Easy-to-Use Collection Technology Leads to Lower e-Discovery Costs

Today, most legal departments turn to their IT department to conduct defensible collections or hire outside forensic experts for the job, believing this is the only defensible way to collect. This process is expensive and time-consuming, and often fraught with miscommunication between legal teams and technology experts. Nonetheless, this is the path that many corporations feel compelled to take because they lack alternatives.

Unfortunately, this method of managing collections often entails the use of complicated forensic tools that typically create enormous collections. These tools are so difficult to use that only a technology expert can manage them. As a result, legal teams tend to ask for an image of the entire hard drive or a massive download of all the custodian's drives so they don't have to go back to IT; again yielding massive collections that take more resources and costs to sort through in the next phase of e-discovery. Further complicating matters, sometimes IT may use tools that were not specifically designed for electronic discovery collections. Some teams use backup utilities, while others are homegrown scripts created to accomplish the base collection task. Very few of these tools, however, support any kind of collaboration between legal and IT; nor do they provide a defensible audit trail.

In addition to using complex tools, corporations or outside counsel often hire certified forensic experts to perform collections. While experts bring specialized expertise ' including, for example, the ability to reconstruct deleted material from hard drives ' that level of service is often not needed. Employing costly experts should be reserved for those unique situations where it's reasonable to suspect data is in danger of being destroyed or modified, such as a custodian who appears to have purposely deleted data or a hold that was not properly communicated.

Whether outsourced to IT or to a forensic expert, these solutions tend to be expensive, encourage organizations to collect too much data and are disruptive to business operations. For example, collecting from a remote laptop can require the collector to physically extract data from a computer. If the collection takes place at the local office, then it can be as easy as walking down the hall and imaging the laptop right there. But often collections involve getting data from an employee in a distant office, or even a remote location, such as an employee's home office. In cases where a remote collection technology is not available, IT or forensic experts have to travel to complete the collection. This is time-consuming, expensive and highly disruptive to business operations. For example, it can take several hours to perform a forensic image of the entire contents of an employee's laptop ' impacting productivity as the employee waits for the return of the laptop. So the company takes three hits: the consultant fees; travel costs; and loss of the employee's productivity.

Shrink Large Volumes of Data With Targeted Collections

Currently, corporations collect vast amounts of information from the same custodians repeatedly and then pay for it to be processed, reviewed by counsel and stored for each case. But there's a better way: targeted collections. New, easy-to-use technology is allowing corporate legal teams to conduct targeted collections to filter data and shrink collection size rather than grab everything in an image or a massive collection. This new approach is made possible, first of all, by having thorough, effective legal hold procedures in place that give the legal team the confidence that relevant ESI will be preserved and available for rolling collections if necessary. Second, corporate legal teams, IT and internal forensics groups now have the technology to filter data during collection rather than waiting to eliminate duplicates, junk files and clearly non-responsive data during early case assessment or legal review.

Easy-to-use collection software that supports remote collections and cloud repository collections gives non-technical experts, not just forensics experts, the ability to perform collections. Corporate legal teams no longer have to grab everything on that computer or try to narrow the collection with overly complicated tools. Instead, they can select only those files, file types or e-mail date ranges that realistically may have relevant ESI. The best new collection tools also enable collections and filtering from cloud storage repositories like Box, Dropbox and Amazon Web Services, where more and more corporate and BYOD (Bring Your Own Device) ESI resides. Imagine starting a collection by quickly targeting only the data most likely on point from a short list of key custodians and from a specified date range. Before you ever hit the “collect” button, you can also eliminate any duplicates based on MD5 hashing and systems files.

All this targeting during collections, rather than after the fact, means legal teams and law firms aren't forced to wade through non-responsive data and duplicates as they start to assess their case and move on to full review for privilege and relevancy. This makes their legal work much more efficient and cost-effective ' and legal departments avoid paying for processing and review of irrelevant data, like vacation pictures, system files and completely off-topic files or e-mails.

Another way to leverage a targeted collections approach is to apply filters to the ESI of former employees that has been preserved “just in case” there is litigation down the road. Former employee data is often stored away on hard drives in storage closets somewhere, gathering dust and taking up way more space than necessary on a litigation server. This data is at risk for breach and leakage; the more there is, the higher the level of risk. A much better approach is to use newer collection tools to filter down former employees' ESI to a reasonable set of potentially responsive data, preserving only a small subset of the original data and destroying the superfluous data according to your records retention policy.

Use Forensic Experts and Complex Tools Only When Needed

In the past, many legal departments have hired a forensic expert or used complex forensic tools for every collection. However, teams are now realizing that if they have a good legal hold system and a thorough custodian interview process in place, they can be more confident that there are not bad actors deleting information ' requiring an expert to reconstruct data using forensic solutions and techniques.

