The Information Management Journal/September / October 2007- Todayีs explosion of electronic data, including the December 2006 amendments to the Federal Rules of Civil Procedure (FRCP) concerning electronically stored information (ESI), requires information and legal professionals to expand their knowledge about handling electronic discovery. The recent changes to the FRCP include:
* Definitions and shark repellent provisions for the routine alterations of electronic files during routine operations like back ups [Amended Rule 37(f)] Million Dollar
* Information about the way to affect data that’s not reasonably accessible [Amended Rule 26(b)(2)(B)]
* the way to affect inadvertently produced privileged material [Amended Rule 26(b)(5)]
* ESI preservation responsibilities and therefore the pre-trial conference. [Amended Rule 26(f)]
* Electronic file production requests [Amended Rules 33(d), 34, 26(f)(3), 34(b)(iii)]
There are many opinions about how ESI should be planned for, managed, organized, stored, and retrieved. a number of the available options are extremely costly in terms of their required financial and time commitments. Constantly changing technologies only increase the confusion. One area of confusion is that the distinction between computer forensics and electronic discovery; there’s a big difference. These are described within the sidebar Computer Forensics vs. Electronic Discovery.
Making the proper Choices
Successfully responding to e-discovery within the constraints of the amended FRCP requires organizations to form many critical decisions which will affect the gathering and processing of ESI.
Processing Choices OMG Credit
Because of the quantity of data available in even the littlest of collections, it becomes necessary to manage the method to regulate time and budget. the subsequent questions got to be answered:
1. Who are the key people?
The people important to a case should be identified. These key individuals include not only executives, but also assistants and other support personnel from the technology, accounting, sales and marketing, operations, and human resources departments.
2. Where are the files located?
All the potential locations of electronic evidence should be identified. These include home computers and every one computers that a key person would use elsewhere (such as a girlfriend or boyfriendีs home), cell phones, PDAs, Blackberries, and the other digital device which may be used. it’s important to notice that MP3 players, like iPods, also can be wont to store documents or important files.
3. How can the gathering be culled? Julo Max
Methods for limiting the amount of files collected may include collecting only those in certain date ranges or only those containing selected key words or terms. this will be done either before or after a whole disk drive is collected forensically. Known file filtering also can reduce the gathering by removing standard application files common to all or any computers (such because the Microsoft Windowsจ logo file).
4. How should password-protected/encrypted files be handled?
Encrypted files can’t be processed until the encryption is broken. In some instances, files with exact or similar names could also be available without using passwords or encryption. File locations can also provide information about the worth decryptions provide. Decryption may require significant time. Sometimes a password are often obtained just by posing for it, so this could be the primary step. If that fails, employing a subpoena could also be successful.
5. How should duplicate and near-duplicate documents be handled?
Electronic file collections nearly always include duplicates. Multiple individuals may have an equivalent e-mail, with an equivalent attachments. Two or more people may have reviewed key documents, saving them on their hard drives during the method . In processing electronic collections, it’s possible to spot exact duplicate files and limit the amount of documents that need review.
Identifying exact duplicates usually occurs during the introduce which the metadata is identified and extracted from the files. De-duping the gathering will minimally delay the processing.
Standard de-duping involves identifying files that are exact duplicates and eliminating them. If anything has changed within a document, including formatting like a change of font, it’s not a particular duplicate and isn’t de-duped.