Law.com Subscribers SAVE 30%

Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.

Electronic Data Discovery: It's All About Access

By Trey Wilkins
April 28, 2005

More often than not, elements of corporate investigations and legal proceedings come to an abrupt halt because archived electronic files can't be accessed. But thanks to the latest generation of restoration software applications, access can now be gained to virtually all archived electronic files. This new level of access is having a tremendous impact on litigation and corporate record-keeping.

Barriers To Data
Retrieval Are Eliminated

It's always been the prevalent opinion of the courts and others in the legal profession that most archived electronic files simply can't be accessed through traditional electronic discovery techniques and, as such, critical evidence is often not introduced. This opinion is perpetuated by three perceived barriers:

  1. The operating systems and applications used to store information are unknown. This is because the parties who originated the documents are no longer available, perhaps, and so are unable to provide direction.
  2. Even when the software and media are known, it's likely that the programs are obsolete and that support from the manufacturer is no longer available. Translation: The systems needed to run the programs are unattainable.
  3. Personnel with knowledge of the stored or backup files are no longer employed by the enterprise in question. In many cases, staff members who can sort through enormous amounts of data to discern which files are important and which are not may have moved on to other positions.

With the development of non-native restoration software applications, though, these barriers have been eliminated, and access can be provided to an extensive range of storage media. Experts estimate that more than 300 families of tape drives and hundreds of software formats have been used over the years to store e-data. Nevertheless, non-native restoration allows firms to restore data regardless of the physical or logical format of the tape media, floppy media or optical platter ' without having to recreate the originating or “native” environment, or the combination of hardware and software that was used when the original materials were preserved. Even the oldest formats can be accessed, including media from 30 or more years ago, such as 10-inch floppy disks and the earliest generations of magnetic tape.

Non-native restoration applications are also able to circumvent complex security features that prevent access to certain files. For example, backup data is designed to be read by the originating application and sometimes has embedded passwords placed in the data stream. The native application restoring this data “knows” to interrogate the user for the password at this point and, if the password does not match, deny access. Non-native restoration can bypass this obstacle. Likewise, data can be retrieved when the medium has been damaged or the data compromised. In reality, the only time when retrieval is impossible is when data has been overwritten.

How Non-native Restoration Works

When attempts to natively restore data are made, a complex set of variables comes into play. To start, hardware or tape drives that are compatible with the data must be identified; in other words, do the media match the hardware? Once the appropriate hardware is found, a second question is raised: Can the operating system internal to the tape drive read the media, making sense of the raw 1s and 0s that encrypt the information? When these hurdles are overcome, the appropriate software application is launched to translate the data into a readable and useable format.

Although this might seem like a straightforward process, it quickly becomes unmanageable when the varieties of hardware and software are considered. There are hundreds of different tape drives (DLT, LTO, AIT, 8 mm and 4 mm, etc.) and countless software applications (Veritas, Legato, Tivoli, ArcServe, NT, Tar, etc.). Plus, these applications have evolved through thousands of versions and each is no longer compatible with older versions. Backward compatibility can be an issue, too. For instance, the current version of the application might not understand data generated by an earlier version of the same application.

The gist of it: When trying to create the originating environment, organizations may need to purchase and try several tape drives before identifying one that will actually access the stored data. Then, the organization might need to purchase the applications and licensing for potential operating systems and software programs ' and all potentially relevant versions that might have been released over the years. In some cases, the tape hardware and backup software may no longer be available because the vendor has gone out of business or the model is obsolete. Through trial and error (a process that may never bear fruit), the proper combination of hardware and software might be discovered to retrieve the information contained on the file. In any event, the effort is prohibitively expensive, in time and money.

Non-native restoration bypasses this matrix of variables. Vendors of this technology, such as eMag Solutions, have spent years developing the in-house capability to decode the intricacies of various drives, operating systems and software applications, relying on a significant pool of knowledge gathered over the years. These vendors have also developed the capability of converting e-mail messages from all servers and systems, including foreign scripts like Cyrillic.

