I was having a conversation with a close friend of mine the other day who also happens to be in the E-Discovery industry. We got to talking about how to treat document families for the various stages of processing, review and production. That conversation got me thinking that while most vendors and E-Discovery attorneys treat this as basic knowledge, if you don’t practice in this area, you may not know the correct terminology, or what you should insist upon with your vendors. I decided I would write about the various stages of the E-Discovery lifecycle and how you should treat document families as you move through them.

For this first blog post, I am going to define the basic document family relationships and discuss standard industry treatment. In my next post, I’ll go into specific issues that can arise in the different stages of the E-Discovery life cycle. At the end of the two part blogging, when you are presented with these questions, my hope is that this post will help you to speak intelligently on the subject and make an informed decision about how you should proceed.

Let’s start with the basics; a document family can be created in multiple ways:

1. E-MAIL FILES
Email data is usually transferred in a container format; emails are exported from their native program to a pst, ost, or nsf file. This methodology preserves the metadata associated with the individual email files. Once data is extracted from email archives, an email and any attachment thereto are treated as separate records, but are linked as a document family the BeginAttach and EndAttach field.

Industry standards dictate that this recognized family should not be broken apart without a compelling reason presented by counsel, and even then the entire family should be produced, but specific documents can be place-holdered with a legal reason describing why it was withheld (ie: Privileged, Confidential Business Information, etc).

2. OTHER CONTAINERS FILES
A method of transport for loose documents (ie: non-email data), is to zip up the loose files into a container of some sort. This also preserves the metadata in the same way that an email archive does. If your dataset contains archives that are not email archives files and are not otherwise attached to an email, most processing tools will treat the extracted contents of the archive (ie: the documents that reside in the archive file) as a document family, and those documents will be linked using the same fields noted above. It is important to note that there is a difference of opinion within the industry as to whether or not the family relationships created by the processing tools for non-email archive or container files are legitimate document families.

Some people treat the extracted contents as truly all being interconnected or related in some way. Others, like myself, tend to view the extracted contents of a non-email archive as being nothing more than documents that resided in a folder (albeit, a compressed folder) together. The logic is that you wouldn’t treat all documents in a folder as being related for document family purposes, so why would you do that for a compressed folder?

3. COMPOUND DOCUMENTS
If your dataset contains files such as a PowerPoint presentation that have excel, word, or other PowerPoint files that were added to the source file, most processing tools allow you to extract out the files into their own records. If you select this option, the tool will create a family relationship amongst the extracted and source file using the same linking field identified in the Email Files section. This is often referred to as compound document extraction.

As a general note, the industry has been moving away from this process for a couple of reasons.

First, all of the content that made the parent document responsive or not responsive can be found in the parent document, so extracting the additional files does nothing to add to the decision making process.

Second, there are now tools that will identify in most document types (office files, for example) if the source file has said added files to it. As a result, this can be called out to the reviewer in a read only field visible when the reviewer is looking at the document, and the reviewer can then inspect the extracted text to ensure that only the text appearing in the source document is being produced should that document be marked for production.

Third, most industry people I talk to see this as problematic from a review standpoint, not just because it adds documents for the reviewers to go through, but it also raises hosting and production costs on the back end.

4. EMBEDDED OBJECTS
Have you ever seen an email with one of those little image files down at the bottom associated with someone’s title block? That is the best example of an embedded object. Essentially an embedded object is usually some image that has been copied/pasted into a document. Most processing tools allow you to extract those embedded objects into their own files. When this option is selected, the tool will create a family relationship amongst the source file and the files that were extracted out of the source file using the same linking field identified in the Email Files section. Again, this is something the industry is moving away from for the same reasons outlined in the compound document section.

That covers the most common document family relationships. Next time, I will discuss how you should treat those various families and potential pitfalls and caveats in the various stages of the E-Discovery life cycle.

On July 29, 2011, the Board of Governors of the Florida Bar voted to adopt changes to the Florida Rules of Civil Procedure relating to e-discovery that would largely mirror the 2006 amendments to the Federal Rules.  On March 7, 2012, the Florida Supreme Court heard testimony about those amendments.  Kevin Johnson, a lawyer in private practice who spoke on behalf of the Florida Bar Civil Procedure Rules Committee, stated that the proposed amendments are the culmination of a 5-year process that began with the adoption in 2006 of the Federal Rules amendments. A subcommittee of the Florida bar studied the effects of the federal and other states’ rules, and obtained feedback from judges, other bar committees, and e-discovery experts. The justices are expected to adopt the proposed amendments this summer.

