Electronic Discovery Made Easy

De-Duplication -- Different Tools, Different Results

David Rostov — Wed, 26 Aug 2009 09:12:35 -0800

If two emails are identical, shouldn’t they be considered duplicates?

Unfortunately in eDiscovery it is not quite so simple. The industry standard is to calculate an MD5 hash value for all emails in a population and then identify the duplicate emails (this is referred to as de-duping). MD5 hash value is the output of a complex mathematical algorithm; it provides a way to identify each unique document. Ralph Losey has written some very thoughtful commentary on hash values. He makes a very interesting case for using hash values as the replacement for Bates numbering; the 21^st century version of Bates numbering.

The issue/challenge is that each of the major eDiscovery software tools uses its own proprietary definition of the inputs used in calculating the hash values. In the hash value world, even a very small difference means that two documents that are truly identical can be considered distinct. As a result, this leads to a certain set of documents being reviewed and/or produced more than once. The table below provides a summary of the inputs used to calculate the hash values from three leading tools: Clearwell, LAW and IPRO. As you can see, they are each different.

	Clearwell	LAW	IPRO
From	Yes	Yes	Yes
To	Yes	Yes	Yes
Cc	Yes	Yes	Yes
Bcc	Yes	Yes	Yes
Subject of the email	Yes	No	Yes
Email date (sent date)	UTC	No	GMT
Body content	Yes	Yes	Yes
Attachment Names	No	Yes	Yes
IntMsgID	No	Yes	No

Notes:
Yes indicates it is included in the hash computation.
No indicates that it is not included in the hash computation.
IPRO hash methodology can be customized based on the settings outlined above.

As a recent real world example, we worked on an eDiscovery project where the custodian sent out an email to eight people within his company. By any reasonable standard, this means that there were eight exact duplicates of this email in the population set. However, the software tool used to process this data categorized this email as being four different emails. This was due to the fact that the company had various internal email servers (a fairly common occurrence in larger corporations) and each time the email was handed off to a different internal server, it placed a slightly different time in one of the metadata fields.

Conclusion

Although each software tool calculates the hash values slightly differently, this does not necessarily mean that one tool is better or worse than another or that one is inherently more accurate. If hash values were to become the Bates stamp of the 21^st century, the electronic discovery industry could benefit from a standard method of calculating hash values. Absent a standard, it is important to be aware of this issue in case you run across it.

Why are So Many Email Collections Corrupted

David Rostov — Wed, 08 Jul 2009 11:28:21 -0800

Many email collections are done improperly and produce corrupted files. Unless properly repaired, corrupted email files cannot be processed for litigation. The most common email collection problem is from Microsoft Exchange Server collections (.PST files). Improperly collected exchange data adds significant time and cost to the eDiscovery process. It also introduces an element of risk in terms of the overall integrity of the evidence.

Microsoft Outlook saves all email files in a .PST file format. Think of the PST as an expanding container file. For most custodians, all of their email resides in a few PST files.

Often email collections are performed by internal IT personnel. Usually email collections are done using the Microsoft Exchange Mailbox Merge Program (ExMerge.exe). This program enables a network administrator to extract data from mailboxes on an Exchange Server and merge it into the same mailboxes on another computer that is running Exchange Server. The program copies the PST file from the source mailbox server and merges the data into the same PST file on the destination server. The most common practice is to copy the data while the custodian(s) are still logged into the system. This allows the custodian to continue working while the collection is occurring. This is the main cause of the file corruption. The system cannot properly synchronize the various sets of files, in particular slight differences in dates/times, while the custodian’s email account is active.

The good news is that there is a very simple and effective solution to this problem. The solution is to make sure that the custodian is logged out of his/her account during the entire collection process and that the account has been properly synchronized with the server. It is always advisable to verify that the data was successfully collected prior to turning it over it to your eDiscovery vendor or counsel. To verify the collected PST, use the function “Advanced Find” in Outlook. If you do not see any messages in the view pane, this is an indication that the collection was not successful and the data has been corrupted.

Paraben has a tool called E-mail Examiner that does a good job of insuring that the email collection is forensically sound. Their product is more expensive than ExMerge and not as widely used. However, it is designed specifically for purposes of litigation and investigations.

Repairing Corrupted PSTs

If the collection was not done properly and the data is corrupted, repairing a PST usually involves a number of hours of senior technical time. A rough estimate is that a 10 GB PST will take a few hours to repair. There are two tools that we would recommend for this type of repair. Both tools search all the files in order to locate the corrupt files and then attempt to recover the damaged information.

1. EasyRecovery File Repair. This tool is from Kroll Ontrack.

2. Outlook Recovery Tool Box. This is a Microsoft tool that is usually included with Outlook.

Unfortunately not all corrupt PSTs can be repaired. If so, you will need to have the data re-collected. Be prepared for an unhappy custodian when you show up to re-collect their data.

