±Your Account
Membership:
New Today: 0
New Yesterday: 4
Overall: 24209
Visitors: 47±Latest Webinar
±Latest Articles
· Android Forensics
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Go to page Previous 1, 2, 3 Next
True. but then look at Arthur Andersen and Enron. My point is that there will always be cases where in-house will not be sufficient just as there will be cases where readily accessible is not sufficient. When it comes to validating the ESI, CF investigators have more tools at their disposal than does the typical eDiscovery vendor.
Absolutely. I actually do a lot of both, especially for small businesses that simply can't afford in-house eDiscovery personnel or software.
And, I'll repeat my statement that eDiscovery production may not be sufficient for many cases. Consider, for example, the "discovery for discovery's sake" arguments against "one bite of the apple". If I were going to approach discovery in this way, I'd almost always want a CF investigator to do the limited discovery for the purposes of refining what should be requested for full production.
That was a corollary to my point, though not so directly. Assuming that the outside consultant (and this is true for any type of consulting) has a reasonable degree of autonomy/independence, there can be no question of bad faith on the part of the party, itself. No bad faith, no adverse inference.
The argument has been made that companies prone to many civil actions might find it less expensive to do the work in-house. Perhaps. But laws were changed for publicly traded companies to require that outside auditors certify certain financial statements (which is certainly more expensive), precisely due to the potential for conflict of interest (though that didn't help in certain high profile cases).
I suspect, based upon our experience, that we are going to see the evolution of a hybrid model where by outside, predominantly CF trained, individuals, provide input into the process while the implementation is left to in-house groups.
To illustrate, we recently had a case involving breach of contract, copyright violation, and theft of intellectual property. At issue was the extent to which the parties understood and agreed to the implied relationship (contract) between themselves. As is often the case, especially in start-ups and partnerships, both sides thought that there was an advantage, to themselves, if the terms of the agreement were vague.
This fell apart as soon as one party felt that the other had violated the agreement. The producing party was asked to provide all e-mail discussions with any individuals related to the evolution of their agreement. There were over 3 million e-mail records in the party's multiple accounts (and backups). The CF team was brought in to:
1. Verify that the search space included all e-mails that could be relevant (in other words, verify that all potentially relevant e-mails were included).
2. Reduce the searchable content to a manageable level by excluding messages to individuals who were not parties to the action and not aware of or involved with the parties of interest.
3. Eliminate the duplicates.
What was left was approximately 8,000 e-mails which could be relevant. These were, then, searched by the in-house team for responsiveness to the discovery request.
Outside CF can sometimes also help the requesting party to evaluate the issue of "hardship" which can make the difference in terms of what is included in the search.
My (admittedly self-serving), point is that an outside team can often lend a certain amount of objectivity and rationale to the actions taken in response to a discovery request/motion that might be less favorably viewed when proposed by the in-house team.
I have seen the future of eDiscovery
Re: I have seen the future of eDiscovery
Posted: Sat Jul 24, 2010 3:32 pm
As Qualcomm vs Broadcom proved, some people are going to try to play hide the data. And since this is the civil arena, and you don't have the option to shut them down as they are opening the door in the morning (aka kicking in the door) and seizing all their equipment before they can decide to start spoliation, we're just going to have to accept that cooperation on the part of the parties is required and some parties are going to try to compound the issue.
Realistically, if your client is a Fortune 500, and you're dealing with new litigation every day because they have thousands of custodians, and thousands of legal issues (suits, threatened suits, employee issues) every year, then it's not practical for outside counsel to independently investigate everything every time.
My 7 years in LEO CF mean I don't trust the other side to play fair either, but that's the system that we're dealing with. Thankfully, when they screw up because of incompetence or outright dishonesty, that's more work for the CF side to come in and sort out the mess.
It's interesting given that the Fed Civ Procedure rules have been in place a few years now that most of my clients are still having me do CF rather than requesting the other side to do discovery, but since most of my cases involve some element of alleged dishonesty on the part of one side, it's not surprising.
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6
Realistically, if your client is a Fortune 500, and you're dealing with new litigation every day because they have thousands of custodians, and thousands of legal issues (suits, threatened suits, employee issues) every year, then it's not practical for outside counsel to independently investigate everything every time.
My 7 years in LEO CF mean I don't trust the other side to play fair either, but that's the system that we're dealing with. Thankfully, when they screw up because of incompetence or outright dishonesty, that's more work for the CF side to come in and sort out the mess.
It's interesting given that the Fed Civ Procedure rules have been in place a few years now that most of my clients are still having me do CF rather than requesting the other side to do discovery, but since most of my cases involve some element of alleged dishonesty on the part of one side, it's not surprising.
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6
-

