Knowledge Center

Industry Insights

eDiscovery Update: Cloud computing and lame excuses for not preserving ESI

The facts in this case clearly show that counsel were either purposely stonewalling or completely oblivious regarding the preservation and production of materials from Regardless of the reason, there are some takeaways and lessons learned.

eDiscovery Update: Gathering Tweets from a Different Place in Time

Whether they know it or not, people are crowdsourcing evidence that can be used in lawsuits or criminal cases.

eDiscovery Update: ESI: Beyond the usual suspect, rules still apply

The ESI in the spotlight were images captured and stored on a video surveillance system, and specifically, images that may have recorded the incident.

eDiscovery Update: What We Can ‘Lerner’ About ESI from the IRS

The IRS should have taken immediate action to collect the data on Lois Lerner’s laptop. Instead, her hard drive crashes and the agency shreds it.

Applying Predictive Data Analytics in Discovery | Part 1

Part 1: Series explores the application of data analytics to eDiscovery. This part dives into predictive data analytics; what it is and how it works.

eDiscovery Update: Cybersecurity, Changes to Federal Rules of Evidence

Hon. Judge Peck participated on panel on the proposed changes to the Federal Rules of Evidence; this is what he had to say…

Part 6 of 6: What Do the Proposed FRCP Amended Changes Mean for In-House Counsel?

Practitioners should be thinking NOW about how what changes the new Rules will bring about; What will you do differently? How will this change your practice—if you typically represent plaintiffs, or individuals, or whether you typically represent defendants and large organizations?

Part 3 of 6: Proportionality in discovery proposals for amendments to FRCP

Several proposed amendments seek to promote proportionality by directly amending the scope of discovery, promoting clearer responses to Rule 34, reducing the presumptive limits on the number of depositions and interrogatories, adding a limit to the number of requests for admission, and explicitly recognizing the authority to allocate expenses in discovery.

View More Industry Insights
Case Studies

How to Deal with a Document Dump and Save $1.4M Using Predictive Coding [CASE STUDY]

Receiving counsel needed to find out which documents were most important to support their side of the dispute, but they were faced with a gargantuan task.

Using Advanced Technologies and Solutions to Cut Costs Significantly

A major healthcare company, with operations in more than 100 countries, was involved in a contract dispute which the General Counsel of Litigation described as a “high costs/low merits” case. D4 applied advanced technologies and solutions to help this company reduce its data set by over 75% and saved them $550,000 on eDiscovery.

Predictive Coding as a Strategic Weapon

Our customer and its legal team felt it strategic to meet the existing deadline although the document population increased by a factor of ten. Outside counsel wanted to leverage the completed coding for the initial five custodians; the corporate customer wanted to keep to the original budget. In short: same deadline and budget for ten times the number of documents.

Second Requests – The D4 Difference

The proposed merger could not go forward until the second request was completed, pressuring the team to collect, review and produce the responsive materials as quickly as possible. Five million documents were collected (1.6TB of data) and the firm had 10 days until production. To make it even more complicated, this included translation and review of foreign language documents.

EDRM in a Week – The D4 Difference

A leading law firm takes 18 TB through the EDRM in 7 days and realizes a 98% data reduction. The Challenge: The courts mandated the discovery and review of data contained on 78 backup tapes, containing 18 TB within four weeks.

Forensic Analysis & Written Testimony, All on a Sunday

Analysis & Written Testimony, All On a Sunday – Forensics needed to complete both the analysis and written testimony by Monday morning.

A Large European Corporation

A large European corporation was involved in patent litigation. Hundreds of custodians needed to be interviewed and electronic data had to be collected pursuant to a discovery request. The custodians were located throughout the United States and Europe.

An International Corporation

An international corporation was accused of unfair employment practices. The suit claimed that the corporation had been engaging in these activities for years. The corporation was asked to produce relevant data regarding their hiring and promotion practices over a period of 20 years. Potentially relevant data was not only stored in e-mail systems and file servers but in outdated legacy databases as well.

A Small Technology Company

A small technology company accused the defendant of not paying invoices that had been submitted over a 12 month period. The defendant claimed that they never received any invoices until the suit was filed. The defendant also claimed that due to the invoices being submitted years after the work had been completed there was no way to verify the work that had been done or match that work to the invoices.

An Individual

An individual was accused by his former employer of possessing and using customer lists and other proprietary and confidential information to steal business shortly after being hired by a competing organization. The defendant did return some data but it was after he had been employed at the new company for over a month. It also believed that the defendant still maintained some confidential and proprietary information.

Tips & Tricks

The Fundamentals of Document Management [Infographic]

Document management and control can be a complicated and daunting process, but ignoring it is a bad idea. Getting started is usually the hardest part…

8 Best Practices for Handling Electronic Evidence

Why does electronic evidence multiply? Why does it move or get renamed or even deleted? It does not do it on its own… so who is responsible and why?

