Historical Essays

When lawyers begin looking at what keywords are important for identifying potentially responsive information, the process seems fairly straightforward. Look at the key issues; brainstorm on concepts, words, and synonyms; select the keywords; conduct the collection. Tracking this process, however, can be cumbersome. Imagine trying to explain how you generated a keyword list based on several hours of brainstorming without detailed notes or a virtual recording of the brainstorming sessions. Optimizing keyword selection can help to make a cumbersome process more transparent and scientific.

Collection tools are sophisticated enough now that organizations should be able to centrally manage collection efforts for 90% of what needs to be preserved. There will be the need to take forensic images of certain local machines, but a good information management or information governance program should cover most organizations and make the collection process smoother, more efficient, and defensible.

My very first Journal entry, The Myth of Custodial Selection, explored the very real discrepancy between what your designated custodians think might be relevant and reality. Now the Delaware ruling of Roffe v. Eagle Rock Energy GP, et al., C.A. No. 5258-VCL (Del. Ch. Apr. 8, 2010) seems to assert that custodian self-collection is inadequate and all collection must be done under the direct supervision of counsel. Barry Murphy tackled some of the potential implications and solutions in his article on Standardized Collection Workflows. I would like to assert the need for technology to enable custodial self collection or ‘custodial designation’ as an integral part of any preservation and collection effort. In my recent examinations of Enterprise Desktop Collection, Self Collection is the first and dominant methodology outlined. That is because even if you do a full forensic image of every desktop, I believe that you are still obligated to interview key custodians and ask them for relevant ESI. No one wants to try and explain why a reviewer missed a key document that your star witness knew was the smoking gun.

In Part 1, we explored the basic methods of collecting from desktops in the large enterprise environment. The recent Delaware ruling of Roffe v. Eagle Rock provided a good context to discuss the potential pitfalls and necessity of custodial self-designation of potential evidence. That brings us around to the lowest risk/highest effort method, full forensic images of desktops. I want to be very careful here to differentiate a bit-by-bit image of the physical drive from the more commonly used ‘forensically sound copy’. A forensic image captures every one or zero across the entirety of the physical drive. This means that an 80 GB laptop drive will have an 80 GB forensic image, even if there are only 20 GB of files on it. A ‘forensically sound copy’ uses the operating system to capture the content (Hash verified) and the context (OS metadata) of selective active or deleted files. Now that we have made that clear, we can move on to enterprise forensic collection, which I am taking to mean the ability to collect a full forensic image without having to physically attach a write-block device.

There is a need to ensure that the redaction methodology used will work for the format of data in question, and to make sure that the redaction will actually make the private text both non-visible and non-searchable. In order to select the right redaction methodology, though, organizations must know what information they have, what format it’s in, and what elements are private or privileged. That takes planning and really requires that a proactive eDiscovery initiative (and hopefully infrastructure) be in place.

The Daegis acquisition by Unify caught my attention this morning as I was coding the latest batch of news and blogs from the eDJ search engine. After the 2009 slump, I expect to see a string of consolidation and acquisition within the eDiscovery market. Knowing some of the talented folks at Daegis (including some of the best of SPI), I did not expect them to be acquired for a 1.5 multiplier. That was a shocker. Daegis reported $24 million in revenue with a healthy 27% profit for fiscal 2009. That was pretty good for last year. So why did they accept $38 million in cash, notes and stock? They are advertising it as a merger and taking the Daegis name, which indicates that they are going after the corporate eDiscovery market as opposed to the corporate archive or database support market. If that seems confusing, consider that Unify specializes in database management and migration software. Unify acquired AXS-One for $8 million in stock last June. AXS-One seemed to be struggling in the archiving market, which has been consolidating for a while.