1. When Is Full Blown Forensics Necessary? John Rosenthal, Esq. Partner, Winston Strawn DC Office Chris H. Paskach Partner KPMG LLP Patrick Oot, Esq Vice President and General Counsel The eDiscovery Institute Fort Lauderdale, FL Tom Morrissey - Moderator Sr. Director, IT Litigation Purdue Pharma LP

2. DISCLAIMER THE VIEWS EXPRESSED HERE ARE OF THE INDIVIDUAL SPEAKERS AND NOT NECESSARILY THE VIEWS OF THE COMPANIES THEY WORK FOR.

3. Define : Forensics Webster’s Dictionary "The application of scientific knowledge to legal problems; especially: scientific analysis of physical evidence (as from a crime scene)" The Sedona Conference has the following definition of forensics: “The scientific examination and analysis of data held on, or retrieved from, ESI in such a way that the information can be used as evidence in a court of law. It may include the secure collection of computer data; the examination of suspect data to determine details such as origin and content; the presentation of computer based information to courts of law; and the application of a country’s laws to computer practice. Forensics may involve recreating “deleted” or missing files from hard drives, validating dates and logged in authors/editors of documents, and certifying key elements of documents and/or hardware for legal purposes.”

4. QUESTIONS FOR PANEL 1.Is that an accurate definition of Forensics? 2.What is in scope and what can/should be collected ‘forensically’ 3.When to consider a forensic collection and what are we NOT talking about? 4.What are the tools of the trade? 5.What is the trigger/determining factor to use a forensic collection process ?

5. QUESTIONS FOR PANEL 6.How do we choose a balanced approach? 7.What level of capture do we want/need? 8.What does a bit-by-bit copy of a hard drive mean for us? 9.What other issues are involved? 10.Other considerations?