Digital Forensics & eDiscovery Overview prepared for Charlotte ARMA Chapter September 20, 2007 Copyright © 2007 Document Technologies, Inc.

DTI | Discovery Solutions | Confidential 2 The Post 12/1/06 World New Federal rules governing discovery and production codified existing case law and changed the face of ‘document discovery’ Shortened timeline for planning, discovery and production Significantly impacted ESI collection, processing, review and production Confirmed expansion of the scope of discovery and, consequently, reinforced significance of developing and adhering to comprehensive corporate record retention policies

DTI | Discovery Solutions | Confidential 3 Sources of Electronic Data

DTI | Discovery Solutions | Confidential 4 New Sources of ESI IM VOIP MP3 Storage Devices (iPods) Memory sticks and flash drives Global positioning systems Blogs

DTI | Discovery Solutions | Confidential 5 EDD Page Counts 1 Megabyte (MB) will average around 75 pages 1 Gigabyte (GB) will average around 75,000 pages 1 Terabyte (TB) will average around 75,000,000 pages average 1-2 pages per each Word Processing Fileaverage 5-8 pages per each Spreadsheetsaverage pages per each Presentationaverage pages per each Graphicaverage 1 page per each Adobe PDF Fileaverage 35 pages per each Diskette 1.44 MBif full pgs Zip Disk 100 MB or 250 MBif full 7,500-18,750 pgs CD640 MB MB if full 48,000-64,000 pgs DVD4.7 GB - 17 GBif full 350, million Tape Drive 2 GB GBif full 150, million Hard Drive 20 GB and overif full 1.5 million and up

DTI | Discovery Solutions | Confidential 6 Treat an attorney review like a production process –Predict cost & time –Cost of attorney review is always more than document processing costs Have forensically defensible processes in place Rolling deliverables of data from vendor Linear review vs. Non-Linear Review EDD Workflow Best Practices

DTI | Discovery Solutions | Confidential 7 Think of document review… as a manufacturing process –Require progress reporting and production statistics How many documents per hour reviewed? How long will it take to complete? Which attorneys are reviewing above average rates? –Manage audit and quality control processes

DTI | Discovery Solutions | Confidential 8 Adoption of the long-awaited federal rule changes Managing parent-child relationships Clarification on the role of metadata in litigation Communicating effectively with opposing parties Proper evidence handling procedures Processing volume is increasing 2007 EDD Trends

DTI | Discovery Solutions | Confidential 9 Save Time and Money –De-Duplication Reduces File Review Time –Obtain Full Data Fields Without Coding Expense –100% Accurate Text –Rapid Filtering and Searching –Produce and Share Tremendous Volumes of Information Quickly Learn More –Extensive Meta-Data –Uncover Hidden Data and Comments –Show Tracked Changes Find Critical Information Early and Make Better Strategic Decisions EDD Advantages

DTI | Discovery Solutions | Confidential 10 Small Convert all TIFF for blowback TIFF and data for online review Large Consulting and collection Multiple locations for acquiring data National, multi-party review Thorough plan in place long before we see any data Medium Multi-pass review Data only with native files Hosting Searching / filtering, production sets, etc. Data Processing Scenarios

DTI | Discovery Solutions | Confidential 11 1.Prevent Spoliation 2.Formulate Discovery Plan 3.Limit Scope of Discovery Request 4.Seek Cost Shifting 5.Collect Documents 6.Process Documents 7.Review Documents 8.Produce Documents Responding to EDD Requests

DTI | Discovery Solutions | Confidential 12 Develop a discovery response plan and standard spoliation letters to opposing party and to client in advance Implement spoliation plan upon occurrence or anticipation of litigation (suspend backup recycling and archive deletion, etc.) Make all parties aware of possible sanctions –Penalties –Adverse inferences –Preclusion from arguing issues 1. Prevent Spoliation

DTI | Discovery Solutions | Confidential 13 Evaluate universe of media Monitor and enhance spoliation prevention measures Determine method of review Determine production format Select parties to assist with process Establish schedule for production process 2. Formulate a Discovery Plan

DTI | Discovery Solutions | Confidential 14 Determine whether argument can be made that request is overbroad Determine whether argument can be made that request is unduly burdensome Suggest narrower/less burdensome alternative or alternatives to request Negotiate search protocol 3. Limit Scope of Production Request

