the sheer size and complexity of large matters. Browning Marean posed a question to the EDRM Search project that resulting in my wasting an entire afternoon dissecting the 511 page examiner’s report from In re Lehman Brothers Equity/Debt Securities Litigation, 08-cv-05523, U.S. District Court, Southern District of New York (Manhattan). Now I do love to geek out on metrics of all kinds, but what drives me is trying to understand the impact of numbers in context. In this case, we get to see the actual search criteria created by 20 Jenner & Block attorneys to find everything related to the downfall of the investment firm.

My very first Journal entry, The Myth of Custodial Selection, explored the very real discrepancy between what your designated custodians think might be relevant and reality. Now the Delaware ruling of Roffe v. Eagle Rock Energy GP, et al., C.A. No. 5258-VCL (Del. Ch. Apr. 8, 2010) seems to assert that custodian self-collection is inadequate and all collection must be done under the direct supervision of counsel. Barry Murphy tackled some of the potential implications and solutions in his article on Standardized Collection Workflows. I would like to assert the need for technology to enable custodial self collection or ‘custodial designation’ as an integral part of any preservation and collection effort. In my recent examinations of Enterprise Desktop Collection, Self Collection is the first and dominant methodology outlined. That is because even if you do a full forensic image of every desktop, I believe that you are still obligated to interview key custodians and ask them for relevant ESI. No one wants to try and explain why a reviewer missed a key document that your star witness knew was the smoking gun.

In Part 1, we explored the basic methods of collecting from desktops in the large enterprise environment. The recent Delaware ruling of Roffe v. Eagle Rock provided a good context to discuss the potential pitfalls and necessity of custodial self-designation of potential evidence. That brings us around to the lowest risk/highest effort method, full forensic images of desktops. I want to be very careful here to differentiate a bit-by-bit image of the physical drive from the more commonly used ‘forensically sound copy’. A forensic image captures every one or zero across the entirety of the physical drive. This means that an 80 GB laptop drive will have an 80 GB forensic image, even if there are only 20 GB of files on it. A ‘forensically sound copy’ uses the operating system to capture the content (Hash verified) and the context (OS metadata) of selective active or deleted files. Now that we have made that clear, we can move on to enterprise forensic collection, which I am taking to mean the ability to collect a full forensic image without having to physically attach a write-block device.

The Daegis acquisition by Unify caught my attention this morning as I was coding the latest batch of news and blogs from the eDJ search engine. After the 2009 slump, I expect to see a string of consolidation and acquisition within the eDiscovery market. Knowing some of the talented folks at Daegis (including some of the best of SPI), I did not expect them to be acquired for a 1.5 multiplier. That was a shocker. Daegis reported $24 million in revenue with a healthy 27% profit for fiscal 2009. That was pretty good for last year. So why did they accept $38 million in cash, notes and stock? They are advertising it as a merger and taking the Daegis name, which indicates that they are going after the corporate eDiscovery market as opposed to the corporate archive or database support market. If that seems confusing, consider that Unify specializes in database management and migration software. Unify acquired AXS-One for $8 million in stock last June. AXS-One seemed to be struggling in the archiving market, which has been consolidating for a while.

Almost every new processing or review application that I have seen over the last year has featured a left hand navigation window that enables users to dynamically filter the collection by Author, Date, Type and more. You can call this faceted navigation, guided search or browsing navigation, but it boils down to the user’s ability to actively browse/filter the collection by metadata characteristics and categories that have been extracted from the index. Although this seems like just another way to construct a search, this feature offers a lot more to the discerning user. In older platforms, users had to run reports on their collections to extract the summary population metrics across different fields. The first one that I recall was the Tally function in Summation. This could only be done one field at a time, but unlike most static reports, you could generate the tally numbers on a set of search results instead of the entire collection. Current review, processing and even archiving products like Clearwell, Relativity, Introspect and Symantec’s Discovery Accelerator can generate these hierarchical ‘facets’ across multiple fields and display the total and item level counts dynamically in real time.

The firm of Gibson Dunn has published a survey that covers 103 eDiscovery cases from the first half of 2010. To catch the overall legal implications, Ralph Losey has done his usual excellent analysis riffing on an Andy Warhol theme this time. I wanted to pull out some trend highlights and talk through the potential impact on corporate stakeholders who are struggling to implement a full eDiscovery process. Although there have been some large and well publicized eDiscovery sanctions going back to Zubulake v. UBS Warburg, the total number and cost of civil sanctions against the overall litigation scope has not been sufficient to compel most corporations to invest in defensible process. Corporate legal departments are a cost center. Corporate counsel must make risk versus cost decisions every day and the realistic risk of sanctions has not measured up to the cost of doing discovery ‘right’ for many or most companies.

As some of you might recall, I briefly ran Attenex’s services group before the potential FTI acquisition reminded me how much I liked to work for myself. I always liked Document Mapper, aka ‘the Petri Dish’, and wanted to expand the usage of their conceptual clustering, social networking and other visual analytics beyond the review interface. The FTI Technology team has accomplished this by combining three products under the Ringtail Analytics brand. Even better, they are breaking free of the volume based licensing that has dominated the market for far too long. Corporations can purchase these add-on Ringtail modules via a traditional enterprise license. The idea is to apply a variety of analytics on the early assessment samples and against collections as large as a million items to support ECA, search creation, processing parameters and to optimize automated review sets management.

Every day new products and service bundles enter the eDiscovery market. I know this because of the constant feedback that we get from articles saying, “But we do that! Why didn’t you mention us?” The reality is that I cannot list every product that has guided search, conceptual folders, etc in every article. So I try to pick 3-4 example products with as much diversity as possible. I could have called out Stratify, Recommind and many others in my Guided Search article. The good part about all this feedback is the constant opportunity to be briefed on new versions and products. For many years, Autonomy and Nexidia have had the only enterprise level audio search built for discovery (and I am sure that I will now hear from others). The team at MerlinOne briefed me on their new hosted review platform going live in August. Lo and behold, their offering includes a new, fixed fee option for dealing with large collections of voicemail, meeting minutes and other audio/video collections.

When lawyers begin looking at what keywords are important for identifying potentially responsive information, the process seems fairly straightforward. Look at the key issues; brainstorm on concepts, words, and synonyms; select the keywords; conduct the collection. Tracking this process, however, can be cumbersome. Imagine trying to explain how you generated a keyword list based on several hours of brainstorming without detailed notes or a virtual recording of the brainstorming sessions. Optimizing keyword selection can help to make a cumbersome process more transparent and scientific.

Collection tools are sophisticated enough now that organizations should be able to centrally manage collection efforts for 90% of what needs to be preserved. There will be the need to take forensic images of certain local machines, but a good information management or information governance program should cover most organizations and make the collection process smoother, more efficient, and defensible.