Big Changes in Early Case Assessment

David Rostov — Wed, 03 Jun 2009 08:46:01 -0800

There are some very exciting trends and developments going on in the Early Case Assessment (“ECA”) phase of litigation. ECA is a critical part of the litigation process since it is a time to perform a preliminary analysis of the merits of a case, claims, likely defenses and estimate of the cost of the case. Usually the ECA is conducted in the first 90 days from the time a case is filed. There is general agreement that ECA improves litigation outcomes. For example, a survey by LexisNexis showed that ECA results in favorable outcomes in 76% of cases and reduces litigation expenses in 50% of cases.

In the digital era, the BIG CHALLENGE is getting access to the electronic data early in the ECA process and having the tools to allow the legal team to evaluate the case based on a preliminary review of the evidence. This is both a technology challenge as well as a cost challenge. The good news is that there are now a number of early case assessment tools on the market that can solve this problem. We are big fans of Clearwell for this and our clients are seeing the value.

The key benefits from this are:

Speeding up access to client data. The documents can be fully indexed and available to review within hours rather than weeks.
An easy to use web interface. This means it is available anywhere and anytime. There is no need to rely on internal IT resources and no need to purchase additional software or hardware.
Collaboration between in-house counsel and outside counsel. It is very easy to have the legal team work together to examine key documents.

Effective use of an early case assessment tool makes it possible to prepare an Early Case Assessment in the digital era. A good understanding of the documents allows the legal team to prepare a more complete litigation strategy. It also helps lower the overall cost of the case by reducing the amount of data that needs to be processed for review and correspondingly reducing the amount of legal hours required for review. The other added benefit is that the legal team will be able to create a more accurate budget for the case based on their insight into the data size and its nuances.

Text Messaging and Its Impact on eDiscovery

David Rostov — Tue, 21 Apr 2009 12:18:39 -0800

To-date, most litigation electronic discovery requests are limited to custodian email and loose documents. The requests ignore custodian mobile phone data, in particular stored text messages. The next big eDiscovery collection trend for litigation will likely be the collection of text messages from mobile phones.

Text messaging is still viewed as something that only teenagers really use. However, the usage data on text messaging is quite revealing. Over 70% of Americans ages 25 to 49 use text messaging. The average number of texts sent per day per user in the US is over 10. In 2008, the number of text messages sent surpassed mobile phone calls. And text messaging is growing at 100 to 200% per year.

To put texting in its proper context, it is estimated that Americans send about 30 emails per day (the data on this is not very precise). This means that texting accounts for ¼ of the daily electronic correspondence sent in the US.

The first step in any forensics investigation is identifying sources of evidence. Mobile phones store evidence in a variety of locations and media formats. Similar to desktop computers, most cell phones have an internal memory and a removable storage media (SD Cards). Depending on the carrier, an internal SIM (Security Identity Module) card stores pertinent information, such as phone numbers, contacts, and unique subscriber registration data.

As with computer collections, mobile device collections should be done in a forensically sound manner. This means that the data collected must be collected without changing the original device content. A forensic hash should be performed on the collected data to insure that no subsequent changes are made to the data. Keep in mind that the data on mobile devices is constantly changing (e.g. clock time, network data, etc.) so it is important to make an exact replica as quickly as possible.

The main challenge with mobile collections is that most cellular phones use a proprietary operating system. This is compounded by the fact that new mobile devices are constantly being introduced into the market making it a challenge to stay current on the collections tools. Often the hardest part in the collection is just having the right phone adapter on hand to be able to do the data transfer from the phone to the acquiring computer.

After making a copy of the phone data, the next step is to analyze the data. The forensic tools available for analysis and processing are still in their early stage of development. However, there are a number of forensic tools available such as Paraben’s Device Seizure Toolkit and Guidance Software’s Neutrino. Paraben’s Device Seizure is probably the most common tool used both by law enforcement as well as for commercial litigation. These tools are very similar to traditional forensics software utilities and offer many of the same capabilities and functionally, such as text viewing and keyword. During the analysis phase text messages, e-mails and contacts can be identified, undeleted (if necessary), searched, and exported for review or further processing. If you are interested in more information on mobile collections, The National Institute of Standards and Technology (NIST) has a good overview.

The Search Duel: What is the Best Method?

David Rostov — Mon, 02 Mar 2009 17:01:46 -0800

At Legal Tech’s recent conference in New York, most of the discussion was around search: is it defensible, how good is it relative to other methods, what did Magistrate Judge Facciola really mean in his O’Keefe opinion, how do you know if the search methodology picked up all the relevant documents, what is the best search engine, etc. To borrow a famous quote from Winston Churchill, it felt like the consensus regarding key word searching could be summarized as follows:

It is the worst form of search except all the others that have been tried.