DTI | Discovery Solutions | Confidential 15 Analyze facts based on relevant case law –Rowe, UBS, Sedona Principles Availability from other resources Total cost vs. total at stake Resources of the parties Ability of and incentives for the parties to control costs Relative potential benefits Move for shift/share to requesting party Argue in the alternative for narrowing the request 4. Request Cost Shifting/Sharing

DTI | Discovery Solutions | Confidential 16 Begin early Consider all relevant media & don’t forget the hard copy documents Maintain chain of custody and record of recovery procedures Never Conduct a “Home-Made” Review –Why approach electronic files differently than hard copies –Potential conflicts of interest –Lack of consistency or understanding of process –Risk of damage to data or documents –Don’t give opposing counsel a reason to put them on the stand –You don’t want to lose the case over this process 5. Collect Responsive Data / Documents

DTI | Discovery Solutions | Confidential 17 Use litigation specific conversion software De-duplicate files Extract hidden information Cull Results by date and search terms Create combined database of hard copy and e-files for more powerful review Consider manual coding or auto-coding of paper document, particularly if present in volume 6. Process Electronic & Paper Documents

DTI | Discovery Solutions | Confidential 18 Never work with original electronic document Use litigation-specific software to review –Ability to efficiently view native documents –Ability to easily tag issues, relevancy –Ability to redact privileged and confidential information –Ability to annotate important documents –Ability to share access with co-counsel Methodically track “review production” Electronically bates number production sets, not necessarily originals 7. Review Data and Documents

DTI | Discovery Solutions | Confidential Produce Data and Documents Produce in the appropriate format –Closely monitor production to avoid unintended disclosure of meta-data –TIFF or PDF images are preferable –Avoid producing native documents unless it provides a substantial economic benefit Produce in timely manner Maintain comprehensive production history –What was produced, to whom and in response to what

DTI | Discovery Solutions | Confidential 20 Identify all potential data sources within the organization Issue notice to all appropriate employees to preserve all documents, including , relating to the matter after consulting with counsel on scope of litigation hold communications Identify someone to locate and gather the data in a manner that is forensically defensible! Inventory the resulting media and maintain chain-of-custody documentation Restore the data from backup media only after consulting counsel Convert, dedupe and cull the data prior to release for relevancy review by counsel Load the resulting data to a system specifically tailored for litigation-related document reviews ESI Collection Checklist

DTI | Discovery Solutions | Confidential 21 1.Failing to Have a Data Collection Plan 2.Failing to Prioritize the Data 3.Neglecting to Conduct Thorough Interviews 4.Ignoring Key Data Locations & Important File Types 5.Conducting Do-It-Yourself Data Collection 6.Performing Ad Hoc Desk- side Collection 7.Failing to Mirror Image v. Imaging Excessively 8.Limiting Names 9.Assuming IT Can Manage on Their Own 10.Failing to Maintain Proper Chain of Custody TOP 10 DATA COLLECTION PITFALLS

DTI | Discovery Solutions | Confidential 22 Morgan Stanley Case –“Failure to produce all attachments was negligent” –Discovered & revealed by 3rd party vendor –Led to jury awarding plaintiff over $1.45 billion Attachment handling procedures subject to increasing scrutiny Dynamic links between host and attachments vital to effective document review and production Dealing with Attachments to

DTI | Discovery Solutions | Confidential 23 You cannot impose the paper practices on the ESI Redactions can’t be done to e-data except via images (TIFFs, PDFs) Document production are much more complicated with ESI-sourced documents. Plan, test and verify agreed upon production methodology Best Practice Tip: Rolling deliverables to manage the volume Paper Versus Electronic Documents

DTI | Discovery Solutions | Confidential 24 eDiscovery Response Team

DTI | Discovery Solutions | Confidential 25 eDiscovery Workflow Plan - simplified

DTI | Discovery Solutions | Confidential 26 In Conclusion… Stick to your discovery response plan but be flexible –Maximize planning and assessment –Consider variety of options –Apply proportionality assessment Continuing education –Track current technology trends –Stay on top of legal developments Utilize technology and resources effectively –In-house resources (IT, legal staff, etc.) –Vendors

DTI | Discovery Solutions | Confidential 27 Courts are not afraid and, in fact, increasingly prone, to hold companies accountable for deficient discovery practices Courts consider electronic data a part of mainstream discovery & are unwilling to tolerate destruction of relevant information Counsel, organizations & individuals must take affirmative steps to prevent intentional and negligent spoliation Spoliation as a result of document mismanagement is now seldom, if ever, excused And Remember ….