The Amendments in Brief

• Rule 1.200 now specifically refers to electronically stored information (ESI) and encourages early discussion of ESI, but does not require the meet-and-confer conference found in FRCP 26(f).  Notably, three of the state’s largest circuit courts—those in Miami, Orlando and Tampa—require early conferences, as does a rule applicable to complex cases. Thus, the drafters of the amendment believed that early conferences will take place in the cases where they are most needed. In addition, the comments to the rules encourage the parties to have early discussions about ESI.

• Rule 1.280 allows discovery of ESI, adopts the federal “proportionality test” and permits parties to object based on undue burden and cost, but allows courts to order the discovery upon a showing of need. Cost-shifting may be ordered.  The notes to Rule 1.280 encourage judges to consider ordering focused discovery concerning parties’ IT environment, including sampling of sources, if it appears that counsel have insufficient familiarity with potential sources of ESI.

• Rule 1.350 allows the requesting party to specify the form of production of ESI.  This provision follows the federal model of allowing a party to request production as documents were originally maintained or in a reasonably usable form. Within each category, various formats can be requested.

• Rule 1.380 includes a safe harbor provision, which protects parties that have deleted information through the ordinary course of business as long as the party was not aware of a need to preserve at the time of the deletion.

Questions Posed by the Florida Supreme Court

The justices must now decide whether to adopt these amendments. Their questions reflected concerns about e-discovery and a hope that the proposed rules will help trial court judges and lawyers.

• Justice Barbara J. Pariente, a former trial lawyer, asked whether the amendments will make discovery easier or more difficult. She posed an example of product liability cases she handled early in her career in which a plaintiff might ask for all complaints relating to a product, necessitating the search of a warehouse filled with paper. In that event, lawyers for the company would argue that production would be unduly burdensome. What happens today? Is all of that information digitized? Is it burdensome to produce? It may be, said Mr. Johnson, but if parties achieve agreement on how to search, they can streamline the gathering of large quantities of ESI.

• Justice James Perry asked whether the proposed rules, and the need for them occasioned by the explosion of electronic discovery, boils down to which party has the best expert. Only an expert is knowledgeable enough to know what to ask for, because if a party asks for the wrong ESI, they won’t get what they wanted. This question reflected a theme of the hearing regarding the need for education for judges and lawyers to help them understand their clients’ electronic systems so they can manage the identification and production of ESI.

• Justice Fred Lewis asked how the rules will affect the trial court judges. Will the rules help judges referee the “silly battles” they often face? Mr. Johnson replied that trial court judges should now have more tools and greater flexibility to correct abuse; in addition to the rules, guidance is provided in the comments.

Counterproposals by the Defense Bar

J. Richard Caldwell, speaking for the Florida Defense Lawyers Association and the Lawyers for Civil Justice, identified three proposed provisions that do not go far enough.

• First, cost shifting should be mandatory for burdensome productions, not permissive. He said that lawyers and judges tend to think of the discovery paradigm as a David vs. Goliath situation, with the large organization bearing the burden of production; however, a “mom and pop” business can store a large quantity of data on their iPhone and laptop, which would cause considerable burden to produce.

• Second, Mr. Caldwell also believed that the provision limiting production of ESI that is “not reasonably accessible” should contain an enumerated list of identified sources that need not be produced.

• Finally, severe sanctions should be limited to situations involving willful misconduct and real prejudice.

Mr. Caldwell also pointed out that although the proposed amendments track the Federal Rules, those rules should not be the standard; it is widely believed that the federal rules are no “model of fairness and efficiency.” Commentators such as the Sedona Conference have argued that the federal system is not working. Additional amendments to the federal rules have been advocated and are being considered.

Judge Andrew L. Carter (U.S.D.C., S.D.N.Y) issued an order adopting the rulings of Magistrate Judge Andrew J. Peck in Da Silva Moore et al v. Publicis Groupe SA and MSL Group, Case 1:11-cv-01279-ALC-AJP (Filed 04/26/12).

