1. © 2007 LexisNexis. All rights reserved. Keating Muething & Klekamp E-Discovery Fundamentals CLE Larry W. Conner, Esq. (Bud) Electronic Discovery SpecialistLarry W. Conner, Esq. (Bud) Electronic Discovery Specialist Brenna L. Penrose, KMKBrenna L. Penrose, KMK Stephanie M. Maw, KMKStephanie M. Maw, KMK Cincinnati, OH November 8, 2007

2. © 2007 LexisNexis. All rights reserved. Session Overview E-Discovery Fundamentals The Paperless Office Understanding Electronic Files Harnessing Efficiencies Unique to Electronic Files Amendments to the Federal Rules of Civil Procedure/Duty to Preserve and Legal Holds Sanctions Data Collection, Evidentiary Issues and Chain of Custody

3. © 2007 LexisNexis. All rights reserved. E-Discovery Fundamentals

4. © 2007 LexisNexis. All rights reserved. What Makes E-Discovery Different Volume & Duplicability Persistence Dynamic & Changeable Metadata

5. © 2007 LexisNexis. All rights reserved. Volume and DuplicabilityThe Paperless Office Volume of Electronic Data is Increasing 99% of new information is stored electronically (most on hard disks) An estimated 97 billion email messages are sent each day Most Data is Stored Only Electronically Less than 1/3 of e-documents are ever printed 60% of business-critical info is stored within corporate email systems Few companies proactively manage document storage

6. © 2007 LexisNexis. All rights reserved. Persistence Data is More Difficult to Dispose of than Paper Shredded paper document is essentially irretrievable Delete a misnomer in e-discovery With Electronic Data, a Little Goes a Long Way: 1 megabyte = A short novel 1 gigabyte = A pickup truck filled with books 1 terabyte = 50,000 trees reduced to paper One Gigabyte of Electronic Documents Contains an average of 75,000 pages.

7. © 2007 LexisNexis. All rights reserved. PersistenceWhere Are Electronic Files Located? Hard drives (at office and at home) – hard drive storage accounts for more than 55% of total data storage each year Back up tapes Email Servers File servers CDs and DVDs 3.5 disks and zip disks Personal Digital Assistants (Palm, Blackberry, etc.

8. © 2007 LexisNexis. All rights reserved. Dynamic and Changeable Computer data has the potential to automatically update and backup files. In many instances, these changes take place without human intervention.

9. © 2007 LexisNexis. All rights reserved. Metadata Ability to retain all 3 dimensions: Front of document: The Image The face of the document Middle of document: The Text What the document says Document content fully searchable Back of document: Meta Data Meta data = data about the document Ex: date created, bcc, links to attachments

10. © 2007 LexisNexis. All rights reserved. Why Metadata Matters Provides additional information about the document you might not find in the paper version Provides the authenticity of the document Provides link between email and attachment(s) Provides link between conversation threads Allows for de-duplication

11. © 2007 LexisNexis. All rights reserved. Why Metadata MattersNew Efficiencies Duplicates are identified & consistently tagged 100% text indexed = accurate searches All meta data captured & searchable Email conversations preserved Parent-child relationships preserved Web-based repository with access from any computer with Internet connection

12. © 2007 LexisNexis. All rights reserved. Amendments to the Federal Rules of Civil Procedure Recognition of the Impact of Electronic Documents on the Discovery Process

13. © 2007 LexisNexis. All rights reserved. Amendments to the Federal Rules of Civil Procedure Effective December 1, 2006 Changes to Rules 16, 26, 33, 37 & 45 Will affect cases filed after effective date, and all proceedings then pending in so far as just and practicable.

14. © 2007 LexisNexis. All rights reserved. Amendments to the Federal Rules of Civil Procedure Rule 16: Provisions in courts scheduling order pertaining to discovery or disclosure of ESI Rule 26: Discussion of electronic discovery issues during parties discovery-planning conference Rule 33: Permits a party to respond to an interrogatory by specifying the ESI from which the answer can be gleaned Rule 34: Adds a new category of discoverable information called electronically stored information and provides options for form of production Rule 37: Safe harbor for ESI deleted as a result of routine operation of information management system Rule 45: Provides conditions for non-party production of ESI Form 35: Includes parties proposed discovery plan for ESI

15. © 2007 LexisNexis. All rights reserved. Amendments to the Federal Rules of Civil Procedure Scope of Discoverability of Electronic Documents Definition of Document Inaccessible Electronic Files Discovery Duties Duty to Preserve Duty to Investigate Duty to Disclose Issues Pertaining to Production Form of Production Native File Production Meta Data Production Inadvertent Production Cost Shifting Sanctions

16. © 2007 LexisNexis. All rights reserved. Electronically Stored Information Rule 34 Purposefully Broad The basic legal framework is the same as for paper documents. Authorizes requests for the production of documents, including electronic data compilations. The definition of a Rule 34 document has implicitly included electronic data for more than 30 years. PRACTICE TIP: EVERY request for documents is a request for ELECTRONIC DOCUMENTS as well as for paper documents.

