9 Things You Never Want to Hear in eDiscovery
There are times - most of the time - when a client can be your best ally. They will have evidence lined up, each device impeccably preserved with all of the proper chain of custody forms filled out. However, there are other times when the corporation or law firm may not be as familiar with the science of electronic discovery. This article pays homage to these other times - the times when the dominos do not line up, when opportunity does not meet preparation. Here are nine things you never want to hear in eDiscovery:
1. “We decided to do a little snooping around on the laptop before you got here.” Extremely commonplace ten years ago, this still occurs fairly frequently today - usually to those who are less familiar with how computer forensics works. The obvious effect of the innocent “snooping” is a tainted source of evidence and a dubious chain of custody. The client will be able to produce a pristine source of evidence by practicing a little patience.
2. “We re-assigned the laptop to another employee shortly after he was fired.” Sometimes the rush to save a budget dollar or two will end up costing the client one hundred-fold. That is the case when the laptop of an employee who leaves under a cloud of suspicion is wiped clean and reset by IT before an image of the hard drive can be created. A little communication between supervisors and IT can go a long way to prevent the pre-mature re-circulation of a laptop.
3. “We told the relevant employees to just drag and drop all of their important documents to a network server where we would collect them all.” This is a mistake on many different levels. The first being the changes made to the metadata fields by dragging documents into new folders. Creation dates, last altered dates and times can all be affected by dragging and dropping the documents--not to mention altered file names and inadvertently placed documents. Furthermore, how comfortable are you with an employee making the call on what is relevant and what is not?
4. “Retention policy. What retention policy?” Properly crafted and maintained retention policies can ease the strain of eDiscovery by reducing the mountain of irrelevant data to review. Retention policies also provide the attorneys with a roadmap of where relevant data can be found.
5. “I don’t know if the CEO saw the litigation hold notice.” Maintaining a litigation hold is as important as sending one out. That is, the attorney in charge needs to make sure that the holds are being followed and data is not being inadvertently destroyed by automated processes. Sanctions are now more common where the client and counsel both fail to monitor a litigation hold.
6. “We decided not to recycle the backup tapes since we weren’t sure if the retention schedules were correct.” Here we have a retention policy but there is a failure to follow it. A failure to properly manage a retention/destruction policy will create mountains out of molehills. High levels of data can not only affect litigation costs but can also dramatically affect productivity. Large volumes of data drain resources that must deal with migrating data from one repository to the next rather than monitoring automated retention/destruction schedules.
7. “The CEO does not want you to image his laptop.” Handle with care.
8. “Remember the backup tapes I told you about a few months ago that did not exist....?” I have had cases where we found backup tapes used as door stops and to prop up televisions. Many corporate clients without a retention/destruction policy face a glut of backup data on a variety of different media that is difficult to track. Spreadsheets and physical inspections of archived data sites are always the best way to track and find all of the relevant data. Meet-and-confer conferences go much smoother with an accurate assessment of where and how much archived data exists. It is a difficult call to make to opposing counsel when you have found relevant data after depositions have begun.
9. “We let her go back to her office and clean out her desk after she was terminated.” This is akin to leaving a puppy alone in a house full of shoes while you go outside to water the yard. The amount of damage that can be done in just fifteen minutes goes well beyond your imagination. While you may be able to recover the lost data, the amount of work required to put the pieces back together again is both costly and often incomplete.
David Weber is General Counsel for Digital Discovery (www.digitaldiscoveryesi.com) and serves as a computer forensics consultant and eDiscovery expert to corporations and law firms. He can be reached at firstname.lastname@example.org.