Don’t Be Afraid of Document Management! | 7 Best Practices for Getting Started

“How do you eat an elephant? One bite at a time.” The same should apply to addressing information governance in your organization – no matter what size you are.

Uncovering ESI (Electronically Stored Information) – 20 Tips for Keyword Searching in eDiscovery

Any term less than four (4) characters may result in a lot of false positives…Be aware of “noise word” lists…Be aware that searching numbers can sometimes return unwanted results…

Rehashing: Using Hash Tables to Remove or Flag ESI in eDiscovery

So what’s a hash table? A hash is a calculated value of a defined set of data, such as a file or a string of text. A hash table is a collection of two or more hashes. You may be familiar with the term MD5 hash. This is an example of an MD5 hash value:


It’s akin to a digital fingerprint and it’s basically meaningless.


The Importance of Federal Rule of Evidence 502

Do we need privilege logs anymore? First, let’s discuss the advantages, challenges and best practices when implementing 502 orders and agreements.

Legal Hold and Data Preservation Best Practices

Your Guide for Navigating the Complexities of Preservation in the Digital Age; This Guide on “best practices” continues the goal of helping lead legal professionals on the path to excellence in legal holds and data preservation.

Technology Assisted Review – What Does TAR Really Mean?

This whitepaper will answer many questions, including:
-What is “TAR” and why should you care?
-Does it really help speed up discovery and minimize costs?
-Is it a defensible process?
-What are the courts’ views on the use of TAR?

Adopting an Enterprise-Wide Cloud Solution: 5 Things to Consider

In this whitepaper you will learn about:
-The most crucial aspect to consider when evaluating cloud solutions: security;
-Hidden costs and risks associated with implementing a new platform;
-The importance of scalability, and where free solutions like Dropbox and Microsoft Skydrive, fall short;
-Company trends and benefits of adopting a cloud solution.

How To Conduct an Efficient eDiscovery Interview

As a service provider we perform a lot of intake on new electronic discovery projects. We see the difference between legal teams who have thoroughly interviewed custodians and IT staff, and those who either have not, or if they have, they didn’t ask many questions about ESI in any quantified or documented way.

In this whitepaper you will learn 6 expert tips to remember for your next eDiscovery client interview.

3 Methods of eDiscovery Document Review Compared

This whitepaper compares keyword search with concept-based, and support vector-based platforms, including Technology Assisted Review and Predictive Coding


Social Media eDiscovery Case Study from the Field

Evidence from Facebook, Twitter, LinkedIn and other social networking sites is now commonplace in litigation. However, despite extensive discussion on this topic, little direction has been given on how to actually collect, process and review social media evidence in a routine and scalable fashion, consistent with best practices– until now.

New Podcast-Cloud Computing Forensics

AccessData Users Conference 2011

The Sedona Conference® Glossary, 3rd Edition, Copyright © 2010, Reprinted with permission.

30(b)(6): Under Federal Rule of Civil Procedure 30(b)(6), a corporation, partnership, association, or governmental agency is subject to the deposition process, and required to provide one or more witnesses to "testify as to matters known or reasonably available to the organization" on the topics requested by the notice. Sometimes the 30(b)(6) topics concern the discovery process itself, including procedures for preservation, collection, chain of custody, processing, review, and production. Early in the litigation, when developing a discovery plan, particularly with regard to electronic discovery, a party should be mindful of the obligation to provide one or more 30(b)(6) witnesses should the request be made by another party to the litigation, and include this contingency in the discovery plan.

Ablate: Describes the process by which laser-readable "pits" are burned into the recorded layer of optical disks, DVD-ROMs, and CD-ROMs.

Ablative: Unalterable data. See Ablate.

Acetate-base film: A safety film (ANSI Standard) substrate used to produce microfilm.

ACL (Access Control List): A security method used by Lotus Notes developers to grant varying levels of access and user privileges within Lotus Notes databases.

ACM (Association for Computing Machinery): Professional association for computer professionals with a number of resources, including a special interest group on search and retrieval. See

Active Data: Information residing on the direct access storage media (disk drives or servers) that is readily visible to the operating system and/or application software with which it was created. It is immediately accessible to users without restoration or reconstruction.

Active Records: Records related to current, ongoing, or in-process activities referred to on a regular basis to respond to day-to-day operational requirements. See Inactive Records.

ADC: Analog to Digital Converter. Converts analog data to a digital format.

Address: Addresses using a number of different protocols are commonly used on the Internet. These addresses include email addresses (Simple Mail Transfer Protocol or SMTP), IP (Internet Protocol) addresses and URLs (Uniform Resource Locators), commonly known as Web addresses.

ADF: Automatic Document Feeder. This is the means by which a scanner feeds a paper document.

Adware: See Spyware.

Agent: A program running on a computer that performs as instructed by a central control point to track file and operating system events and takes directed actions, such as transferring a file or deleting a local copy of a file, in response to such events.

AIIM: The Association for Information and Image Management, It focuses on ECM (enterprise content management).