17. © 2007 LexisNexis. All rights reserved. Electronically Stored Information Rule 34(a) adds an entirely new category of discoverable information called Electronically Stored Information (ESI) Specifically includes writings, drawings, images and other data or data compilations stored in any medium from which information can be obtained or translated into a reasonably usable form. Previous Rule on Discovery Everything relevant is discoverable Responding parties seek protective order under Rule 26(c) Must demonstrate affirmative and compelling proof of undue burden United States of America v. Americagroup Illinois, Inc., 2005 U.S. Dist. LEXIS 24929 (N.D. Ill. October 21, 2005)

18. © 2007 LexisNexis. All rights reserved. Electronically Stored InformationReasonable Accessibility FRCP Rules 26(b)(2)(B) & 45(d)(1)(C) Discovery if data is not reasonably accessible Responding party not required to produce if not reasonably accessible due to undue burden/cost Party still has duty to preserve inaccessible ESI Upon the requesting party's motion, responding party must show that the information is not reasonably accessible Even if showing is made, court may still order production if requesting party demonstrates good cause Court may specify conditions for the discovery (cost-shifting)

19. © 2007 LexisNexis. All rights reserved. Electronically Stored InformationReasonable Accessibility Courts Determinations of Unduly Burdensome. Responding partys limited interest in case. Burkholder v. Local 12, A.A.W., 2006 U.S. Dist. Lexis 45312 (N.D. Ohio July 5, 2006) Labor–intensive production of legacy systems. Rowe Entt v. William Morris Agency, 205 F.R.D. 421 (S.D.N.Y. 2002) Significant financial burden on responding party. Byers v. Illinois State Police, 2002 U.S. Dist. Lexis 9861 (N.D. Ill. 2002)

20. © 2007 LexisNexis. All rights reserved. Electronically Stored InformationReasonable Accessibility Hierarchy of ESI Accessibility Active, online data (hard drives) Near line data (computer accessible optical drives) Offline storage/archives (indexed or organized back up tapes) Offline storage/archives (back up tapes intended for disaster recovery) Erased or fragmented data (data not intended to be saved, but capable of restoration) Legacy data and back-up tapes for systems no longer supported Most Accessible Least Accessible

21. © 2007 LexisNexis. All rights reserved. Rule 26(b)(2)(B): Case Law Focus is on Burdens and Costs, Not Type of Data Semsroth v. City of Wichita, 2006 U.S. Dist. LEXIS 83363 (D. Kan. Nov. 15, 2006) Ameriwood Indus., Inc. v. Liberman, 2007 U.S. Dist. LEXIS 10791 (E.D. Mo. Feb. 13,2007); Ameriwood Indus., Inc. v. Liberman, 2006 U.S. Dist. LEXIS 93380 (E.D. Mo. Dec. 27, 2006) Cenveo Corp. v. Slater, 2007 U.S. Dist. LEXIS 8281 (E.D. Penn. Jan. 31, 2007) Best Buy Stores, L.P. v. Developers Diversified Realty Corp., 2007 U.S. LEXIS 7580 (D. Minn. Feb. 1, 2007) Thielen v. Buongiorno USA, Inc., 2007 U.S. Dist. LEXIS 8998 (W.D. Mich. Feb. 8, 2007) Peskoff v. Faber, 2007 U.S. Dist. LEXIS 11623 (D. D.C. Feb 21, 2007) Rule 45: Guy Chemical Co. v. Romaco, Inc., 2007 U.S. Dist. LEXIS 37636 (N.D. IN May 22, 2007)

22. © 2007 LexisNexis. All rights reserved. Reasonable Accessibility Undue Burden or Cost Rule 26(b)(2)(C): (C) The frequency or extent of use of the discovery methods otherwise permitted under these rules and by any local rule shall be limited by the court if it determines that: the discovery sought is unreasonably cumulative or duplicative, or is obtainable from some other source that is more convenient, less burdensome, or less expensive; the party seeking discovery has had ample opportunity by discovery in the action to obtain the information sought; or the burden or expense of the proposed discovery outweighs its likely benefit, taking into account the needs of the case, the amount in controversy, the parties' resources, the importance of the issues at stake in the litigation, and the importance of the proposed discovery in resolving the issues. The court may act upon its own initiative after reasonable notice or pursuant to a motion under Rule 26(c).