We see this development as yet one more judicial decision that carefully examines the means by which the reliability of the discovery process can be measured. While predictive coding and other means of technology-assisted review are undoubtedly given a boost in this opinion, the process by which ediscovery may be evaluated for compliance or deficiency is the clear winner here.

Judge Carter discussed the standard of review for non-dispositive matters concerning discovery and the deference that must be given to the magistrate judge on the scene.

“Mindful of this highly deferential standard of review, the Court adopts Judge Peck’s rulings because they are well reasoned and they consider the potential advantages and pitfalls of the predictive coding software.”

Regardless of the disagreements of the parties or of the parties with the magistrate over whether predictive coding had been agreed upon, he said,

“…the confusion is immaterial because the ESI protocol contains standards for measuring the reliability of the process and the protocol builds in levels of participation by Plaintiffs. It provides that the search methods will be carefully crafted and tested for quality assurance, with Plaintiffs participating in their implementation. For example, Plaintiffs’ counsel may provide keywords and review the documents and the issue coding before the production is made. If there is a concern with the relevance of the culled documents, the parties may raise the issue before Judge Peck before the final production. Further, upon the receipt of the production, if Plaintiffs determine that they are missing relevant documents, they may revisit the issue of whether the software is the best method. At this stage, there is insufficient evidence to conclude that the use of the predictive coding software will deny Plaintiffs access to liberal discovery.

“Plaintiffs’ arguments concerning the reliability of the method are also premature. It is difficult to ascertain that the predictive software is less reliable than the traditional keyword search. Experts were present during the February 8 conference and Judge Peck heard from these experts. The lack of a formal evidentiary hearing at the conference is a minor issue because if the method appears unreliable as the litigation continues and the parties continue to dispute its effectiveness, the Magistrate Judge may then conduct an evidentiary hearing. Judge Peck is in the best position to determine when and if an evidentiary hearing is required and the exercise of his discretion is not contrary to law. Judge Peck has ruled that if the predictive coding software is flawed or if Plaintiffs are not receiving the types of documents that should be produced, the parties are allowed to reconsider their methods and raise their concerns with the Magistrate Judge. The Court understands that the majority of documentary evidence has to be produced by MSL Group and that Plaintiffs do not have many documents of their own. If the method provided in the protocol does not work or if the sample size is indeed too small to properly apply the technology, the Court will not preclude Plaintiffs from receiving relevant information, but to call the method unreliable at this stage is speculative.

“There simply is no review tool that guarantees perfection. The parties and Judge Peck have acknowledged that there are risks inherent in any method of reviewing electronic documents. Manual review with keyword searches is costly, though appropriate in certain situations. However, even if all parties here were willing to entertain the notion of manually reviewing the documents, such review is prone to human error and marred with inconsistencies from the various attorneys’ determination of whether a document is responsive. Judge Peck concluded that under the circumstances of this particular case, the use of the predictive coding software as specified in the ESI protocol is more appropriate than keyword searching. The Court does not find a basis to hold that his conclusion is clearly erroneous or contrary to law. Thus, Judge Peck’s orders are adopted and Plaintiffs’ objections are denied.”

As a service provider working with both requesting and responding parties, we are encouraged by language that stresses the criticality of method and metrics in the discovery process. What is important here is not so much the choice of tools or software, but that “…the ESI protocol contains standards for measuring the reliability of the process…” and “…methods will be carefully crafted and tested for quality assurance…”

A few weeks ago, Maureen Holland issued an impassioned report from the trenches about the all-too-common practice of lawyers using their Outlook accounts to review client e-mails.   Not surprisingly, there are important reasons why this practice does not comport with Fed. R.Civ.P. 34.

To set the stage, here’s a short quiz.

True or false: A party must produce documents and ESI as they are “maintained in the ordinary course of business.”

Answer: Sort of, but there’s more to it than that.

Federal Rule of Civil Procedure 34 contains a trap for the unwary, which I call the “form vs. manner” distinction—that is, there are really two requirements which sound very similar, but they’re not identical.

The rule says:

34(b)(2)(E) Producing the Documents or Electronically Stored Information. ….

(i) A party must produce documents as they are kept in the usual course of business or must organize and label them to correspond to the categories in the request; (emphasis added)

(ii) If a request does not specify a form for producing electronically stored information, a party must produce it in a form or forms in which it is ordinarily maintained or in a reasonably usable form or forms; (emphasis added) ….

