In this post, Corporate Technology Counsel for Fios, Mary Mack, discusses the differences between electronic discovery and computer forensic services, and gives some tips for choosing which service to employ for different types of matters.

While negotiating the scope of discovery in the early “meet and confer” stages, you may already have limited the potentially responsive data universe to a certain type of data. The following table outlines the four main types of data and their characteristics:

Sedona Principle 9:

Absent a showing of special need and relevance, a responding party should not be required to preserve, review, or produce deleted, shadowed, fragmented, or residual electronically stored information.

 

 

Active files are generally easy to access and collect. Challenges include dealing with large volumes of data and preserving file date information. Most requests for production ask for active files.

De-duplication is an additional challenge when faced with multiple backups of the same set of data over time.

Lines are being blurred with the widespread acceptance of “near line” storage where “archives” are written to an online media, for speed of disaster recovery or automatic failover.

This data is often deemed “not reasonably accessible”. Sampling may be helpful for quantifying costs, time and likelihood of non duplicative discoverable data.

Collect forensically when you need maximum preservation protection, such as when you are responding to a specific event like a wrongful termination law suit. Often, the only way to collect data from a PDA is forensically. Due to cost and/or exposure, opposing counsel is usually not willing to provide forensically collected data, but as with archival data, will need to document this burden in the FRCP 26(f) meet and confer conference. Typically, the requesting party will be required to bear the cost of forensic collection.

Is It Always Necessary to Collect Forensically?

There are many factors to consider before collecting forensically. The legal team will need to assess the case, the jurisdiction, the custodians, data types and the judge to determine whether forensics are warranted. Factors include whether sanctions have already been applied, the trust level for custodians, whether the case is criminal or quasi criminal and other such considerations.

The following chart can assist your decision making:

e-Discovery vs. Computer Forensics

Additional Resources

Instant Messaging, Preservation and e-Discovery Collection Obligations

Instant messaging presents a new set of technical and legal issues in the discovery process, much like e-mail did a few years ago. Download now >

About the Author:

Mary Mack, Esq.

As Corporate Technology Counsel for Fios, Mary Mack has more than 20 years experience delivering enterprise-wide electronic discovery, managed services and software projects with legal and IT departments in publicly held companies. She is a hands-on strategic advisor to counsel for some of the largest products liability class actions, government investigations and intellectual property disputes. A member of the Illinois Bar, ACC and the ABA’s Section on Litigation, Mack received her J.D. from Northwestern University School of Law (1982) and a B.A. from Le Moyne College in Syracuse, NY. She holds certifications in Computer Forensics and Computer Telephony. Mack is one of the leading speakers and authors on e-discovery issues, technology and the law. She is co-author of eDiscovery for Corporate Counsel, published by West; author of the popular book, A Process of Illumination: The Practical Guide to Electronic Discovery; and hosts the blog, Sound Evidence, featured on DiscoveryResources.org.

You Don’t Have To Solve This on Your Own – Get a Lawyer’s Help

Civil Rights

Block on Trump’s Asylum Ban Upheld by Supreme Court

Criminal

Judges Can Release Secret Grand Jury Records

Politicians Can’t Block Voters on Facebook, Court Rules