Patrick4n6 - Senior Member
Re: I have seen the future of eDiscovery
Posted: Sat Jul 24, 2010 4:00 pm
- Patrick4n6
Realistically, if your client is a Fortune 500, and you're dealing with new litigation every day because they have thousands of custodians, and thousands of legal issues (suits, threatened suits, employee issues) every year, then it's not practical for outside counsel to independently investigate everything every time.
True. but then look at Arthur Andersen and Enron. My point is that there will always be cases where in-house will not be sufficient just as there will be cases where readily accessible is not sufficient. When it comes to validating the ESI, CF investigators have more tools at their disposal than does the typical eDiscovery vendor.
- Patrick4n6
It's interesting given that the Fed Civ Procedure rules have been in place a few years now that most of my clients are still having me do CF rather than requesting the other side to do discovery, but since most of my cases involve some element of alleged dishonesty on the part of one side, it's not surprising.
Absolutely. I actually do a lot of both, especially for small businesses that simply can't afford in-house eDiscovery personnel or software.
And, I'll repeat my statement that eDiscovery production may not be sufficient for many cases. Consider, for example, the "discovery for discovery's sake" arguments against "one bite of the apple". If I were going to approach discovery in this way, I'd almost always want a CF investigator to do the limited discovery for the purposes of refining what should be requested for full production.
-

seanmcl - Senior Member
Re: I have seen the future of eDiscovery
Posted: Sun Jul 25, 2010 1:31 pm
We are a large (ginormous) firm with many many cases.
They Legal is convinced that it is cheaper to spend $250K over a weekend on a single case with outside vendor, than spending the same amount over a year to do it in-house.
They have yet to give me a real reason, but I believe a lot has to do with the ability to blame someone else other then ourselves, if something goes wrong.
They Legal is convinced that it is cheaper to spend $250K over a weekend on a single case with outside vendor, than spending the same amount over a year to do it in-house.
They have yet to give me a real reason, but I believe a lot has to do with the ability to blame someone else other then ourselves, if something goes wrong.
-

jhup - Senior Member
Re: I have seen the future of eDiscovery
Posted: Sun Jul 25, 2010 8:19 pm
- jhupThey Legal is convinced that it is cheaper to spend $250K over a weekend on a single case with outside vendor, than spending the same amount over a year to do it in-house.
That was a corollary to my point, though not so directly. Assuming that the outside consultant (and this is true for any type of consulting) has a reasonable degree of autonomy/independence, there can be no question of bad faith on the part of the party, itself. No bad faith, no adverse inference.
The argument has been made that companies prone to many civil actions might find it less expensive to do the work in-house. Perhaps. But laws were changed for publicly traded companies to require that outside auditors certify certain financial statements (which is certainly more expensive), precisely due to the potential for conflict of interest (though that didn't help in certain high profile cases).
I suspect, based upon our experience, that we are going to see the evolution of a hybrid model where by outside, predominantly CF trained, individuals, provide input into the process while the implementation is left to in-house groups.
To illustrate, we recently had a case involving breach of contract, copyright violation, and theft of intellectual property. At issue was the extent to which the parties understood and agreed to the implied relationship (contract) between themselves. As is often the case, especially in start-ups and partnerships, both sides thought that there was an advantage, to themselves, if the terms of the agreement were vague.
This fell apart as soon as one party felt that the other had violated the agreement. The producing party was asked to provide all e-mail discussions with any individuals related to the evolution of their agreement. There were over 3 million e-mail records in the party's multiple accounts (and backups). The CF team was brought in to:
1. Verify that the search space included all e-mails that could be relevant (in other words, verify that all potentially relevant e-mails were included).
2. Reduce the searchable content to a manageable level by excluding messages to individuals who were not parties to the action and not aware of or involved with the parties of interest.
3. Eliminate the duplicates.
What was left was approximately 8,000 e-mails which could be relevant. These were, then, searched by the in-house team for responsiveness to the discovery request.
Outside CF can sometimes also help the requesting party to evaluate the issue of "hardship" which can make the difference in terms of what is included in the search.
My (admittedly self-serving), point is that an outside team can often lend a certain amount of objectivity and rationale to the actions taken in response to a discovery request/motion that might be less favorably viewed when proposed by the in-house team.
-