Reading sub-parts (i) and (ii) quickly, you may wonder why Congress chose to include both provisions, because they sound very similar. Therein lies the “form vs. manner” distinction.

Manner of Production

Subpart (i) addresses what I call the “manner of production,” and can best be explained by what it is intended to prevent. Picture an old-fashioned paper production that a party has thrown down the stairs, scooped up and handed to the receiving party. A challenge to this manner of production would be successful. A producing party bears the burden of showing where the documents originated, such as a filing cabinet in Joe Executive’s office or a common file room. In the days of all-paper productions, producing parties replicated folders, Bates-numbered them and produced the replicated folder containing responsive documents.

The modern-day equivalent of throwing the paper down the stairs is the case of a party producing a single PDF that contains thousands of documents with no identifying or organizing information. In Pass & Seymour, Inc. v. Hubbell Inc., 255 F.R.D. 331 (N.D.N.Y. 2008), a party produced 405,367 pages of nonsearchable documents, divided among 202 unlabeled folders. Some of the documents were scanned paper and some were ESI reduced to nonsearchable PDFs. No custodian, source, file/path, or other organizing information accompanied the production. The court required the producing party to provide information sufficient to identify how the documents were “kept in the usual course of business.” “Sufficient” means more than simply identifying the custodian, consistent with the Advisory Committee Note to Rule 34, whose goal is the avoidance of unnecessary obstacles for the requesting party. In sum, producing ESI as the party usually maintains it or as per the numbered document requests describes the manner of production.

Form of Production

Subpart (ii) requires the production of ESI “as it is ordinarily maintained or in a reasonably usable form.” This is not a reference to file and path information custodian, or other originating information. This language refers to the actual format in which the documents are produced, such as paper, native, PDF or TIFF. Importantly, the Advisory Committee Note makes clear that a party cannot “degrade searchability” in the production of ESI. Thus, in producing non-searchable PDFs in 202 unlabeled folders, the producing party in Pass & Seymour ran afoul of both Fed. R. Civ. P. 34(b)(2)(e)(i) and (ii) with objectionable manner and form of production.

Conclusion

This brings us back to Maureen’s opposition to using Outlook as a review tool. Are e-mails produced from the lawyer’s Outlook account delivered in a proper form? Likely not. Although they may be produced as agreed-upon TIFFs with certain metadata and a load file, they must be doctored prior to production to remove the metadata and parts of the image which show that they passed through a lawyer’s account. Likewise, e-mails produced from a lawyer’s e-mail account are not delivered in an appropriate manner because EITHER the identified source of the e-mail is the lawyer and not the client custodian, OR that information is suppressed, in which case no source information is produced at all.

Sedona, Arizona is a special town. Harmony, convergence, tranquility are all attributes one associates with this place. The scenery, energy and people make this the perfect place to meet and discuss the future of eDiscovery. This week, the Sedona Conference® RFP+ Vendor Panel meets to look at the current state of the industry and through dialogue, industry leaders brainstorm on what they see on the horizon for the next five years. We also discuss ideas on what needs to be done in the industry to increase eDiscovery acumen for the practitioner from various viewpoints.

The overall goal of the RFP+ Vendor Panel is a well-informed marketplace that speaks the same language and will ultimately lead to reduced costs for all parties, higher quality, and greater predictability.

D4 has been participating with this group for a few years and I, myself am excited to be here for the second time. This group is indeed a “who’s who” in this space. Collectively, we’ve agreed to speak our minds when we meet, but the final output will be a collective conscience of what was discussed. I will post a recap once I return from this eDiscovery haven.

ABOUT THE SEDONA CONFERENCE

The Sedona Conference® exists to allow leading jurists, lawyers, experts, academics and others, at the cutting edge of issues in the area of antitrust law, complex litigation, and intellectual property rights, to come together – in conferences and mini-think tanks (Working Groups) – and engage in true dialogue, not debate, all in an effort to move the law forward in a reasoned and just way.

The organization’s hallmark is its unique use of the dialogue process to reach levels of understanding and insight not otherwise achievable. The Sedona Conference® Working Group Series is designed to focus the dialogue on forward-looking principles, best practices and guidelines in specific areas of the law that may have a dearth of guidance or are otherwise at a “tipping point.” The goal is that the Working Groups, the open Working Group Membership Program, and peer review process, will produce output that is balanced, authoritative, and of immediate benefit to the Bench, Bar and general public.