When it is truly necessary to grab fragments of deleted e-mails off of a hard drive, then hiring a forensic expert or having an internal expert conduct that collection is a good idea. No question, these highly trained experts can save your bacon and testify in court as well, especially when dealing with spoliation charges. But the de facto collection approach doesn't have to be, “I need a forensic collection for reconstruction of evidence,” nor do legal teams necessarily have to hire an expert to testify before the court to affirm the data was collected in a valid way.

Today, corporate teams can deploy easy-to-use technology to conduct forensically sound collections where the selected data is collected in a “container” (much like an electronic evidence bag) that keeps all the metadata intact and preserves a detailed collection audit trail for reporting all the details surrounding the collection, including the chain of custody, filtering decisions made by the collector, and any errors or exceptions. The technology documents precisely what device was collected, when, and by whom. It also documents the size of files before and after the collection, and provides details of the decision-making process along the way, establishing that a collection was forensically sound and defensible in court.

This new technology puts the power of forensically sound collections in the hands of the legal team ' professionals who have the best understanding of the legal issues of a particular matter, and who are in the best position to make judgment calls on what to include or exclude in the collection. When legal teams perform collections, they get quicker access to the ESI. This gives them a head start on developing case strategy and informs their preparations to negotiate at meet-and-confer sessions.

Given that proportionality is an important goal articulated by the new amendments to the Federal Rules of Civil Procedure, courts will welcome forensically sound, targeted collections, which speed up the discovery process so litigants can get to the merits of the case faster.

Looking Forward

The trend of exploding data volumes and types will only continue as employees take advantage of new forms of mobility that affect the ways they work, communicate, and share and store information. The “collect everything” mentality is simply not sustainable, particularly in cases where there is no reason to suspect bad behavior among custodians. Corporate law departments are learning that they can now perform defensible, forensically sound, targeted collections themselves, both locally and remotely, dramatically reducing e-discovery costs and increasing the efficiency of the collection process.

Brad Harris is Vice President of Products for Zapproved, Inc. A frequent author and speaker on data preservation and e-discovery issues, including presentations at leading industry events such as LegalTech New York, Brad has more than 30 years of experience in the high technology and enterprise software sectors.

Corporate legal departments today are feeling the squeeze. The proliferation of discoverable data stored in far-flung locations and on all sorts of personal mobile devices complicates the e-discovery process. Even the first preservation step of identifying all the potential custodians and their data sources is more involved now, with data being stored on document collaboration sites, e-mail servers and social media in the cloud. Compounding this challenge is the increasing pressure corporate legal teams feel to be accountable for their department's litigation spend.

Corporate legal departments are all about cost control and efficient processes, yet when hit with a new investigation or lawsuit, legal teams often reflexively fall back on the “collect everything” mentality. The emergence of targeted and remote collection technologies now makes it possible for corporations to collect in a legally defensible way that reduces cost and minimizes business disruption. One key is to be sure that the collections process is tightly linked with a highly defensible legal hold notification process and preservation best practices. With the right technology and a targeted approach to collections, corporations can collect electronically stored information (ESI) confidently and affordably.

A Look at Collections Today

Today, most legal departments turn to their IT department to conduct defensible collections or hire outside forensic experts for the job, believing this is the only defensible way to collect. This process is expensive and time-consuming, and often fraught with miscommunication between legal teams and technology experts. Nonetheless, this is the path that many corporations feel compelled to take because they lack alternatives.

Unfortunately, this method of managing collections often entails the use of complicated forensic tools that typically create enormous collections. These tools are so difficult to use that only a technology expert can manage them. As a result, legal teams tend to ask for an image of the entire hard drive or a massive download of all the custodian's drives so they don't have to go back to IT; again yielding massive collections that take more resources and costs to sort through in the next phase of e-discovery. Further complicating matters, sometimes IT may use tools that were not specifically designed for electronic discovery collections. Some teams use backup utilities, while others are homegrown scripts created to accomplish the base collection task. Very few of these tools, however, support any kind of collaboration between legal and IT; nor do they provide a defensible audit trail.

In addition to using complex tools, corporations or outside counsel often hire certified forensic experts to perform collections. While experts bring specialized expertise ' including, for example, the ability to reconstruct deleted material from hard drives ' that level of service is often not needed. Employing costly experts should be reserved for those unique situations where it's reasonable to suspect data is in danger of being destroyed or modified, such as a custodian who appears to have purposely deleted data or a hold that was not properly communicated.

Whether outsourced to IT or to a forensic expert, these solutions tend to be expensive, encourage organizations to collect too much data and are disruptive to business operations. For example, collecting from a remote laptop can require the collector to physically extract data from a computer. If the collection takes place at the local office, then it can be as easy as walking down the hall and imaging the laptop right there. But often collections involve getting data from an employee in a distant office, or even a remote location, such as an employee's home office. In cases where a remote collection technology is not available, IT or forensic experts have to travel to complete the collection. This is time-consuming, expensive and highly disruptive to business operations. For example, it can take several hours to perform a forensic image of the entire contents of an employee's laptop ' impacting productivity as the employee waits for the return of the laptop. So the company takes three hits: the consultant fees; travel costs; and loss of the employee's productivity.

