1. E-Discovery: An Introduction to Digital Evidence
Introduction to E-discovery and Digital Evidence

2. Objectives Define e-discovery and digital forensics
Describe types of digital evidence
Explain factors affecting digital evidence collection
Summarize U.S. federal rules on digital evidence
Describe other laws related to digital evidence and ESI discovery
E-Discovery: An Introduction to Digital Evidence

3. An Overview of E-discovery
E-discovery: process of applying traditional legal discovery process to electronic evidence
Electronic evidence encompasses any electronically stored information (ESI) which can include:
Documents, s, pictures, Web pages, and databases
ESI can be found on:
Hard drives, cell phones, DVDs, CDs, and laptops
E-discovery is a form of data mining
A method companies use to gather information about customers or vendors
E-Discovery: An Introduction to Digital Evidence

4. An Overview of E-discovery
Digital forensics: a scientific method for extracting data or evidence from a digital device or an active network
Following this process ensures information will stand up to scrutiny in court
Field of digital forensics is divided into two specialties:
Device forensics: existing files, deleted files hidden files, encrypted data, and more are retrieved
Network forensics: deals with network intrusion and hackers
E-Discovery: An Introduction to Digital Evidence

5. An Overview of E-discovery
Key difference between e-discovery and digital forensics:
In digital forensics investigators are typically looking for incriminating or exculpatory evidence in a criminal case or an investigation of a corporate policy violation
Digital forensics can be considered to overlap with e-discovery
Network forensics do not consider e-discovery to be related to their job
E-discovery experts might have to call on device forensics expert to retrieve data
E-Discovery: An Introduction to Digital Evidence

6. Figure 1-1 The relationship between e-discovery and digital forensics
E-Discovery: An Introduction to Digital Evidence

7. An Overview of E-discovery
Type of evidence examined is OS information
MAC times: “modified, accessed, and created” dates and times
File access times and network logins are also examples
In a Linux OS
Investigators might be able to retrieve the time files were deleted and who deleted them
Challenge of e-discovery
It involves both the legal field and the highly specialized IT field
E-Discovery: An Introduction to Digital Evidence

8. Factors Affecting Evidence Acquisition
In civil cases, evidence is acquired by issuing a request for production
One company requests physical or electronic documents and the second company produces them
Criminal cases require strict adherence to chain of custody
To ensure evidence hasn’t been tampered with or altered in the process
Requires use of search warrants, subpoenas, etc
E-Discovery: An Introduction to Digital Evidence

9. Factors Affecting Evidence Acquisition
In digital forensics, a forensic image of a hard drive or other media device allows an investigator to:
Retrieve deleted files, deleted s, file fragments, and other information not included in a simple file copy
Because hard drives are increasing in size live acquisitions are common
Live acquisitions are done while machines are running
Question before the courts is that the results of a live acquisition might not be reproducible (violates forensics standards)
E-Discovery: An Introduction to Digital Evidence

10. Overview of E-discovery Tools
AccessData and Guidance Software
Have e-discovery tools that work independently or with their digital forensics tools
If a company has its own digital forensics team and legal team
Their efforts can be correlated easily with these tools
Legal team can view results at the e-discovery level
If it is determined that more analysis is needed, the forensics team can search deeper
E-Discovery: An Introduction to Digital Evidence

11. Cost and Time Considerations
Large multinational corporations may be able to afford expensive packages to handle e-discovery
Small and medium firms may not have the budget
Freeware and shareware products can be used
E-discovery can be time consuming
Going through all the information stored on a terabyte hard drive could take a legal team years
Cost and time can be reduced by:
Asking “Which information is needed to prove a case”
Be specific and narrow the focus
E-Discovery: An Introduction to Digital Evidence

12. Federal Rules in U.S. Courts
Three sets of rules govern the conduct of federal court cases:
Federal Rules of Civil Procedure (FRCP)
Federal Rules of Criminal Procedure (FRCrP)
Federal Rules of Evidence (FRE)
Each state has its own interpretation of these rules
E-Discovery: An Introduction to Digital Evidence

13. The Federal Rules of Civil Procedure
Established in 1938 by the U.S. Supreme Court
Those involved with e-discovery need to be aware of the following rules:
FRCP Rule 16
FRCP Rule 26
FRCP Rule 33
FRCP Rule 34
FRCP Rule 37
E-Discovery: An Introduction to Digital Evidence