This past weekend I had the pleasure of heading down to my local Apple Store for a Genius Bar appointment to deal with my non-functioning iPhone. While sitting there, I overheard one of the resident “Geniuses” discussing restoration of an old damaged iPhone to a newer one via iCloud. The long and short of it is that this “Genius” instructed the owner of the two iPhones to turn on iCloud, allow the old damaged phone to back up to iCloud, and then use the backup of the old phone to transfer all of his data to the new phone through a restore. (If I were truly showing my roots, I’d be referring to iCloud as “the iCloud”.) Most people wouldn’t think twice about this, and in fact the gentleman (and his daughter) both seemed quite pleased that this could be done so quickly and painlessly. However, I am a bit of a freak and immediately began to think about the implications that iCloud and other Cloud Based services could have on data preservation, collection, and overall litigation strategy in cases involving electronic data.

The questions that came to mind were:

• “Where is the iCloud, and where exactly is the ‘Genius’ sending the gentleman’s data? Does the ‘Genius’ know? What about the gentleman?”
• “How long does this data reside in the cloud?”
• “Can the data be removed from the cloud? If so, how difficult is it to remove from the cloud?”
• “Do we have to collect from the cloud now too? If so, how do I get to it?”
• “A lot of companies use iPhones. Do companies let their data get backed up to iCloud? Are those companies keeping tabs on it if they do? Should that be part of their company preservation/litigation hold policy?”

So, as my brain began to crunch on those questions, it also began wandering off to other cloud-like services such as DropBox and Carbonite. The former is a place where people leave electronic data for another person to retrieve and download, much like an FTP server; the latter is a place where people place their own data for retrieval at some later point, much like a backup hard drive in the cloud. And I realized that we are very messy people and there are a lot of places we put our data these days that are not our computers.

Since that is the case, how do we, as litigators and consultants on litigation, account for the data that is stored in the cloud-based locations?

CONCLUSION
The conclusion I came to, as I sat and thought about all of these wonderful places someone could hide their data and not actually lose it, is that the cloud is like any other source of data. It is simply another source of a person’s data.

Attorneys can ask about it in interrogatories and ask for it in RFPs. As such, law firms dealing with corporations and corporations themselves must include cloud data as part of their data retention, preservation and collection policies, unless otherwise agreed to with a specific party. It might be duplicative of data you gather from a phone or individual’s computer, but you won’t know unless you look, and most judges don’t like the head in the sand (or cloud, as it may be) method of practicing law.

In my previous post, I mentioned I would provide some more resources to help answer the question, “Is Technology Assisted Review (TAR) defensible?”.

Determining whether a review method is defensible (or, for that matter, any other action you take in your case), is, and has always been, a function of organization, iteration, sampling and documentation. However, as lawyers and e-discovery experts work to develop strong methods and clear documentation around TAR , there has been a lingering worry that something in that black box is going to blow up and damage your case.

Here are some links to articles and court rulings that should help put you at ease:

•“Overall, the myth that exhaustive manual review is the most effective – and therefore, the most defensible – approach to document review is strongly refuted. Technology-assisted review can (and does) yield more accurate results than exhaustive manual review, with much lower effort.”

Maura R. Grossman & Gordon V. Cormack, Technology-Assisted Review in E-Discovery Can Be More Effective and More Efficient Than Exhaustive Manual Review, Richmond J. of Law & Tech., Vol. XVII, Issue 3, 11 (2011)

•“I bring to the parties’ attention recent scholarship that argues that concept searching, as opposed to keyword searching, is more efficient and more likely to produce the most comprehensive results.”

Judge John Facciola, United States magistrate judge for the District of Columbia, in Disability Rights Council of Greater Wash. V. Wash. Metro. Transit Auth., 242 F.R.D. 139, 148 (D.D.C. 2007)

•“Although basic keyword searching techniques have been widely accepted…as sufficient to define the scope of their obligation to perform a search for responsive documents…simple keyword searching alone is inadequate in at least some discovery contexts. This is because simple keyword searches end up being both over- and under-inclusive in light of the inherent malleability and ambiguity of spoken and written English.”