Most e-discovery vendors capable of non-native restoration work closely with major litigation consultants and law firms that handle corporate litigation issues. While each case is unique and requires a custom approach, all demand meticulous planning and standardized procedures throughout each stage of the restoration process. Specialists highly trained in the art and science of restoration oversee the projects and determine how best to apply advanced technology to retrieve the information.

At the start of the e-discovery process, non-native restoration applications access the header contained at the beginning of the computer storage tape. This header contains vital information about the tape, including the system on which it was created, the type and version of software program used to save the data, and any salient setup information. From this, the application begins to precategorize the internal database and determine what is required to populate the database.

As the process moves ahead, the application pulls data off the tape and moves it into today's environment ' from an obsolete AS400 server, for instance, onto a state-of-the-art PC. From here, data is saved and can then be manipulated and used as required. This makes it possible to convert from one type of data structure to another (eg, writing converted data to a different tape or operating system), from one type media to another (from 9840 to LTO3), from one format to another (Novell to a PC) and from one magento-optical platform to another (optical platters to a CD or DVD).

As data restoration is occurring, it is possible to dynamically deduplicate on the fly, which also represents a tremendous savings of storage space, time and money. Each time a document is opened and revised, a copy of that version is saved within the program, creating duplicates. These copies are, in turn, stored on the backup media. eMag's application, for instance, eliminates all repetitions through a process known as deduplication, often resulting in a 30%-80% reduction in data. This means it is easier and faster to examine the remaining data to determine what can be productively used.

e-Discovery vendors often provide online repository and storage where extracted data is hosted in the native format so that client organizations can query data, and electronically review and cull document content prior to complete conversion.

Surveying The Impact

Use of non-native restoration represents an e-discovery breakthrough with far-reaching significance. Essentially, if data has been stored or backed up, it can be retrieved in virtually all cases.

Most corporate organizations believe in the value of storing important data and materials ' operating under the assumption that the more they keep, the less risk they face. And, to a large degree, this is correct, thanks to increasing compliance demands that have resulted from legislation like Securities and Exchange Commission (SEC) requirements, the Healthcare Information Portability and Accountability Act (HIPAA), and Sarbanes-Oxley. Failure to respond to requests for data can lead to fines, economic sanctions and litigation. With non-native data restoration, though, organizations now have the ability not only to access historical data, but also to easily catalog, organize and analyze the information. Once retrieved, data can be converted to contemporary programs so that it becomes useable, and actionable.

On the other hand, easy access to electronic data can influence organizations to keep too much archival information. Most regulatory agencies require that records be kept for a prescribed number of years. But if files beyond that term are requested and if the organization has stored them, they must also be produced. With the advent of non-native restoration, companies can no longer contend that older data is inaccessible. On more than one occasion, the practice of keeping files longer than required has offered the opportunity for a smoking gun to be uncovered. The danger there for the responding party is that excess data storage can result in excessive exposure to discovery risk.

[Editor's note: In next month's edition, we'll conclude this article with a brief overview of non-native restoration case study thumbnail sketches, and some tips on selecting an e-discovery vendor with expertise in non-native restoration. Also, see our story in this edition, "A Bird's-eye View Of e-Discovery: Get A Feel For The Overall Process And The Crowded Field Of Vendors." ]



Trey Wilkins [email protected] http://www.emaglink.com/

More often than not, elements of corporate investigations and legal proceedings come to an abrupt halt because archived electronic files can't be accessed. But thanks to the latest generation of restoration software applications, access can now be gained to virtually all archived electronic files. This new level of access is having a tremendous impact on litigation and corporate record-keeping.