The problem with debates about how best to judge the effectiveness of a given search methodology is that it often ignores two important considerations: what is the cost tradeoff and what is the “gold” standard to which to compare it. The “gold” standard is usually viewed as the ability of experienced litigators to find the relevant documents by reviewing (reading) all the documents in discovery.

A friend recently shared the following real experiment that he did at his firm. He challenged a group of four seasoned litigators in his firm to see if using key word searching of approximately five boxes of documents (2,000 documents or 10,000 pages) he would find more relevant documents in the case than they would find reviewing every document the old fashioned way. It took our friend under one hour to search the documents and he found approximately 500 responsive documents. The four lawyers took a total of 32 hours to review all the documents. They found about 300 responsive documents. When they compared responsive sets, it was clear that the lawyers had missed almost 40% of the responsive documents in the data set. Not only had the review team missed a lot of responsive documents, the cost differential was significant: $200 versus over $6,000 (assuming $200 per hour).

Although key word searching has many limitations, and like any method, needs to be carefully thought out when used, it is a very effective way to quickly and cost effectively focus a review.

Not All TIFFs Are Created Equal

David Rostov — Wed, 25 Feb 2009 20:25:36 -0800

Processing of electronic discovery data can lead to interesting surprises in terms of the complexity and/or size of the data. This can sometimes make it challenging to accurately estimate a timeline for a project prior to loading the data and performing some preliminary analysis.

For example, we recently received 20 spreadsheets that needed to be converted into TIFF images and produced to opposing counsel. The client called and asked us for an estimated time to complete the project. Based on the fact that it was only 20 spreadsheets, we estimated that we would have this project completed within a few hours. Assuming 50 pages per spreadsheet, our estimate was that this was going to be about 1,000 TIFF images.

After we received the data, we loaded it in our system and created TIFF images of the spreadsheets. It turned out that the 20 spreadsheets generated close to 100,000 TIFF images or pages (an average of 5,000 pages per spreadsheet). One spreadsheet converted into approximately 20,000 TIFF images. This meant that the data size was almost 100 times bigger than we had expected. As a result, the project took longer than our original estimate. The good news was that most of the spreadsheets actually had a lot of blank pages and other “quirky” formatting issues. In the case of the 20,000 page spreadsheet, we were able to fix the formatting (without, of course, changing any of the original data) which reduced the spreadsheet to a few hundred pages. We were also able to significantly reduce the page size for the other spreadsheets by a similar amount. The additional time that we took to fix the formatting ended up saving counsel countless review hours and cost.

Bottom line, when requesting a firm timeline and cost estimate from an electronic discovery vendor, it is always best to give them the actual data and request that they do a preliminary analysis of the data prior to finalizing an estimate. This will insure a much more realistic estimate.

Controlling Rising Litigation Costs

David Rostov — Sun, 22 Feb 2009 23:32:38 -0800

In 2009 you will continue to see very large increases in the size of the discovery data sets. According to a study by McKinsey & Company, the demand for corporate data is growing by 50% per year. According to the ABA, 60 to 90% of the cost of litigation relates to first level review. This means that litigation costs in 2009 will continue to increase. Of course in a global economic recession, the “amount in controversy” will not increase by an average of 50% in 2009. As Magistrate Judge Paul W. Grimm writes in Mancia v. Mayflower Textile Services Co., Civ. No. 1:08-CV-00273-CCB (D. Md. October 15, 2008), “The goal is to attempt to quantify a workable “discovery budget” that is proportional to what is at issue in the case.”

If the size of the data involved in litigation is growing by 50% per year, the only way to effectively control litigation costs is to embrace the use of electronic discovery tools. The good news is that understanding and using the basic electronic discovery tools is relatively straightforward.

I have broken the basic tools into five main categories:

1. Data collection. How the data is collected will have a significant impact on the overall cost of the case.

a. Determine if you need a full forensic image (copy of the full drive; this will pick up deleted files as well as active files); or

b. Targeted File collection (also referred to as an Active File collection). Usually this collection method will avoid collecting system files.

2. Filter the data by custodian and/or date ranges. This means eliminate/suppress the data that is outside of the date range of the case. Also, eliminate/suppress the data for custodians that were inadvertently collected in the data collection but are not part of the case.

3. Cull out the system files. Suppress all system files. This usually accounts for a significant amount of the data collected. The only exception to this rule is if for some reason certain system files relate to the case.

4. De-duplicate the data. This will identify exact duplicates of documents and suppress them.

5. Search the data. Different search techniques are used for different type of cases. However, a key word search is still the most frequently used technique to identify relevant documents.