Judge Paul Grimm, United States magistrate judge for the District of Columbia, in Victor Stanley, Inc. v. Creative Pipe, Inc., 250 F.R.D. 251 (D. Md. 2008)

•“Depending on the circumstances, a party that uses advanced analytical software applications and linguistic tools in screening for privilege and work product may be found to have taken “reasonable steps” to prevent inadvertent disclosure.”

Paul W. Grimm, Lisa Yurwit Bergstrom & Matthew P. Kraeuter, Federal Rule of Evidence 502: Has It Lived Up to Its Potential?, XVII RICH. J.L. & TECH. 8 (2011)

Finally, you might also remember from the last post our Sherlock Holmes-loving jurist, Judge Andrew Peck.

Well, he’s made another important statement about this question, but this time in the context of a case. In Da Silva Moore v. Publicis Groupe et. al., the parties agreed to use predictive coding, and Judge Peck ordered them to adopt a protocol —one that would allow the plaintiff to weigh in on the sufficiency of the production and allow the judge to assess whether the defendant has reached a point where further review isn’t necessary because responsive document are unlikely to exist in additional samples.

This latest development deserves a much deeper analysis (one that my colleagues and I will go into in later postings). But for now, you should hopefully be feeling a little less apprehensive.

I am still trying to recover from the phone call I received last month:

CALLER: Hi Maureen. I was wondering if you could help with something. We have a production due on Friday and I’m wondering if D4 could run it. It is mostly e-mail, which our client self-collected. We have taken care of the processing, review and imaging in-house.  Could you either walk me through producing the docs using our tools or take the docs we have and produce them for us?

ME: Ok, why don’t you walk me through your workflow and I’ll see what we can do to help you out.

CALLER: Sure – our client is trying to save money so they collected their emails and provided pst files to us. We just opened the emails in our Outlook accounts and reviewed the contents. We created folders and moved the responsive emails into them.

ME: Oh, ok, I need to think about that one. In the meantime, you mentioned that you have processed and imaged everything – what were your workflows?

CALLER: We used a processing application we found on the web. For those we couldn’t process, we just imported the native emails into our in-house litigation review tool. How would we merge all of these documents together for production?

ME: You seem to be pretty far along with the production. How are you handling the family relationships?

CALLER: Oh, that’s not too bad. We aren’t concerned about the attachments because it’s mostly the emails that are responsive. We have removed the attachments that we don’t need. So, what do I need to give you in order for D4 to run the production for us?

It’s a good thing I was sitting down while I had this conversation. I think we would all agree that I had found myself in a very delicate and sensitive situation. How do I help this client meet its court ordered production deadline, knowing that their data and workflows aren’t defensible?

I am pleased to report that the caller is still my client and they met their production deadline with defensible data. As far along as we are in the eDiscovery field in many ways, the Outlook “workflow” just described is one of many situations I have seen, in which lawyers try to take matters into their own hands with potentially disastrous results. In this situation we stepped in and did what needed to be done and the client is in a much better place because of it.

THE KEY TAKEAWAY IS THIS: Please DO NOT use Outlook to review and produce e-mails and attachments.

There are many, many reasons to heed this advice. Here are just a few:

1. Data corruption

2. Lack of ability to trace and document your data, process and workflow.

3. Opposing counsel may be tech savvy enough to start asking questions you won’t want to answer.

4. The email account used to access the data has to belong to someone and I guarantee it’s not the rightful owner/custodian of the data.

5. Metadata is likely to reflect your own personal information or the information of the email account owner.

6. Personal information from the email account used to access the data could be displayed in email headers, especially when imaging or printing messages (I have seen vendors do this quite often without realizing it; always check the top right corner of an email after imaging/printing, and definitely before producing).

7. Broken or corrupt family relationships; missing attachments.

8. Loss of accurate custodian information.

9. Loss of accurate email account folder structures.

10. Failure to produce e-mail as it was maintained in the ordinary course of business.

11. Additional costs associated with the re-work.

12. And last, but definitely not least: Outlook is not a review tool.

In Part II of this post, my colleague, Cindy Courtney, will discuss the legal principles a party runs up against when using Outlook as a review tool.

Last week, my colleague in the trenches, Maureen Holland, expressed her belief that eDiscovery has become too complex. Frankly, she is not crazy about this situation; I think it makes her head hurt. Maureen articulated three fundamental points about the need to keep eDiscovery simple: First, apply the same principles for small batches of ESI that you would for large amounts of data. Second, don’t get distracted by the technologies that are bombarding us at warp speed. Third, continuously vet your practices and workflows against emerging case law and agreed-upon best practices.

