© 2007 LexisNexis. All rights reserved. Keating Muething & Klekamp E-Discovery Fundamentals CLE...

© 2007 LexisNexis. All rights reserved.

Keating Muething & Klekamp Keating Muething & Klekamp E-Discovery Fundamentals CLEE-Discovery Fundamentals CLE

• Larry W. Conner, Esq. (Bud)Larry W. Conner, Esq. (Bud)Electronic Discovery SpecialistElectronic Discovery Specialist

• Brenna L. Penrose, KMKBrenna L. Penrose, KMK

• Stephanie M. Maw, KMKStephanie M. Maw, KMK

• Cincinnati, OHNovember 8, 2007


Session OverviewSession Overview

• E-Discovery Fundamentals The Paperless Office Understanding Electronic Files Harnessing Efficiencies Unique to Electronic Files

• Amendments to the Federal Rules of Civil Procedure/Duty to Preserve and Legal Holds

• Sanctions

• Data Collection, Evidentiary Issues and Chain of Custody


E-Discovery FundamentalsE-Discovery Fundamentals


What Makes E-Discovery DifferentWhat Makes E-Discovery Different

• Volume & Duplicability

• Persistence

• Dynamic & Changeable

• Metadata


Volume and DuplicabilityVolume and Duplicability─The Paperless Office─The Paperless Office

• Volume of Electronic Data is Increasing

• 99% of new information is stored electronically (most on hard disks)

• An estimated 97 billion email messages are sent each day

• Most Data is Stored Only Electronically

• Less than 1/3 of e-documents are ever printed

• 60% of business-critical info is stored within corporate email systems

• Few companies proactively manage document storage


PersistencePersistence

• Data is More Difficult to Dispose of than Paper

• Shredded paper document is essentially irretrievable

• “Delete” a misnomer in e-discovery

• With Electronic Data, a Little Goes a Long Way:

• 1 megabyte = A short novel

• 1 gigabyte = A pickup truck filled with books

• 1 terabyte = 50,000 trees reduced to paper

One Gigabyte of Electronic Documents Contains an average of 75,000 pages.


PersistencePersistence─Where Are Electronic Files Located?─Where Are Electronic Files Located?

• Hard drives (at office and at home) – hard drive storage accounts for more than 55% of total data storage each year

• Back up tapes

• Email Servers

• File servers

• CDs and DVDs

• 3.5” disks and zip disks

• Personal Digital Assistants (Palm, Blackberry, etc.


Dynamic and ChangeableDynamic and Changeable

• Computer data has the potential to automatically update and backup files.

• In many instances, these changes take place without human intervention.


MetadataMetadata

Ability to retain all 3 dimensions:

• Front of document: The Image

• The “face” of the document

• Middle of document: The Text

• What the document “says”

• Document content fully searchable

• Back of document: Meta Data

• Meta data = data about the document

• Ex: date created, bcc, links to attachments


Why Metadata MattersWhy Metadata Matters

• Provides additional information about the document you might not find in the paper version

• Provides the “authenticity” of the document

• Provides link between email and attachment(s)

• Provides link between conversation threads

• Allows for de-duplication


Why Metadata MattersWhy Metadata Matters─New Efficiencies─New Efficiencies

• Duplicates are identified & consistently tagged

• 100% text indexed = accurate searches

• All meta data captured & searchable

• Email conversations preserved

• “Parent-child” relationships preserved

• Web-based repository with access from any computer with Internet connection


Amendments to the Federal Amendments to the Federal Rules of Civil ProcedureRules of Civil Procedure

Recognition of the Impact of Electronic Documents on the Discovery Process


Amendments to the Amendments to the Federal Rules of Civil ProcedureFederal Rules of Civil Procedure

• Effective December 1, 2006

• Changes to Rules 16, 26, 33, 37 & 45

• Will affect cases filed after effective date, and all proceedings then pending “in so far as just and practicable.”


Amendments to the Amendments to the Federal Rules of Civil ProcedureFederal Rules of Civil Procedure

• Rule 16: Provisions in court’s scheduling order pertaining to discovery or disclosure of ESI

• Rule 26: Discussion of electronic discovery issues during parties’ discovery-planning conference

• Rule 33: Permits a party to respond to an interrogatory by specifying the ESI from which the answer can be gleaned

• Rule 34: Adds a new category of discoverable information called “electronically stored information” and provides options for form of production

• Rule 37: Safe harbor for ESI deleted as a result of routine operation of information management system

• Rule 45: Provides conditions for non-party production of ESI• Form 35: Includes parties’ proposed discovery plan for ESI


Amendments to the Amendments to the Federal Rules of Civil ProcedureFederal Rules of Civil Procedure Scope of Discoverability of Electronic Documents

Definition of “Document” Inaccessible Electronic Files

Discovery Duties Duty to Preserve Duty to Investigate Duty to Disclose

Issues Pertaining to Production Form of Production

• Native File Production• Meta Data Production

Inadvertent Production Cost Shifting Sanctions


Electronically Stored InformationElectronically Stored Information

Rule 34• Purposefully Broad• The basic legal framework is the same as for paper

documents.• Authorizes requests for the production of documents,

including “electronic data compilations.”