Barriers To Data
Retrieval Are Eliminated

It's always been the prevalent opinion of the courts and others in the legal profession that most archived electronic files simply can't be accessed through traditional electronic discovery techniques and, as such, critical evidence is often not introduced. This opinion is perpetuated by three perceived barriers:

  1. The operating systems and applications used to store information are unknown. This is because the parties who originated the documents are no longer available, perhaps, and so are unable to provide direction.
  2. Even when the software and media are known, it's likely that the programs are obsolete and that support from the manufacturer is no longer available. Translation: The systems needed to run the programs are unattainable.
  3. Personnel with knowledge of the stored or backup files are no longer employed by the enterprise in question. In many cases, staff members who can sort through enormous amounts of data to discern which files are important and which are not may have moved on to other positions.

With the development of non-native restoration software applications, though, these barriers have been eliminated, and access can be provided to an extensive range of storage media. Experts estimate that more than 300 families of tape drives and hundreds of software formats have been used over the years to store e-data. Nevertheless, non-native restoration allows firms to restore data regardless of the physical or logical format of the tape media, floppy media or optical platter ' without having to recreate the originating or “native” environment, or the combination of hardware and software that was used when the original materials were preserved. Even the oldest formats can be accessed, including media from 30 or more years ago, such as 10-inch floppy disks and the earliest generations of magnetic tape.

Non-native restoration applications are also able to circumvent complex security features that prevent access to certain files. For example, backup data is designed to be read by the originating application and sometimes has embedded passwords placed in the data stream. The native application restoring this data “knows” to interrogate the user for the password at this point and, if the password does not match, deny access. Non-native restoration can bypass this obstacle. Likewise, data can be retrieved when the medium has been damaged or the data compromised. In reality, the only time when retrieval is impossible is when data has been overwritten.

How Non-native Restoration Works

When attempts to natively restore data are made, a complex set of variables comes into play. To start, hardware or tape drives that are compatible with the data must be identified; in other words, do the media match the hardware? Once the appropriate hardware is found, a second question is raised: Can the operating system internal to the tape drive read the media, making sense of the raw 1s and 0s that encrypt the information? When these hurdles are overcome, the appropriate software application is launched to translate the data into a readable and useable format.

Although this might seem like a straightforward process, it quickly becomes unmanageable when the varieties of hardware and software are considered. There are hundreds of different tape drives (DLT, LTO, AIT, 8 mm and 4 mm, etc.) and countless software applications (Veritas, Legato, Tivoli, ArcServe, NT, Tar, etc.). Plus, these applications have evolved through thousands of versions and each is no longer compatible with older versions. Backward compatibility can be an issue, too. For instance, the current version of the application might not understand data generated by an earlier version of the same application.

The gist of it: When trying to create the originating environment, organizations may need to purchase and try several tape drives before identifying one that will actually access the stored data. Then, the organization might need to purchase the applications and licensing for potential operating systems and software programs ' and all potentially relevant versions that might have been released over the years. In some cases, the tape hardware and backup software may no longer be available because the vendor has gone out of business or the model is obsolete. Through trial and error (a process that may never bear fruit), the proper combination of hardware and software might be discovered to retrieve the information contained on the file. In any event, the effort is prohibitively expensive, in time and money.

Non-native restoration bypasses this matrix of variables. Vendors of this technology, such as eMag Solutions, have spent years developing the in-house capability to decode the intricacies of various drives, operating systems and software applications, relying on a significant pool of knowledge gathered over the years. These vendors have also developed the capability of converting e-mail messages from all servers and systems, including foreign scripts like Cyrillic.

Most e-discovery vendors capable of non-native restoration work closely with major litigation consultants and law firms that handle corporate litigation issues. While each case is unique and requires a custom approach, all demand meticulous planning and standardized procedures throughout each stage of the restoration process. Specialists highly trained in the art and science of restoration oversee the projects and determine how best to apply advanced technology to retrieve the information.

At the start of the e-discovery process, non-native restoration applications access the header contained at the beginning of the computer storage tape. This header contains vital information about the tape, including the system on which it was created, the type and version of software program used to save the data, and any salient setup information. From this, the application begins to precategorize the internal database and determine what is required to populate the database.