23. © 2007 LexisNexis. All rights reserved. Reasonable Accessibility Undue Burden or Cost Zubulake Cost-Shifting Factors The court should consider shifting costs only when inaccessible data is at issue. Inaccessible data is data that is not online or near line and includes data on backup tapes. Court must determine what data may be found on inaccessible media. Sampling approach. In conducting the cost-shifting analysis, a seven-factor test should be applied with priority given to the first two factors.

24. © 2007 LexisNexis. All rights reserved. Reasonable Accessibility Undue Burden or Cost Zubulake balancing test: 1.The extent to which the request is specifically tailored to discover relevant information. 2.The availability of such information from other sources. 3.The total cost of production, compared to the amount in controversy. 4.The total cost of production, compared to the resources available to each party. 5.The relative ability of each party to control costs and its incentive to do so. 6.The importance of the issues at stake in the litigation. 7.The relative benefits to the parties of obtaining the information.

25. © 2007 LexisNexis. All rights reserved. Duty to Preserve and Legal Holds Defined Trigger Scope Current Cases Best Practices

26. © 2007 LexisNexis. All rights reserved. Duty to Preserve An entity is required to preserve documents and electronic data when it knows or reasonably should know that information may be relevant to pending or anticipated litigation. Once litigation is anticipated, a party must suspend its routine document retention/destruction policy and put in place a legal hold to preserve what it knows, or reasonably should know, is relevant to the action.

27. © 2007 LexisNexis. All rights reserved. Legal Holds - Trigger Fact Specific Rambus Decisions Hynix Semiconductor, Inc. v. Rambus, Inc., 2006 U.S. Dist. LEXIS 30690 (N.D. Cal. Jan. 4, 2006) Although Rambus contemplated litigation prior to holding its annual shred day, court held the duty to preserve evidence did not arise until later when Rambus initiated a beauty contest to select litigation counsel. Samsung Elecs. Co. v. Rambus, Inc., 2006 U.S. Dist. LEXIS 50007 (E.D. Va. July 18, 2006) Court rejects Hynix noting that by the time Rambus initiated shred day, it had identified most likely and attractive litigation targets, settled on possible legal theories, and identified relevant documents for both preservation and destruction Preservation Orders

28. © 2007 LexisNexis. All rights reserved. Legal Holds - Scope A party or anticipated party must retain all relevant documents (but not multiple identical copies) in existence at the time the duty to preserve attaches, and any relevant documents created thereafter. -Zubulake v. UBS Warburg, (Zubulake IV) 220 F.R.D. 212 (S.D.N.Y. 2003).

29. © 2007 LexisNexis. All rights reserved. Duty to Preserve – Current Cases Miller v. Holzmann, 2007 U.S. Dist. LEXIS 2987 (D.D.C. Jan. 17, 2007 Reino De Espana v. American Bureau of Shipping, 2007 U.S. Dist. LEXIS 5693 (S.D.N.Y. Jan. 25, 2007) Floeter v. City of Orlando, 2007 U.S. Dist. LEXIS 9527 (M.D. Fl. Feb. 9, 2007) Griffin v. GMAC Comm. Fin., 2007 U.S. Dist. LEXIS 10504 (N.D. Ga. Feb. 15, 2007) Cache la Poudre Feeds v. Land OLakes, Inc., 2007 U.S. Dist. LEXIS 15277 (D. Colo. March 2, 2007)

30. © 2007 LexisNexis. All rights reserved. 1.Trigger Considerations 2.Understand Clients Data Storage/Data Map 3.Be Familiar with Clients Document Retention Policy 4.Define Scope of Information that must be Produced 5.Send Legal Hold Letter 6.Communicate with Key Custodians 7.Communicate with IT and Records Management 8.Assure that Information is Preserved in Proper Format 9.Continue to Monitor and Audit 10.Continue to Communicate 11.Keep Detailed Records of Preservation and Production Legal Holds Best Practices

31. © 2007 LexisNexis. All rights reserved. EXAMPLE IT ORGANIZATION Very large Organization Chief Information Officer Director – Office of IT Planning & Policy Director – Office of IT Security Infrastructure And Technology Director – Office of Networking & Telecom Operations Director – Office of Systems Development & Support Director – Office of Computer Services

