Collection tools are sophisticated enough now that organizations should be able to centrally manage collection efforts for 90% of what needs to be preserved. There will be the need to take forensic images of certain local machines, but a good information management or information governance program should cover most organizations and make the collection process smoother, more efficient, and defensible.
My very first Journal entry, The Myth of Custodial Selection, explored the very real discrepancy between what your designated custodians think might be relevant and reality. Now the Delaware ruling of Roffe v. Eagle Rock Energy GP, et al., C.A. No. 5258-VCL (Del. Ch. Apr. 8, 2010) seems to assert that custodian self-collection is inadequate and all collection must be done under the direct supervision of counsel. Barry Murphy tackled some of the potential implications and solutions in his article on Standardized Collection Workflows. I would like to assert the need for technology to enable custodial self collection or ‘custodial designation’ as an integral part of any preservation and collection effort. In my recent examinations of Enterprise Desktop Collection, Self Collection is the first and dominant methodology outlined. That is because even if you do a full forensic image of every desktop, I believe that you are still obligated to interview key custodians and ask them for relevant ESI. No one wants to try and explain why a reviewer missed a key document that your star witness knew was the smoking gun.
In Part 1, we explored the basic methods of collecting from desktops in the large enterprise environment. The recent Delaware ruling of Roffe v. Eagle Rock provided a good context to discuss the potential pitfalls and necessity of custodial self-designation of potential evidence. That brings us around to the lowest risk/highest effort method, full forensic images of desktops. I want to be very careful here to differentiate a bit-by-bit image of the physical drive from the more commonly used ‘forensically sound copy’. A forensic image captures every one or zero across the entirety of the physical drive. This means that an 80 GB laptop drive will have an 80 GB forensic image, even if there are only 20 GB of files on it. A ‘forensically sound copy’ uses the operating system to capture the content (Hash verified) and the context (OS metadata) of selective active or deleted files. Now that we have made that clear, we can move on to enterprise forensic collection, which I am taking to mean the ability to collect a full forensic image without having to physically attach a write-block device.
There is a need to ensure that the redaction methodology used will work for the format of data in question, and to make sure that the redaction will actually make the private text both non-visible and non-searchable. In order to select the right redaction methodology, though, organizations must know what information they have, what format it’s in, and what elements are private or privileged. That takes planning and really requires that a proactive eDiscovery initiative (and hopefully infrastructure) be in place.
The Daegis acquisition by Unify caught my attention this morning as I was coding the latest batch of news and blogs from the eDJ search engine. After the 2009 slump, I expect to see a string of consolidation and acquisition within the eDiscovery market. Knowing some of the talented folks at Daegis (including some of the best of SPI), I did not expect them to be acquired for a 1.5 multiplier. That was a shocker. Daegis reported $24 million in revenue with a healthy 27% profit for fiscal 2009. That was pretty good for last year. So why did they accept $38 million in cash, notes and stock? They are advertising it as a merger and taking the Daegis name, which indicates that they are going after the corporate eDiscovery market as opposed to the corporate archive or database support market. If that seems confusing, consider that Unify specializes in database management and migration software. Unify acquired AXS-One for $8 million in stock last June. AXS-One seemed to be struggling in the archiving market, which has been consolidating for a while.
While there are some common trends, every company is different and the disconnect between legal and IT is so large that gauging eDiscovery purchasing habits is complex.
Almost every new processing or review application that I have seen over the last year has featured a left hand navigation window that enables users to dynamically filter the collection by Author, Date, Type and more. You can call this faceted navigation, guided search or browsing navigation, but it boils down to the user’s ability to actively browse/filter the collection by metadata characteristics and categories that have been extracted from the index. Although this seems like just another way to construct a search, this feature offers a lot more to the discerning user. In older platforms, users had to run reports on their collections to extract the summary population metrics across different fields. The first one that I recall was the Tally function in Summation. This could only be done one field at a time, but unlike most static reports, you could generate the tally numbers on a set of search results instead of the entire collection. Current review, processing and even archiving products like Clearwell, Relativity, Introspect and Symantec’s Discovery Accelerator can generate these hierarchical ‘facets’ across multiple fields and display the total and item level counts dynamically in real time.
The firm of Gibson Dunn has published a survey that covers 103 eDiscovery cases from the first half of 2010. To catch the overall legal implications, Ralph Losey has done his usual excellent analysis riffing on an Andy Warhol theme this time. I wanted to pull out some trend highlights and talk through the potential impact on corporate stakeholders who are struggling to implement a full eDiscovery process. Although there have been some large and well publicized eDiscovery sanctions going back to Zubulake v. UBS Warburg, the total number and cost of civil sanctions against the overall litigation scope has not been sufficient to compel most corporations to invest in defensible process. Corporate legal departments are a cost center. Corporate counsel must make risk versus cost decisions every day and the realistic risk of sanctions has not measured up to the cost of doing discovery ‘right’ for many or most companies.
The archiving market is picking up steam, driven by a huge interest in cloud-based solutions. Cloud-based archiving providers offer virtually all the features of on-premise archiving – eDiscovery search interface; end-user access to email; compliance monitoring interface; storage management; legal hold. About the only thing cloud-based vendors don’t offer is mailbox management (stubbing)…and with the introduction of Microsoft Exchange 2010 to the market, the need for mailbox management is virtually dead. Still, though, there are valid concerns with cloud-based archiving – security; location of data; encryption; regulatory or legal requirements to store certain data on-premise; speed of document retrieval.
As some of you might recall, I briefly ran Attenex’s services group before the potential FTI acquisition reminded me how much I liked to work for myself. I always liked Document Mapper, aka ‘the Petri Dish’, and wanted to expand the usage of their conceptual clustering, social networking and other visual analytics beyond the review interface. The FTI Technology team has accomplished this by combining three products under the Ringtail Analytics brand. Even better, they are breaking free of the volume based licensing that has dominated the market for far too long. Corporations can purchase these add-on Ringtail modules via a traditional enterprise license. The idea is to apply a variety of analytics on the early assessment samples and against collections as large as a million items to support ECA, search creation, processing parameters and to optimize automated review sets management.