Algorithm: A detailed formula or set of rules for solving a particular problem. To be an algorithm, a set of rules must be unambiguous and have a clear stopping point.

Aliasing: When computer graphics output has jagged edges or a stair-stepped, rather than a smooth, appearance when magnified. The graphics output can be smoothed using anti-aliasing algorithms.

Alphanumeric: Characters composed of letters, numbers (and sometimes non-control characters, such as @, #,

$). Excludes control characters.

Ambient Data: See Latent Data and Residual Data.

Analog: Data in an analog format is represented by continuously variable, measurable, physical quantities such as voltage, amplitude, or frequency. Analog is the opposite of digital.

Annotation: The changes, additions, or editorial comments made or applicable to a document - usually an electronic image file - using electronic sticky notes, highlighter, or other electronic tools. Annotations should be overlaid and not change the original document.

ANSI: American National Standards Institute, - a private, non-profit organization that administers and coordinates the U.S. voluntary standardization and conformity assessment system.

Aperture Card: An IBM punch card with a window that holds a 35mm frame of microfilm. Indexing information is punched in the card.

API (Application Programming Interface): Interface implemented by an application to enable interaction with another application. See MAPI.

Applet: a small program typically designed as an add-on to another program, allowing greater functionality for a specific purpose other than what the original program intended, e.g., a game applet for a Web browser.

Appliance: A prepackaged piece of hardware and software designed to perform a specific function on a computer network, for example, a firewall.

Application: A collection of one or more related software programs that enable an end-user to enter, store, view, modify, or extract information from files or databases. The term is commonly used in place of "program" or "software." Applications may include word processors, Internet browsing tools, spreadsheets, email clients, personal information managers (contact information and calendars), and other databases.

Application Metadata: Data created by the application specific to the ESI being addressed, embedded in the file and moved with the file when copied; copying may alter application metadata. See also Metadata.

Application Service Provider (ASP): An Internet-based organization hosting software applications on its own servers within its own facilities. Customers license the application and access it over the Internet or via a private line connection. See SaaS.

Architecture: Refers to the hardware, software or combination of hardware and software comprising a computer system or network. "Open architecture" describes computer and network components that are more readily interconnected and interoperable. "Closed architecture" describes components that are less readily interconnected and interoperable.

Archival Data: Information an organization maintains for long-term storage and record keeping purposes, but which is not immediately accessible to the user of a computer system. Archival data may be written to removable media such as a CD, magneto-optical media, tape, or other electronic storage device, or may be maintained on system hard drives. Some systems allow users to retrieve archival data directly while other systems require the intervention of an IT professional.

Archive, Electronic: Long-term repositories for the storage of records. Electronic archives preserve the content, prevent or track alterations, and control access to electronic records.

ARMA International: A not-for-profit association and recognized authority on managing records and information, both paper and electronic,

Artificial Intelligence (AI): The subfield of computer science concerned with the concepts and methods of symbolic inference by computer and symbolic knowledge representation for use in making inferences - an attempt to model aspects of human thought process with computers. It is also sometimes defined as solving by computer any problem once believed to be solvable only by humans. AI is the capability of a device to perform functions that are normally associated with human intelligence, such as reasoning and optimization through experience. It attempts to approximate the results of human reasoning by organizing and manipulating factual and heuristic knowledge. Areas of AI activity include expert systems, natural language understanding, speech recognition, vision, and robotics.

ASCII (American Standard Code for Information Interchange): Pronounced "ask-ee," a non-proprietary text format built on a set of 128 (or 255 for extended ASCII) alphanumeric and control characters. Documents in ASCII format consist of only text with no formatting and can be read by most computer systems.

Aspect Ratio: The relationship of the height to the width of any image. The aspect ratio of an image must be maintained to prevent distortion.

Attachment: A record or file associated with another record for the purpose of retention, transfer, processing, review, production, and routine records management. There may be multiple attachments associated with a single "parent" or "master" record. In many records and information management programs, or in a litigation context, the attachments and associated record(s) may be managed and processed as a single unit. In common use, this term often refers to a file (or files) associated with an email for retention and storage as a single Message Unit. See Document Family, Message Unit, and Unitization.

Attribute: A characteristic of data that sets it apart from other data, or property of a file aspect such as location, size, or type. The term attribute is sometimes used synonymously with "data element" or "property."

Audit Log or Audit Trail: An automated or manual set of chronological records of system activities that may enable the reconstruction and examination of a sequence of events and/or changes in an event.

Author or Originator: The person, office, or designated position responsible for an item's creation or issuance. In the case of a document in the form of a letter, the author or originator is usually indicated on the letterhead or by signature. In some cases, a software application producing a document may capture the author's identity and associate it with the document. For records management purposes, the author or originator may be designated as a person, official title, office symbol, or code.

Avatar: A graphical representation of a user in a shared virtual reality, such as Web forums or chat rooms.

AVI (Audio-Video Interleave): A Microsoft® standard for Windows animation files that interleaves audio and video to provide medium quality multimedia.

Connect with D4