seanmcl - Senior Member
Re: I have seen the future of eDiscovery
Posted: Sun Jul 25, 2010 9:34 pm
I've been a believer ever since I did my first Chinese wall in '04 - think US vs CDT for the arrangement, but we did it by agreement rather than by court order - that neutral examiners is the best way to go. If we were in a civil law country, then that would be the major role for us. In a common law country like the US, and Australia where I started, the adversarial system is not designed for neutrals, but I'm seeing a greater occurrence of special masters now and I think that's the future of eDiscovery if the costs are to be kept in check.
In the mean time, I certainly think it's worth having an independent specialist review the technical aspects of your discovery. That way you'll end up with less 200 keyword discovery requests, and also less 5 word searches as well. Frankly, many years of conducting searches has lead me to believe in an iterative refinement process rather than sticking to a planned search regime. I once heard an eDiscovery manager (non-technical guy) refer to it as "Zen" but there is both an art and a science to it.
So whilst I think that end-to-end discovery is the way to go for frequent litigators, I also believe that you're going to need to have a CF guy come in and validate your process once in a while. For example to make sure that exceptions are being raised for data deletion and the logs aren't being ignored by the in-house ED team, or where there's a claim of dishonesty on the part of the producing party, to overview the whole process to ensure that the alleged dishonesty isn't compounded.
jhup, these quarter million dollar weekends..... how can I get in on some of that?
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6
In the mean time, I certainly think it's worth having an independent specialist review the technical aspects of your discovery. That way you'll end up with less 200 keyword discovery requests, and also less 5 word searches as well. Frankly, many years of conducting searches has lead me to believe in an iterative refinement process rather than sticking to a planned search regime. I once heard an eDiscovery manager (non-technical guy) refer to it as "Zen" but there is both an art and a science to it.
So whilst I think that end-to-end discovery is the way to go for frequent litigators, I also believe that you're going to need to have a CF guy come in and validate your process once in a while. For example to make sure that exceptions are being raised for data deletion and the logs aren't being ignored by the in-house ED team, or where there's a claim of dishonesty on the part of the producing party, to overview the whole process to ensure that the alleged dishonesty isn't compounded.
jhup, these quarter million dollar weekends..... how can I get in on some of that?
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6
-

Patrick4n6 - Senior Member
Re: I have seen the future of eDiscovery
Posted: Mon Jul 26, 2010 3:35 am
Interesting read Tony, thanks. A couple of other notes for consideration/discussion - and there's some devil's advocate speak going on here as well:
Firstly - I'm internal resource at a $1Bn division of a $5 group - just because my company doesn't have a Retention Policy (never mind a Schedule) in place doesn't mean that the necessary Risk Assessment hasn't been done. Perhaps companies of our size and distribution (my Division is represented in something like 10 different legal jurisdictions (USA counts as one, otherwise double that number) have simply decided that the risk is either unlikely or manageable. We have estimated the time required to design and agree a policy/schedule, then implement it, as approx 2 years. Plus, an enormous hearts and minds effort to change the attitude of users and/or management to all forms of ESI. Maybe we just take our chances, even if litigation could hit us for tens of $M.
b) Even if we decided that we needed DR Policy and Schedule, do I really want one vendor in charge of the end-to-end process? Vendor security/technology/capability? For example, how many people out there now see f-Response as an invaluable tool? Would we still see the truly entrepreneurial products in future if we insisted on single vendor end-to-end?
c) Absolutley agree that IM is just another business process, and should be sold internally as such. Quite apart from eDiscovery and litigation holds, businesses should know what's in their knowledge estate, and where it is. How else can they properly protect what's important to them? Everyone keeps everything in unstructured storage, Management and IT shrug their shoulders and buy more disk space, then archiving solutions (which are disparate and don't connect). And finally comes the eDiscovery request and the Compliance guys say 'told you so'
My tu-pence worth
Firstly - I'm internal resource at a $1Bn division of a $5 group - just because my company doesn't have a Retention Policy (never mind a Schedule) in place doesn't mean that the necessary Risk Assessment hasn't been done. Perhaps companies of our size and distribution (my Division is represented in something like 10 different legal jurisdictions (USA counts as one, otherwise double that number) have simply decided that the risk is either unlikely or manageable. We have estimated the time required to design and agree a policy/schedule, then implement it, as approx 2 years. Plus, an enormous hearts and minds effort to change the attitude of users and/or management to all forms of ESI. Maybe we just take our chances, even if litigation could hit us for tens of $M.
b) Even if we decided that we needed DR Policy and Schedule, do I really want one vendor in charge of the end-to-end process? Vendor security/technology/capability? For example, how many people out there now see f-Response as an invaluable tool? Would we still see the truly entrepreneurial products in future if we insisted on single vendor end-to-end?
c) Absolutley agree that IM is just another business process, and should be sold internally as such. Quite apart from eDiscovery and litigation holds, businesses should know what's in their knowledge estate, and where it is. How else can they properly protect what's important to them? Everyone keeps everything in unstructured storage, Management and IT shrug their shoulders and buy more disk space, then archiving solutions (which are disparate and don't connect). And finally comes the eDiscovery request and the Compliance guys say 'told you so'
My tu-pence worth
-

Cults14 - Senior Member
Re: I have seen the future of eDiscovery
Posted: Mon Jul 26, 2010 7:33 pm
Yeah... I wish I could get one of those myself. I would be okay with 1 a year.
Few weeks ago I demonstrated that we can do identical work, with same results, at a fraction of the cost.
I got a free cup of coffee, but I had to get it myself in the cafeteria. Right at the free coffee dispenser.
Few weeks ago I demonstrated that we can do identical work, with same results, at a fraction of the cost.
I got a free cup of coffee, but I had to get it myself in the cafeteria. Right at the free coffee dispenser.
-

jhup - Senior Member
