Shrink Large Volumes of Data With Targeted Collections

Currently, corporations collect vast amounts of information from the same custodians repeatedly and then pay for it to be processed, reviewed by counsel and stored for each case. But there's a better way: targeted collections. New, easy-to-use technology is allowing corporate legal teams to conduct targeted collections to filter data and shrink collection size rather than grab everything in an image or a massive collection. This new approach is made possible, first of all, by having thorough, effective legal hold procedures in place that give the legal team the confidence that relevant ESI will be preserved and available for rolling collections if necessary. Second, corporate legal teams, IT and internal forensics groups now have the technology to filter data during collection rather than waiting to eliminate duplicates, junk files and clearly non-responsive data during early case assessment or legal review.

Easy-to-use collection software that supports remote collections and cloud repository collections gives non-technical experts, not just forensics experts, the ability to perform collections. Corporate legal teams no longer have to grab everything on that computer or try to narrow the collection with overly complicated tools. Instead, they can select only those files, file types or e-mail date ranges that realistically may have relevant ESI. The best new collection tools also enable collections and filtering from cloud storage repositories like Box, Dropbox and Amazon Web Services, where more and more corporate and BYOD (Bring Your Own Device) ESI resides. Imagine starting a collection by quickly targeting only the data most likely on point from a short list of key custodians and from a specified date range. Before you ever hit the “collect” button, you can also eliminate any duplicates based on MD5 hashing and systems files.

All this targeting during collections, rather than after the fact, means legal teams and law firms aren't forced to wade through non-responsive data and duplicates as they start to assess their case and move on to full review for privilege and relevancy. This makes their legal work much more efficient and cost-effective ' and legal departments avoid paying for processing and review of irrelevant data, like vacation pictures, system files and completely off-topic files or e-mails.

Another way to leverage a targeted collections approach is to apply filters to the ESI of former employees that has been preserved “just in case” there is litigation down the road. Former employee data is often stored away on hard drives in storage closets somewhere, gathering dust and taking up way more space than necessary on a litigation server. This data is at risk for breach and leakage; the more there is, the higher the level of risk. A much better approach is to use newer collection tools to filter down former employees' ESI to a reasonable set of potentially responsive data, preserving only a small subset of the original data and destroying the superfluous data according to your records retention policy.

Use Forensic Experts and Complex Tools Only When Needed

In the past, many legal departments have hired a forensic expert or used complex forensic tools for every collection. However, teams are now realizing that if they have a good legal hold system and a thorough custodian interview process in place, they can be more confident that there are not bad actors deleting information ' requiring an expert to reconstruct data using forensic solutions and techniques.

When it is truly necessary to grab fragments of deleted e-mails off of a hard drive, then hiring a forensic expert or having an internal expert conduct that collection is a good idea. No question, these highly trained experts can save your bacon and testify in court as well, especially when dealing with spoliation charges. But the de facto collection approach doesn't have to be, “I need a forensic collection for reconstruction of evidence,” nor do legal teams necessarily have to hire an expert to testify before the court to affirm the data was collected in a valid way.

Today, corporate teams can deploy easy-to-use technology to conduct forensically sound collections where the selected data is collected in a “container” (much like an electronic evidence bag) that keeps all the metadata intact and preserves a detailed collection audit trail for reporting all the details surrounding the collection, including the chain of custody, filtering decisions made by the collector, and any errors or exceptions. The technology documents precisely what device was collected, when, and by whom. It also documents the size of files before and after the collection, and provides details of the decision-making process along the way, establishing that a collection was forensically sound and defensible in court.

This new technology puts the power of forensically sound collections in the hands of the legal team ' professionals who have the best understanding of the legal issues of a particular matter, and who are in the best position to make judgment calls on what to include or exclude in the collection. When legal teams perform collections, they get quicker access to the ESI. This gives them a head start on developing case strategy and informs their preparations to negotiate at meet-and-confer sessions.

Given that proportionality is an important goal articulated by the new amendments to the Federal Rules of Civil Procedure, courts will welcome forensically sound, targeted collections, which speed up the discovery process so litigants can get to the merits of the case faster.

Looking Forward

The trend of exploding data volumes and types will only continue as employees take advantage of new forms of mobility that affect the ways they work, communicate, and share and store information. The “collect everything” mentality is simply not sustainable, particularly in cases where there is no reason to suspect bad behavior among custodians. Corporate law departments are learning that they can now perform defensible, forensically sound, targeted collections themselves, both locally and remotely, dramatically reducing e-discovery costs and increasing the efficiency of the collection process.

Brad Harris is Vice President of Products for Zapproved, Inc. A frequent author and speaker on data preservation and e-discovery issues, including presentations at leading industry events such as LegalTech New York, Brad has more than 30 years of experience in the high technology and enterprise software sectors.