In an effort for continued dialogue with our clients about current technology and legal issues in our industry, Myriad brings you our monthly newsletter "Newsbyte Bulletin"!

Myriad Newsbyte Article (MARCH 2009 / Volume 2)

What Lawyers Should Know About The Nature Of Electronically Stored Information (ESI) And How A Forensic and/or eDiscovery Consultant Can Assist In The Discovery Of ESI.

There is no question that ESI is growing at an exponential rate, taxing our ability to organize, secure, analyze, and ultimately optimize use of the information. In 2006 alone, for example, it was estimated that the amount of digital information created, captured and replicated was roughly 3 million times more than all of the information contained in all of the books ever written!* Moreover, much of the growth in ESI is expected to occur within organizational settings, making organizations, by both plan and default, the primary custodians of ESI. For example, it is predicted that by 2010 about 30% of all digital information will be created, replicated and reside within the workplace.†

This proliferation of ESI has important implications for all, not just information technology managers. Organizations must focus not only on where ESI resides, but on developing and ensuring cohesive retention policies with respect to this information. And obviously for lawyers, understanding the difference between ESI and paper document information is an important step in contending with the discovery of ESI. For lawyers, identifying, gathering and producing this information within the context of litigation means first re-evaluating old approaches to discovery. As is addressed below, significant differences exist between ESI and information in paper documents, which requires that lawyers and clients alike take a different outlook when it comes to retaining, reviewing, and producing ESI.

ESI Is Different From Paper Documents

ESI is significantly different from paper documents. These differences have been the focus of some study, notably by the Sedona Conference Working Group on Electronic Document Production. Following the dramatic collapses of Enron and Arthur Andersen a few years ago, efforts within the legal community got underway to study both substantive and procedural issues concerning ESI, because events surrounding the Enron and Arthur Andersen cases highlighted the need for a more seasoned approach to handling of ESI. In 2003, some of those efforts crystallized into the Sedona Conference Working Group on Electronic Document Production, which then developed “The Sedona Principles.” The Sedona Principles were intended and designed to address and guide the production of electronic data in discovery.‡

In 2007, the Sedona Conference issued a revised set of principles based on this fundamental recognition that paper documents and ESI are different.

What Are The Significant Differences Between Paper And ESI?

• Volume and Duplicability - Compared to paper data, ESI data is much more voluminous and duplicative. This quality is due to the manner in which ESI is stored and the frequency and ease of its replication. A ready example of this is e-mail, which is one of the most readily identifiable forms of ESI. The ease with which e-mail lends itself to hydra-like replication is apparent from the way in which each user can reply to, forward, and save multiple strings of the same e-mail. This ease of replication means that multiple copies of essentially the same root information can reside in numerous locations creating both volume and duplication.
  

• Persistence - Related to the above point, is the fact that the way ESI is stored, means that it may reside in several different locations, sometimes without the conscience awareness of users or even of information technologists. Accordingly, a conscious effort is required during discovery to ascertain all sources of ESI. The quality of “persistence” also makes it harder to “delete” or “destroy” ESI, which may have significant implications in forensic collection of data.
  

• Dynamic and Changeable Content - ESI is inherently changeable and its content exists in a dynamic form, at times being constantly and automatically updated by electronic systems that are designed to update it. ESI is also dynamically changed simply by being accessed be users, or when it is relocated from one storage device to another. Because of this quality, electronic files may be retained in a form that a user is not even aware exists when the user creates other versions of the same documents.
  

• Metadata - Metadata describes other electronically stored information not explicitly apparent to the user but which is associated with the file and describes various aspects of that file. This is a major difference between paper documents and ESI. An electronically stored document or file contains “other information” about the document or file that is recorded by the computer to assist in storing and retrieving the document or file. The information may also be useful for system administration as it reflects data concerning the generation, handling, transfer, and storage of the document or file within the computer system. In most instances, this metadata is not created by or even accessible to the user. Examples of metadata are information on file designation, file or document creation dates, edit dates, authorship, identification of when a document was accessed, and edit history of a document, etc.
  

• Environment-Dependence and Obsolescence - Another significant manner in which paper documents differ from ESI is that ESI is often dependent on its electronic environment in order to be comprehensible. In other words, separating ESI from the structure in which it was created may result in an incomprehensible product consisting of “undefined numbers.” For ESI to be understandable, it usually must be produced within its structural context, including the report formats that aid in its presentation. Moreover, metadata is often crucial for electronic files and report formats to maintain their functionality accuracy. ESI also presents the related problem of obsolescence in that when organizations update their information platforms, information presented in older formats may become inaccessible due to the either lack of personnel who know how to access the old files or because the technological infrastructure to restore those obsolesced files when they are needed is unavailable. Thus, it is apparent that in the context of discovery, this feature of ESI could present a significant problem if such information needs to be produced.
  

• Dispersion and Severability - ESI is usually stored in multiple locations, such as, desk top hard drives, laptops, network servers, floppy disks, flash drives, CD-ROMS, PDA’s, DVDs, and backup tapes. Paper documents, on the other hand, are usually consolidated in a few confined locations such as file rooms. Also, electronic documents may be stored as identical back-up or archive copies or there may be several versions of the documents from originals to redrafted or edited versions by other users. Thus, it may be more difficult to determine the origin, completeness and accuracy of a document.

What Can A Forensic & eDiscovery Consultant Do?

Because of the differences between ESI and paper document information, not only must a lawyer focus more attention on communicating effectively with the client concerning the sources and storage of information, but a lawyer is well served by employing a knowledgeable Forensic and eDiscovery consultant to assist in the discovery process. A technically proficient consultant(s) with a good handle not only on ESI management, but also on the litigation process and the technical aspects of production, including available information technologies, is invaluable.

A Forensic and eDiscovery consultant can help in the following manner:

Assess the Situation – A forensic consultant can assist the lawyer and the client in ascertaining all possible relevant sources of ESI. These include, networks systems and configuration, email servers, shared network drives, backup procedures & policies, PCs / Laptops, cell phones / PDAs, backup tapes, 3rd Party Email Storage,(e.g., AOL / Gmail / Hotmail / Yahoo);

Acquiring /Collecting ESI - A forensic consultant should be equipped to assist in the appropriate means of collecting the ESI. This would include consulting on a proper forensically sound methodology:

• Forensic Imaging – Bit for Bit (Allocated & Unallocated Drive Space)
  • Normal collection process for PCs / Laptops
  • Necessary to perform data recovery
• Forensic Imaging - Active Files Only (Allocated Drive Space)
  • Usually performed on live network drives
  • Mail Servers (Exchange, GroupWise)
• Cell Phones, PDAs, External Media

Forensically Analyze Evidence re: Computer Usage & Data Recovery (If Required) - The forensic consultant can forensically analyze computer usage and data recovery if this is required, report findings and/or testify.

Filtering ESI (Include and/or Exclude Information) - The eDiscovery consultant can assist in developing appropriate filters for the review, analysis and production of information through the use of: date filters, key word filters, file type filters, and custodian provided filters.

Reviewing ESI (Native vs. TIFF/PDF) - An eDiscovery consultant can provide the most optimal method of reviewing ESI. Available alternatives include either online hosted solutions or in-house systems.

Production of ESI - Finally, the eDiscovery consultant assists the lawyer in the actual production of ESI. Production can either be in native production or by TIFF / PDF Production.

Article Contributed by Stephen K. Lubega, Attorney at Law