eDJ Migrated

Greg Buckles’ recent post on legal hold notices reaching eDiscovery platforms hinted at something that I believe many organizations will be doing this year – connecting legal hold process management with execution of collection and preservation activities. While this would seem an obvious and not-so-revolutionary next step, it’s one that is not easy to implement and not necessarily specifically called for in any rules governing the practice of eDiscovery. Thus, I sense hesitation on the part of some practitioners. But, I believe the process management and IT benefits of making the connection will ultimately start to win out this year.

Greetings to all of the readers of the eDiscoveryJournal. I’m pleased to join you as the newest correspondent and hope that you will find that what l share in this forum is useful. Now that I’m here, I’m sure some of you are wondering, “Just what is an independent consultant going to share?" Some may suspect that there will be a dry recitation of product reviews and hardware specs. Some may worry that I’m going to belabor yet again subjects such as “Are instant messages ‘records’?” And some that have heard me speak in public worry that I might just take off all the safeties and satirize what I see out there in the eDiscovery business world. While the last is the most tempting, I personally hate when the Internet is used to push personal agendas. No dear friends, I intend to do the practical thing and provide you with the “One Thousand Foot View”.

According to Wikipedia, a seanchaí is a traditional Irish storyteller/historian. A commonly encountered English spelling of the Irish word is shanachie. All lawyers need to be able to tell stories to convey facts and explain concepts. They do this for judges, to juries and occasionally among clients. For such a task, there’s no better preparation than kissing the Blarney Stone.

Migrated from eDJGroupInc.com. Author: Kevin Esposito. Published: 2011-03-21 08:00:14Format, images and links may no longer function correctly. The children’s song “Do Re Mi” starts with the line “Let’s start at the very beginning, it’s a very good place to start”.  What seems like a standard concept even for children is anything but when operating in the world of eDiscovery.  In many engagements, we’re brought into [...]

Email is everywhere. We are seeing a lot of corporate clients making the transition from preservation notices to actual preservation/collection systems. Whether using an email archive, collection appliance or search software with connectors into Exchange, the IT administrators tend to interpret Legal’s custodial preservation request very literally. They still see email in the Mailbox model. When assessing the existing preservation process (if any), I almost always find gaps and unmanaged sources that slipped through the net. Public companies that have been around for more that 3-5 years have gone through M&A activities, RIFs, bankruptcies and other corporate wide reorganizations that leave ESI skeletons in the corporate closet. I have blogged recently about the tendency to create corporate digital landfills, but the recent string of preservation sanction cases has reaffirmed the need to know where your email hides.

At the IPRO Innovations 2011 customer conference in Phoenix last week, I participated in an excellent panel discussion focused on the potential impact of large enterprise ECM and archiving platforms expanding into the eDiscovery lifecycle. Panelists Ronald Sotak of Ryley Carlock & Applewhite and Olivia Gerroll of Esentio brought excellent if divergent perspectives. The first thing to realize is that the majority of our audience consisted of IPRO channel partners, i.e. eDiscovery service providers. Some service providers are threatened by global software companies’ recent push to incorporate eDiscovery features into enterprise platforms. Specialty markets like eDiscovery can be eroded when their services are absorbed into normal corporate business processes. So the real question was, “Will in-house software platforms replace the vendors?”

In my long career, I have had to explain client’s data losses to regulators, prosecutors, hostile experts and angry judges far too many times. It makes you paranoid about encryption, backups and other recovery efforts. Even the best of us can get so busy that we forget to kick off that simple process. In my case, I had gotten in the habit of full backups the night before every trip, which should have meant a week’s loss at most. That meant that I got out of my Friday back up habit. Now that we are actively conducting research projects, I occasionally get as much as a month off the road. See where this is going? I didn’t. Turns out that a month is long enough to break even long standing habits. I hope that the punk who smashed-n-grabbed my encrypted hardware gets what is coming to him. This whole exercise got me thinking about recovery and remediation when you have hardware or data loss while under hold.

I hit on a couple articles today that raised awareness on yet another mobile device security issue, this one applies to all the iPhones and iPads with active GPS. A little deeper digging uncovered an excellent forensic discussion and rebuttal by Alex Levinson that details his own research, paper and even forensic software that has been available for some time. The primary issue is that the Apple iOS has been storing your unsecured location history within different file locations since GPS enabled iPhones were available. The only way to prevent this slow accumulation of time-location information is to turn off your Location Services. Although this information has been available previously through the Lantern 2.0 application from Katana Forensics LLC, it is now accessible via a free open source utility called the iPhoneTracker. The June 2010 iOS 4.0 release by Apple moved all the diverse tracking information into a new Consolidated.db central location that is easier to access.

This morning’s keynote speech by Symantec CEO Enrique Salem had several interesting take-aways for those of us focused on the intersection of legal and IT. Legal discovery was mentioned in the first 5 minutes as a key business requirement. That means global software companies now see eDiscovery and Information Governance as a market driver, not just a niche area. I remember having to do eDiscovery 101 talks with execs back in 2006 to explain the purpose of the software company that they had just acquired. So I see this as FRCP to market driver in a short 5 years. The eDiscovery market and industry as a whole has grown incredibly quickly and is still immature in many ways. Symantec started the eDiscovery acquisitions in 2001 with the Veritas/KVS merger. EMC, IBM, Iron Mountain and others have followed with acquisitions of Stratify, PSS,Kazeon, Mimosa, Legato and other products that are directly or indirectly used for eDiscovery.

All of us techies are familiar with strange computer requests from friends and family. I had one today from a good friend in the middle of a business dispute that got me thinking about what we now take for granted in civil discovery. The key question boiled down to, “So can you tell if this Excel 2007 spreadsheet was created or changed right before being sent?” I’m staring at the email with the attached spreadsheet and knowing that my friend will not like the answer. It only takes seconds to check the internal properties and see that the spreadsheet was created three months ago, but modified just prior to being emailed. But what does that really tell us? Not much. The sender could have popped open the original spreadsheet to recheck it and then hit save instead of just closing it. Without the key file system metadata that would have been acquired with any proper discovery collection, there was just no good answer for my friend. Friends, family and counsel all seem to expect that we will be able to do some kind of technical CSI magic to reconstruct every instant of a file’s life. Reality is that improper collection or preservation can effectively destroy any chance of being able to actually authenticate critical properties like dates, authors and more.