32. © 2007 LexisNexis. All rights reserved. EXAMPLE IT ORGANIZATION Small Office IT Director Database Administrator File Server Administrator Email Administrator Desktop Support Backup Administrator

33. © 2007 LexisNexis. All rights reserved. Mandatory Disclosures Duty to Disclose/Duty to Investigate Rule 26(a): Initial Disclosures Must disclose early on documents and electronically stored information. Information that may be used to support claims or defenses Do not have to disclose information that you do not intend to use. In re Novellus Systems, Inc. Case No. 5:06-cv-03514-RWM (N.D. Cal. Jan. 5, 2007)(not for publication).

34. © 2007 LexisNexis. All rights reserved. Duty to Investigate Duty to Investigate: Phoenix Four, Inc. v. Strategic Resources Corp., 2006 US Dist. LEXIS 32211 (S.D.N.Y. May 23, 2006) 3M Innovative Properties Co. v. Tomar Electronics, Inc., 2006 U.S. Dist. Lexis 80571 (D. Minn. July 21, 2006)

35. © 2007 LexisNexis. All rights reserved. Meet and Confer Rule 26(f): Conference of the Parties Parties directed to discuss e-discovery issues during their discovery planning conference. Must discuss Issues related to the disclosure or discovery of electronically- stored information, including: Preservation of evidence Form of production Consideration of inadvertent production and potential waiver of privilege

36. © 2007 LexisNexis. All rights reserved. Meet and Confer Rule 16(b) (Scheduling Order) and Form 35 (Report of Parties Planning Meeting) Scheduling order may include provisions governing the discovery of electronically-stored information. And agreements on inadvertent production Report of parties planning meeting required by Form 35 must include proposals regarding electronic information.

37. © 2007 LexisNexis. All rights reserved. Prior to the Conference Exchange information on Electronically Stored Information (ESI) prior to the conference Network Design Types of Database Database Dictionaries Access Control List/Security Access Logs Document Retention Policy Organizational Chart for Information Systems Personnel Backup and Systems Recovery Routines Discuss scope/time frame parameters of ESI Discuss internally – ESI Coordinator for both sides Secure Litigation Hold * Adapted from District of Maryland Suggested Protocol for Discovery of Electronically Stored Information, 2007 Meet and Confer Best Practices*

38. © 2007 LexisNexis. All rights reserved. Meet and Confer Best Practices* At the Conference Nature of Information Systems & Custodians Anticipated Scope of Requests/Tiered Production Objections Form of Production, (including production in paper), how organized, bates, redacted Production and Cost of Metadata Costs and Burdens Generally/Cost – Shifting/ASP Preservation Issues/Protective Orders Discuss Claw-Back, Quick Peek Agreements or How Privileged Information May Be Handled Information Not Reasonably Accessible/Testing or Sampling Search methodologies 30(b)(6) Depositions

39. © 2007 LexisNexis. All rights reserved. Meet and Confer Best Practices* Report of the Parties (after Meet and Confer) Any areas where parties have reached agreement Any areas where parties are in disagreement and request intervention by the Court. Specify Proposed Treatment of Privileged Information, Metadata & Proposed Order Regarding Privilege Specify Proposed Treatment of Sampling or Testing of Data if Appropriate Set out Protocol and Conditions for on-Site Inspections of Electronically Stored Information Under Rule 34 Proposed Preservation Order Any agreements regarding the need for Experts

40. © 2007 LexisNexis. All rights reserved. Meet and Confer Best Practices* Who Should Attend: Lead Counsel Representative of the Parties Who May Attend ESI Coordinator Forensic Experts Third Parties Served with Subpoena In House IT/Litigation Support

41. © 2007 LexisNexis. All rights reserved. Inadvertent Waiver of Privilege Rule 26(b)(5) and Rule 45(d)(2)(B): Quick Peek Agreements Claw Back Agreements Hopson v. Mayor, 2005 U.S. Dist. LEXIS 29882 (D.Md. Nov. 22, 2005). Judge Grimm discusses problems with privilege waiver in review of electronic records/costs Quick Peek and Claw-back Agreements v. Full Privilege Review Proposed Rules and Substantive Law Third Party Waiver Proposed FRE 502 Williams v. Taser, 2007 U.S. Dist. LEXIS 40280 (N.D.Ga. June 4, 2007)

42. © 2007 LexisNexis. All rights reserved. Form of Production Rule 34 and Rule 45: If document request or subpoena does not specify the form for producing electronically-stored information (and absent other agreement by the parties), the responding party must produce in the form in which it: Ordinarily maintains the information or Form or forms that are reasonably usable Electronic information need only be produced in one form.