These are all excellent points and we would do well to heed them. We also need to understand that each of Maureen’s points has support in the law. That’s right—your production stands a better chance of surviving a legal challenge if you adhere to Maureen’s suggestions.

On the first point, we need go no further than Maureen’s initial example: Your client forwards discovery documents by e-mail. Those e-mails are now running through your Outlook or Lotus Notes account, and when they are processed, your account’s metadata is attached to those documents. If you are in the process of negotiating the form of production with your adversary, and you intend to produce file and path metadata, you may have to suppress that metadata for the documents that were e-mailed to you, requiring an explanation to opposing counsel about the missing metadata. At best, it’s embarrassing. Or, your adversary may insist that you re-produce those documents as they were maintained in the ordinary course of business, as required by F.R.Civ.P. 34(a)(2)(E)(i) and (ii).

On the second point, if you attended Legal Tech (or “Lethal Tech” as it is also known), you couldn’t walk 10 feet without seeing a booth advertising a technology-assisted review application that is either better at reducing costs than anything else, more defensible, more transparent, or all three. True, you don’t want to use a fly-by-night tool, but even choosing among the strongest options can be daunting. Case law is not going to help with that choice, but the early cases suggest that defensibility lies less in proving the legitimacy of the application’s algorithm than in the lawyering, sampling, transparency and documentation that the professionals apply in their use of it. See generally Da Silva Moore v. Publicis Group, 11 Civ. 1279 (S.D.N.Y. 2/24/12).

This brings me to Maureen’s third point, namely that if there is no court ruling to guide you, use established best practices, along with common sense and the experience of trained professionals. There is a robust e-discovery literature, including several sources that articulate and expound upon best practices. I will share just one “must read” with you. We all know about The Sedona Conference®, a think tank that issues best practices and (free) white papers on several topics pertaining to complex litigation, the most famous of which is the preservation and production of electronically stored information.

Recently, I had occasion to request production of information from a massive database. I made liberal use of The Sedona Conference® Database Principles, published in April 2011. Not only do these principles provide a clear road map for parties to arrive at, agree upon, extract and produce database information, but the prestige of The Sedona Conference® and judges’ reliance on its pronouncements helped me convince the producing party to agree to my proposal.

Read Part I: eDiscovery 101 – Back to the Basics, written by my colleague, Maureen Holland.

I recently received a request from a client to run key terms on a hard drive image and export the “hits”.  Sounds easy enough, however, they also wanted to export the “hits” from slack, deleted, and unallocated space. To complicate matters this was a court ordered search and the directions from the Court included searching deleted space and exporting the “hits”.   Again, may sound easy, but this is when I think to myself that the judge and lawyers were probably not conferring with a forensic or eDiscovery expert when this order was drafted.

First, what are unallocated clusters? Unallocated Clusters – On a hard drive, when data from a portion of a cluster is deleted, or “crossed off”, the free area where the old data resides is the unallocated cluster.

Let’s say one of the key words was “Georgian”. Below is the key word “Georgian” in an unallocated cluster on my hard drive –

Look at all that junk around it! Junk is a good word for it because the unallocated clusters on a hard drive can look like a landfill, minus the seagulls and rats. Is it possible that the key word being searched for is surrounded by useful information or part of an entire document that is still readable? It is absolutely possible. Howerver, it is just as likely that it is junk. Can you find an intact Rubiks cube at a landfill? Yes, it is right next to the dirty diaper.

The forensic examiner can go through the landfill and find the gems. Typically, it is not an automated process. There is a lot of data on a hard drive that may be stored in unallocated clusters (deleted or empty space). Below is a screenshot of a very small sample of the UC’s identified by FTK Imager. Each UC is 102,400 KB or roughly 100 MB. That is how FTK is parsing them to make it easier to review, but in reality it is just one big landfill!

I exported out the file that had my “Georgian” hit because that is what the Court order stated!

When I open it up in Notepad –

Yes somewhere is the word “Georgian”…have fun!  Hey, maybe I will just print it!

Have fun printing out 65,535 pages…

This is why it is important to have forensic experts at your side, so you are not agreeing to:

1. The impossible.

2. Something that will end up costing your client extra time and money.