Here’s a recent example of the power of eDiscovery tools. We recently worked on a case in which we did a full forensic image of over 10 computers and laptops. The total data collected was over 1 terabyte. Using the first four eDiscovery tools listed above – collection, filtering, culling and de-duplication -- we reduced the data set to 150 gigabytes. Working with counsel on key word searching, we were able to reduce the 150 GB to 5 gigabytes. This represents a reduction of over 99% of the data size prior to attorney review. The attorneys reviewed the data and we produced one gigabyte of responsive data or under 50,000 documents.

In summary, embrace eDiscovery tools. Treat them as your NBF (“new best friend”). They will allow you to better control the rising cost of discovery as a result of the fact that corporate data is growing at a 50% annual rate.

Hard Drive Collections Made Easy

David Rostov — Sun, 22 Feb 2009 23:11:31 -0800

For most civil litigation cases, data collection of electronic evidence is really very straightforward. The main decision that the legal team needs to make prior to starting the collection is whether to do a targeted collection or a full image of the hard drive(s). I have summarized below the differences between these two choices. I also try to simplify and demystify the term forensic collection.

Targeted Collection

A targeted collection can also be referred to as an active file collection. For most litigation, a targeted collection is usually the best approach. A targeted collection consists of the collection of certain specific files (active files) from the custodian(s) as deemed relevant to the case. A targeted collection usually includes all of the documents or electronic communications created by the custodian in Word, PDF, Excel and PowerPoint as well as e-mails. This type of collection does not usually include system files (programs used to run the computer such as Windows and Office). System files account for a significant amount of the hard drive space (around 10 gigabytes on a new computer). This alone eliminates the collection of a lot of data at the front end of the process.

Benefits of a Targeted Collection

Time savings. A targeted collection of a hard drive is usually 50% faster than a full image; two hours versus four hours for an 80 gigabyte hard drive.
- The amount of downtime and disruption to the custodian is minimized.
Cost savings. The cost to do a targeted collection is less than a full image due to the faster time to complete it. More importantly, the amount of data processed and eventually reviewed is smaller which is the real cost savings.
A proper collection will preserve all of the targeted meta-data

Limitations of a Targeted Collection

It does not capture and/or preserve the deleted files or file fragments.
Spoliation of deleted data. If after the collection, it becomes necessary to review deleted data, it might not be available.
The collection methodology might be easier to challenge in court.

Full Image

A full image of a hard drive is a bit-for-bit copy of the hard drive(s). It includes all active files, deleted files, file fragments and blank space.

Benefits of a Full Image

Preserves all data on the hard drive including deleted files.
- Deleted files could be relevant to certain cases for example cases that involve some type of malfeasance allegations.
Verified procedure and greater legal defensibility
- Easier to defend methodology in court
Reduces the risk of spoliation
Preserves all of the meta-data

Limitations of a Full Image

It takes longer to collect the data. A full image of a hard drive takes twice the time as a targeted collection: 4 hours versus 2 hours for an 80 GB hard drive.
- Greater inconvenience to the custodian.
Higher cost to image the drive due to the longer time factor. More importantly, there will be additional data to process and review which will increase the cost further.
Deleted data that has not been overwritten is fairly readily accessible. It is harder to argue that the data is inaccessible and therefore cost prohibitive to produce.
- You might have to produce more data than otherwise intended and thus increase the overall cost of review, production, etc.

Forensic Collection

In the legal community there is confusion surrounding what is means to do a forensic collection. In the IT world, a forensic copy of a drive refers to a full copy of the drive. In the legal world, the key is not whether it’s a full copy but instead is the process defensible.

A good definition of a forensically-sound collection comes from Chris Ball (forensically sound):

“A ‘forensically-sound’ duplicate of a drive is, first and foremost, one created by a method which does not, in any way, alter any data on the drive being duplicated. Second, a forensically-sound duplicate must contain a copy of every bit, byte and sector of the source drive, including unallocated ‘empty’ space and slack space, precisely as such data appears on the source drive relative to the other data on the drive. Finally, a forensically-sound duplicate will not contain any data (except known filler characters) other than which was copied from the source drive.”

The important point is that the standard definition of a forensically-sound collection stresses the importance of a bit-by-bit copy of the source hard drive. It is a full copy of the entire drive including the deleted space and unused space (often referred to as empty or slack space). I think that all collections should be done in a sound, defensible manner using industry accepted tools and procedures. I prefer to use Mike Murr’s definition of forensically-sound as a collections process that leads to “an accurate representation of the source evidence” (forensic blog). In other words, all collections need to be legally defensible and need to preserve the data in its original form. However, the legal team can make a choice between making a targeted collection or a full image. In either case, it must be done in a forensically sound manner.