43. © 2007 LexisNexis. All rights reserved. Form of Production - Metadata 2005: Williams v. Sprint/United Mgmt. Co. 2005 U.S. Dist. LEXIS 21966 (D. Kan. 2005) General presumption in favor of production of metadata 2006: Kentucky Speedway v. Natl Assn of Stock Car Auto Racing, Inc., 2006 U.S. Dist. LEXIS 92028 (E.D. Ken. Dec. 18, 2006) General presumption against the production of metadata

44. © 2007 LexisNexis. All rights reserved. Safe Harbor Provision Rule 37(f): Safe harbor provision provides: Absent exceptional circumstances (judges discretion) Court may not impose sanctions under rules If party fails to provide electronically stored information lost as a result of the routine, good faith operation of an electronic information system.

45. © 2007 LexisNexis. All rights reserved. Sanctions Or perhaps more importantly, avoiding them.

46. © 2007 LexisNexis. All rights reserved. Sanctions Typically for lack of preservation Also fact-specific Wachtel v. Health Net, Inc., 2006 US Dist. LEXIS 88563 (D. N.J. Dec. 6, 2006)(not for publication). one of the wors[t] cases of litigation abuse, deemed the facts of spoliation and willful conduct admitted precluded evidence ordered monetary sanctions and the appointment of a discovery monitor outside counsel was also found to have engaged in sanctionable conduct

47. © 2007 LexisNexis. All rights reserved. Type of Sanctions Sanction Powers Courts Inherent Powers Rule 37 State law Some Types of Sanctions Dismissal Adverse Inference Instruction Monetary sanctions

48. © 2007 LexisNexis. All rights reserved. Dismissal Dismissal as a Sanction: (a)Willfulness or bad faith of the noncompliant party (b) History, if any, of noncompliance (c)Effectiveness of lesser sanctions (d)Whether non-compliant party had been warned about sanctions (e)Clients complicity (f)Prejudice to moving party -Metropolitan Opera Assn, Inc. v. Local 100, 212 F.R.D. 178 (S.D.N.Y. 2003)

49. © 2007 LexisNexis. All rights reserved. Sanctions Default Judgment: Quintus Corp. v. Avaya, Inc. (In re Quintus Corp.), 2006 Bankr. LEXIS 2912 (Bankr. D. Del. Oct. 27, 2006) Destruction of evidence deliberate and prejudicial Judgment in the amount of $1.8 million Krumwiede v. Brighton Associates, LLC, 2006 U.S. Dist. Lexis 31669 (N.D. Ill. May 6, 2006) Failure to put in legal hold Default judgment for spoliation Dismissal & Monetary Sanctions: Leon v. IDX Systems Corp., 2006 U.S. App. LEXIS 23820 (9th Cir. Sept. 20, 2006) Affirming monetary sanction of $65,000 Burkybile v. Mitsubishi Motors Corp., 2006 U.S. Dist. LEXIS 84864 (N.D. Ill. Oct. 17, 2006) Monetary sanction more appropriate than default judgment.

50. © 2007 LexisNexis. All rights reserved. Adverse Inference Instruction Party seeking adverse inference instruction for destruction or late production of evidence must show: (i)Obligation to preserve or timely produce (ii)Culpable state of mind (iii)Evidence is relevant to the partys claim or defense. In 2 nd Circuit, culpable state of mind can be satisfied by a showing of ordinary negligence.

51. © 2007 LexisNexis. All rights reserved. Sanctions Adverse Inference Instruction Granted In re NTL, Inc. Sec. Litig., 2007 U.S. Dist. LEXIS 9110 (S.D.N.Y. Jan. 30, 2007) 3M Innovative Properties Co. v. Tomar Electronics, Inc., 2006 U.S. Dist. Lexis 80571 (D. Minn. July 21, 2006) In re Napster, 2006 US Dist. LEXIS 79508 (N.D. Cal. Oct. 25, 2006) Shaffer v. ACS Govt Services, 2006 U.S. Dist. LEXIS 73148 (D. Md. Sept. 30, 2006) Optowave Co. v. Nikitin, 2006 U.S. Dist. LEXIS 81345 (M.D. Fla. Nov. 7, 2006) Louis Vuitton Malletier v. Dooney & Bourke, Inc., 2006 U.S. Dist. LEXIS 87096 (S.D.N.Y. Nov. 30, 2006)