As the process moves ahead, the application pulls data off the tape and moves it into today's environment ' from an obsolete AS400 server, for instance, onto a state-of-the-art PC. From here, data is saved and can then be manipulated and used as required. This makes it possible to convert from one type of data structure to another (eg, writing converted data to a different tape or operating system), from one type media to another (from 9840 to LTO3), from one format to another (Novell to a PC) and from one magento-optical platform to another (optical platters to a CD or DVD).

As data restoration is occurring, it is possible to dynamically deduplicate on the fly, which also represents a tremendous savings of storage space, time and money. Each time a document is opened and revised, a copy of that version is saved within the program, creating duplicates. These copies are, in turn, stored on the backup media. eMag's application, for instance, eliminates all repetitions through a process known as deduplication, often resulting in a 30%-80% reduction in data. This means it is easier and faster to examine the remaining data to determine what can be productively used.

e-Discovery vendors often provide online repository and storage where extracted data is hosted in the native format so that client organizations can query data, and electronically review and cull document content prior to complete conversion.

Surveying The Impact

Use of non-native restoration represents an e-discovery breakthrough with far-reaching significance. Essentially, if data has been stored or backed up, it can be retrieved in virtually all cases.

Most corporate organizations believe in the value of storing important data and materials ' operating under the assumption that the more they keep, the less risk they face. And, to a large degree, this is correct, thanks to increasing compliance demands that have resulted from legislation like Securities and Exchange Commission (SEC) requirements, the Healthcare Information Portability and Accountability Act (HIPAA), and Sarbanes-Oxley. Failure to respond to requests for data can lead to fines, economic sanctions and litigation. With non-native data restoration, though, organizations now have the ability not only to access historical data, but also to easily catalog, organize and analyze the information. Once retrieved, data can be converted to contemporary programs so that it becomes useable, and actionable.

On the other hand, easy access to electronic data can influence organizations to keep too much archival information. Most regulatory agencies require that records be kept for a prescribed number of years. But if files beyond that term are requested and if the organization has stored them, they must also be produced. With the advent of non-native restoration, companies can no longer contend that older data is inaccessible. On more than one occasion, the practice of keeping files longer than required has offered the opportunity for a smoking gun to be uncovered. The danger there for the responding party is that excess data storage can result in excessive exposure to discovery risk.

[Editor's note: In next month's edition, we'll conclude this article with a brief overview of non-native restoration case study thumbnail sketches, and some tips on selecting an e-discovery vendor with expertise in non-native restoration. Also, see our story in this edition, "A Bird's-eye View Of e-Discovery: Get A Feel For The Overall Process And The Crowded Field Of Vendors." ]



Trey Wilkins [email protected] http://www.emaglink.com/
Read These Next
Strategy vs. Tactics: Two Sides of a Difficult Coin Image

With each successive large-scale cyber attack, it is slowly becoming clear that ransomware attacks are targeting the critical infrastructure of the most powerful country on the planet. Understanding the strategy, and tactics of our opponents, as well as the strategy and the tactics we implement as a response are vital to victory.

Major Differences In UK, U.S. Copyright Laws Image

This article highlights how copyright law in the United Kingdom differs from U.S. copyright law, and points out differences that may be crucial to entertainment and media businesses familiar with U.S law that are interested in operating in the United Kingdom or under UK law. The article also briefly addresses contrasts in UK and U.S. trademark law.

'Huguenot LLC v. Megalith Capital Group Fund I, L.P.': A Tutorial On Contract Liability for Real Estate Purchasers Image

In June 2024, the First Department decided Huguenot LLC v. Megalith Capital Group Fund I, L.P., which resolved a question of liability for a group of condominium apartment buyers and in so doing, touched on a wide range of issues about how contracts can obligate purchasers of real property.

Fresh Filings Image

Notable recent court filings in entertainment law.

The Article 8 Opt In Image

The Article 8 opt-in election adds an additional layer of complexity to the already labyrinthine rules governing perfection of security interests under the UCC. A lender that is unaware of the nuances created by the opt in (may find its security interest vulnerable to being primed by another party that has taken steps to perfect in a superior manner under the circumstances.