Records Management for Paper and ESI Document Retention Policies addressing creation, management and disposition Minimize the risk and exposure Information Management

Litigation Hold Readiness Process of learning where everything relevant may be located and who has access to where and what Establishing time frames Determining the need for forensics Identification

When does duty arise through litigation hold Clearly defined, monitored, published process Must allow business to continue to operate, but avoid the spoliation and potential sanctions related to destruction Preservation

Timely Meet and Confers Formalized agreements, preservation notices The “acquisition” of the data Must be comprehensive, maintaining integrity of data content and preserving its format Close attention to metadata and chain of custody Collection

Meet and Confer discussions are required to address how ESI will be handled, as well as written documentation to the court. Collection- Meet and Confer

Traditional method- Acquiring of “all” potentially relevant data and processing it for review. $$$ Interim method- Improved processing tools to dedup and neardup data= a smaller review pool of data. $$ Targeted methods- Collecting only relevant items, using keywords, Boolean and other filtering methods. $ Collection- Data Acquisition

Custodian filtering Time and Date filtering Privilege searching Concept/Context searching Keyword Searching Collection- Targeted Search Methods

Reduced storage needed for review platform. Reduced hosting cost, typically charged by the GB. Reduced attorney review hours. Less (or no) down-time during data acquisition. Metadata preservation is possible. Collection- Targeted Methods- Savings

Must be comprehensive, maintaining integrity of data content and preserving its format. FRCP requires data to be produced in a format that replicates how it was used. Collection- Content and format

Failure to demonstrate a defensible identification, preservation and collection program. Poor collection practices that result in over-collection and other inefficiencies. Under-collection that misses relevant docs. Collection- Risks

AZ Seroquel Coleman v. Morgan Stanley In Re: Fannie Mae Peskoff v. Faber Qualcomm Collection- Caselaw

Under-inclusive- focus is on exactness e.g “car” vs. “Mercedes”, Specialized vocabulary or acronyms are excluded. Over-inclusive- many irrelevant documents may be collected e.g. “car” might bring up car seats, car pools, etc. Caselaw: In Re: Fannie Mae. 400 keywords. TREC project and Verizon tests are demonstrating clear weaknesses in existing search methodologies. Collection- Pitfalls- Keyword Searching weakness

Familiar concept in criminal law, but historically it was rarely an issue in civil litigation. As a result of the ability to change ESI, the requirement to maintain a defensible chain of custody now applies to every stage of the eDiscovery process. This involves: Documenting the acquisition process. Documenting the chain of custody thru the entire process. Collection- Chain of Custody and Authentication

Forensic acquisitions- an exact image that includes everything on the hard drive such as slack space and deleted files not yet overwritten. Forensics tools utilized do not alter any data during the copying process (a bit by bit mirror image is created). Non-forensic acquisitions- Civil litigation requires preservation of data relevant to a litigation, not necessarily forensic acquisition unless there are early issues regarding suspicion of fraud, theft of IP or deliberate concealment of assets or fear of spoliation. However, in all cases a chain of custody will assist in the admission of evidence and s.b. maintained. Chain of Custody –Forensic vs. Non Forensic

An electronic fingerprint. Can be applied to a file, a section of a hard drive, or an entire drive. If any item, even a single character is changed, the hash value will change. Chain of Custody – Hash Values

If opposing party objects to any ESI in a matter, it may be necessary to present an complete foundation for it. If the ESI was collected by someone lacking qualifications or someone who is party to the litigation and potentially biased, it may not satisfy the court and the evidence may be excluded. Chain of Custody – Admissibility

Regardless of whether a forensic or non-forensic collection is made you need to properly maintain the chain of custody, including: A description of devices from which data was copied. A list of folders that were copied. Your process for making the copies. Documentation of any hand-offs e.g. back to a law firm or to a processing company. Chain of Custody – Log

. Write blockers. USB based portable collection tools. Enterprise Collections. Tape Indexing Accessibility Issues are Changing! Collection Tools