52. © 2007 LexisNexis. All rights reserved. Sanctions Adverse Inference Instruction Not Granted Reino de Espana v. American Bureau of Shipping, 2007 U.S. Dist. LEXIS 41498 (S.D.N.Y June 6, 2007) Consolidated Aluminum Corp. v. Alcoa, Inc., 2006 U.S. Dist. LEXIS 66642 at *18 (M.D. La. July 19, 2006) Austin v. City of Denver, 2006 U.S. Dist. 47451 (D. Colo. July 13, 2006)

53. © 2007 LexisNexis. All rights reserved. Safe Harbor Provision Rule 37(f): Safe harbor provision provides: Absent exceptional circumstances (judges discretion) Court may not impose sanctions under rules If party fails to provide electronically stored information lost as a result of the routine, good faith operation of an electronic information system. Two cases directly discussing Safe Harbor Provision (Rule 37): Disability Rights Counsel of Greater Washington v. WMTA, 2007 U.S. Dist. LEXIS 39605 (June 1, 2007) In re: Gary E. Krause, 2007 Bankr. LEXIS 1937 (U.S. Bankr. KS June 4, 2007)

54. © 2007 LexisNexis. All rights reserved. Data Collection and Chain of Custody Making Your Job Easier From The Start

55. © 2007 LexisNexis. All rights reserved. Computer Evidence is VERY PERISHABLE! Can be created, altered, stored, copied, and moved with ease Can be changed during evidence collection Computer evidence must pass traditional admissibility tests Computer Evidence

56. © 2007 LexisNexis. All rights reserved. Data Collection Questions Collection Methodology: Chain of Custody Issues How are you collecting the relevant data? What software are you using? Are you following the same process consistently across all custodians and media forms? What type of media are you storing your collected data to? Where is this media stored? Who has access to it? Are you collecting data mindful of meta data and source location information?

57. © 2007 LexisNexis. All rights reserved. Evidentiary Issues Lorraine v. Markel American Ins. Co., PWG-06-1893 (D. Md May 4, 2007) After discovery, both parties moved for summary judgment to enforce a private arbitrators award that certain damage to plaintiffs yacht was caused by lightening. Defendant sought to uphold the arbitrators decision limiting the extent of plaintiffs damages. Plaintiff argued the arbitrator had exceeded his authority by limiting those damages. In denying both motions, the court held that emails attached to both motions and offered as parol evidence were inadmissible due to parties failure to lay the appropriate evidentiary foundation.

58. © 2007 LexisNexis. All rights reserved. Evidentiary Issues Lorraine v. Markel American Ins. Co., PWG-06-1893 (D. Md May 4, 2007) (cont) The court held that whenever electronic documents are offered as evidence, the party proffering the electronic information must consider the following: whether the electronic evidence is relevant (Rule 501); the authenticity of the information (Rule 901(a)); whether the information is hearsay, including relevant expectation, if the document is offered for its substantive truth (Rule 801); the original writing rule (Rules 1001–1008); and whether the probative value of the document is substantially outweighed by the danger of unfair prejudice or other considerations (Rule 403).

59. © 2007 LexisNexis. All rights reserved. Chain Of Custody Evidentiary integrity If appropriate, use forensically sound tools and procedures Do not alter data or meta data Preserve the evidence Chain of custody Confirms that evidence was not altered Follows the evidence during the entire data gathering lifecycle Describes who handled the evidence and why Must be kept and available for review

60. © 2007 LexisNexis. All rights reserved. Chain of Custody There is a 2-prong attack with regards to chain of custody issues What is your process? Did you follow your process?

61. © 2007 LexisNexis. All rights reserved. Chain Of Custody What is your process? How do you thwart this attack? Establish a standard operating procedure. Do the exact same thing each time. Establish a clearly delineated workflow Who does what? Assign evidence handling responsibilities only to certain limited evidence custodians. Use court challenged industry standard tools and procedures. ** Use a checklist designed for evidence seizure.**

62. © 2007 LexisNexis. All rights reserved. Chain of Custody Should Include Date and time of collection or receipt Physical inspection of media Damaged Write-protected Procedures used Tools used Person conducting procedures Outcome of procedures Problems encountered Date and time of check-in and check-out of media from secure storage Media specific information Media type, standard, manufacturer Serial numbers or volume names Writing on labels Characterize data

63. © 2007 LexisNexis. All rights reserved. Questions? bud.conner@applieddiscovery.com