14. The Federal Rules of Criminal Procedure
Established in 1944 by the U.S. Supreme Court
FRCrP rules specify that when dealing with someone charged in a criminal case:
The rights of the individual take precedence
Main rule that addresses digital evidence is:
Rule 41: Search and Seizure
2002: the Department of Justice “Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations” document
E-Discovery: An Introduction to Digital Evidence

15. The Federal Rules of Evidence
Drafted by the U.S. Supreme Court and became law in 1975
Applies to all evidence presented in court for both civil and criminal cases
Introduction of digital evidence hasn’t changed the FRE extensively
Does add many new interpretations of old rules
Example: hearsay rule
Text messages and s might prove the recipient had been told something; however, messages can’t prove the information’s accuracy
E-Discovery: An Introduction to Digital Evidence

16. The Federal Rules of Evidence
FRE rules that have an impact on how e-discovery is preformed:
Article I, Rule 103
Article I, Rule 105
Article I, Rule 106
Article IV
Article VII
Article VIII
Article X
E-Discovery: An Introduction to Digital Evidence

17. Rules and Policies Governing Digital Evidence
Important aspect of ESI is its overwhelming volume
Digital information may be stored in several physical locations or moved to indeterminate locations as a result of load balancing
Location of data can affect which country’s laws are in effect for e-discovery purposes
s can potentially be transmitted to anywhere in the world
E-Discovery: An Introduction to Digital Evidence

18. Sedona Principles
Sedona Principles - created by a group of lawyers and other professionals as guidelines for handling electronic documents
Emerged from a conference held in 2007
Designed to ease the burden of e-discovery and speed the process along
Lists 14 principles that link to the FRCP
Lay the framework for what a company must do to prepare for possible litigation
E-Discovery: An Introduction to Digital Evidence

19. FRCP Amendments
April 2006: U.S. Supreme Court ordered that the FRCP be amended to address e-discovery
Require companies to protect data that might be subject to discovery in anticipated litigation
The Advisory Committee on Civil Rules incorporated the Sedona Principles into the 2006 amendments
Rule 26(b)(2) - permits parties to avoid discovery of ESI that isn’t reasonably accessible because of “undue burden or cost”
Includes electronic information that has to be converted or recovered to be usable
E-Discovery: An Introduction to Digital Evidence

20. FRCP Amendments
FRCP Rule 34(b) - dictates that ESI be provided in a form that is readily usable
If requesting party specifies another form, the producing party has the option of objecting to the form and proposing its own form
Organizations that scan paper documents and replace them with electronic documents in PDF or TIFF formats:
Improve information-management capabilities
Are better positioned to handle litigation
E-Discovery: An Introduction to Digital Evidence

21. FRCP Amendments
Besides scanning documents, some organizations index the text
Using optical character recognition (OCR) software
OCR software examines scanned pictures of documents and “recognizes” letters and numbers
Use of PDF-scanned copies instead of a native file is disputed in the legal community
Native files can be searched without further processing and metadata still exists
E-Discovery: An Introduction to Digital Evidence

22. FRCP Amendments
Lawyers have a duty to preserve evidence that’s relevant to actual or potential litigation
Amended FRCP Rule 37 (f) states the court can’t impose sanctions when a party destroys ESI as part of its “routine, good faith” operations
Spoliation: a party wrongfully destroying evidence
Companies should put their ESI retention policies in writing and be able to prove that the policies are followed routinely
Procedures should also be drafted to place a “litigation hold” on all potentially relevant ESI
E-Discovery: An Introduction to Digital Evidence

23. FRCP Amendments
FRCP clarifies how ESI is handled during discovery
ESI should be destroyed when it’s no longer legally or operationally required
ESI retention might be affected by IRS rules, corporate policy, or ongoing projects
Policies and procedures should be reviewed and updated as needed
E-Discovery: An Introduction to Digital Evidence

24. State Amendments Related to ESI
Many states have adopted provisions to address procedural issues with e-discovery
Texas developed rules for ESI discovery even before the FRCP amendments were passed
States’ rules can be more stringent than federal rules but not more lenient
30 states have adopted e-discovery procedural rules reflecting the 2006 FRCP amendments
8 other states have some form of e-discovery legislation pending
E-Discovery: An Introduction to Digital Evidence

25. United Nations Model Law
Developed as a result of burgeoning e-commerce in the late 1990s
With multinational corporations
Cases can span several continents and jurisdictions
The United Nations Model Law’s focus was on civil procedures
Has been used as a basis for both digital forensics law and e-discovery worldwide
E-Discovery: An Introduction to Digital Evidence

26. European Corporate Laws
Most European companies that conduct business in the US feel compelled to improve internal controls
In response to U.S. demands
The European Union’s 8th Company Law Directive:
Sometimes described as the European Sarbanes-Oxley Act
Slightly different from the U.S. Sarbanes-Oxley Act
Foreign corporations that want to be listed on the U.S. stock exchanges have to comply with Sarbanes-Oxley provisions
E-Discovery: An Introduction to Digital Evidence

27. European Corporate Laws
European government authorities want more accountability and transparency among European companies
The European Union (EU) has amended the following directives:
4th directive 78/660/EEC
7th directive 83/349/EEC
8th directive 84/253/EEC
E-Discovery: An Introduction to Digital Evidence

28. European Corporate Laws
In accordance with the amendments, EU countries are enacting new laws
Informally known as “EuroSox”
Reflect modern expectations that companies should open themselves to more scrutiny through disclosure and third-party review
communication is a crucial component
records should be maintained in a format that facilitates searching so that third parties can review transactions and relationships
E-Discovery: An Introduction to Digital Evidence

29. Canadian Rules of Civil Procedure
In 2006, a subcommittee of the Canadian Discovery Task Force was created to deal with e-discovery issues in Canadian courts
Group created a list of guidelines for e-discovery
Also created additional guidelines under the Sedona Canada Working Group
In 2010, Ontario amended its rules of civil procedure to address ESI discovery
One of the biggest challenges:
Legal profession’s lack of knowledge in dealing with e-discovery
E-Discovery: An Introduction to Digital Evidence

30. Canadian Rules of Civil Procedure
In 2010, Ontario created a rule:
Parties in a lawsuit agree on and file a written discovery plan within 60 days after close of pleadings
Discovery plan shall be in writing and include:
Intended scope of document discovery
Dates for the service of each party’s affidavit of documents
Information respecting the timing, costs and manner of the production of documents
Any other information intended to complete discovery process
E-Discovery: An Introduction to Digital Evidence

31. Canadian Rules of Civil Procedure
Important principles related to ESI:
Principle 1 - Electronically Stored Information is discoverable
Principle 3 - Parties must consider their obligation to take reasonable and good faith steps to preserve potentially relevant ESI as soon as litigation is anticipated
Principle 4 - Parties and counsel should meet and confer soon and on an ongoing basis
Principle 5 - Parties should be prepared to produce relevant ESI that is reasonably accessible in terms of cost and burden
E-Discovery: An Introduction to Digital Evidence

32. Canadian Rules of Civil Procedure
Important principles related to ESI (cont’d):
Principle 8 - Parties should agree early on the format in which ESI will be produced
Principle 9 - Parties should agree on or seek judicial direction to protect privilege and confidentiality
E-Discovery: An Introduction to Digital Evidence

33. Canadian Rules of Civil Procedure
The Sedona Canada principles and the Ontario checklist for preparing a discovery plan are part of Canadian procedural law
Rule of Ontario Rules of Civil Procedure states:
The court can refuse to award any costs if parties haven’t agreed on a discovery plan
The court can impose cost penalties and other sanctions
E-Discovery: An Introduction to Digital Evidence

34. Summary
E-discovery is the accumulation of digital information for use in litigation
Digital evidence can be found in a variety of forms and on a wide range of devices
The methods used to acquire digital evidence can determine its effectiveness and admissibility in court
A number of software tools are designed for e-discovery
Cost and time considerations affect what tools a company selects for e-discovery and ESI retention
E-Discovery: An Introduction to Digital Evidence

35. Summary
In the US, the Federal Rules of Civil Procedure, along with laws such as the Sarbanes-Oxley Act, govern the ways in which corporations preserve data and data is presented or exchanged during legal proceedings
The Federal Rules of Evidence in the US have a direct bearing on how evidence is collected and maintained in both civil and criminal cases
The Federal Rules of Criminal Procedure take into account the U.S. Constitution and defendants’ rights under the Bill of Rights
E-Discovery: An Introduction to Digital Evidence

36. Summary
The UN Model Law was created to address e-commerce investigations
Other countries, such as Canada and members of the European Union, have similar rules and procedures for governing e-discovery
The Sedona Principles are 14 rules that can be used to help mitigate costs and preserve evidence in e-discovery cases
E-Discovery: An Introduction to Digital Evidence