• The definition of a Rule 34 “document” has implicitly included electronic data for more than 30 years.

PRACTICE TIP: EVERY request for documents is a request for ELECTRONIC DOCUMENTS as well as for paper documents.


Electronically Stored InformationElectronically Stored Information

• Rule 34(a) adds an entirely new category of discoverable information called “Electronically Stored Information” (“ESI”) • Specifically includes writings, drawings, images and other

data or data compilations stored in any medium from which information can be obtained or translated into a reasonably usable form.

Previous Rule on Discovery

• Everything relevant is discoverable• Responding parties seek protective order under Rule 26(c)

• Must demonstrate “affirmative and compelling proof” of “undue burden”

United States of America v. Americagroup Illinois, Inc., 2005 U.S. Dist. LEXIS 24929 (N.D. Ill. October 21, 2005)


Electronically Stored Electronically Stored InformationInformation─Reasonable Accessibility─Reasonable Accessibility

FRCP Rules 26(b)(2)(B) & 45(d)(1)(C)

• Discovery if data is not reasonably accessible • Responding party not required to produce if not reasonably

accessible due to undue burden/cost• Party still has duty to preserve inaccessible ESI• Upon the requesting party's motion, responding party must

show that the information is not reasonably accessible• Even if showing is made, court may still order production if

requesting party demonstrates good cause• Court may specify conditions for the discovery

(cost-shifting)



Courts’ Determinations of “Unduly Burdensome.”• Responding party’s limited interest in

case. Burkholder v. Local 12, A.A.W., 2006 U.S. Dist. Lexis 45312 (N.D. Ohio July 5, 2006)

• Labor–intensive production of legacy systems.Rowe Ent’t v. William Morris Agency, 205 F.R.D. 421 (S.D.N.Y. 2002)

• Significant financial burden on responding party. Byers v. Illinois State Police, 2002 U.S. Dist. Lexis 9861 (N.D. Ill. 2002)



Hierarchy of ESI Accessibility • Active, online data (hard drives)

• Near line data (computer accessible optical drives)

• Offline storage/archives (indexed or organized back up tapes)

• Offline storage/archives (back up tapes intended for disaster recovery)

• Erased or fragmented data (data not intended to be saved, but capable of restoration)

• Legacy data and back-up tapes for systems no longer supported

Most Accessible

Least Accessible


Rule 26(b)(2)(B): Case LawRule 26(b)(2)(B): Case LawFocus is on Burdens and Costs, Not Type of Data

• Semsroth v. City of Wichita, 2006 U.S. Dist. LEXIS 83363 (D. Kan. Nov. 15, 2006)

• Ameriwood Indus., Inc. v. Liberman, 2007 U.S. Dist. LEXIS 10791 (E.D. Mo. Feb. 13,2007); Ameriwood Indus., Inc. v. Liberman, 2006 U.S. Dist. LEXIS 93380 (E.D. Mo. Dec. 27, 2006)

• Cenveo Corp. v. Slater, 2007 U.S. Dist. LEXIS 8281 (E.D. Penn. Jan. 31, 2007)

• Best Buy Stores, L.P. v. Developers Diversified Realty Corp., 2007 U.S. LEXIS 7580 (D. Minn. Feb. 1, 2007)

• Thielen v. Buongiorno USA, Inc., 2007 U.S. Dist. LEXIS 8998 (W.D. Mich. Feb. 8, 2007)

• Peskoff v. Faber, 2007 U.S. Dist. LEXIS 11623 (D. D.C. Feb 21, 2007)• Rule 45: Guy Chemical Co. v. Romaco, Inc., 2007 U.S. Dist. LEXIS

37636 (N.D. IN May 22, 2007)


Reasonable AccessibilityReasonable AccessibilityUndue Burden or CostUndue Burden or Cost

Rule 26(b)(2)(C): • (C) The frequency or extent of use of the discovery methods

otherwise permitted under these rules and by any local rule shall be limited by the court if it determines that: • the discovery sought is unreasonably cumulative or duplicative, or is

obtainable from some other source that is more convenient, less burdensome, or less expensive;

• the party seeking discovery has had ample opportunity by discovery in the action to obtain the information sought; or

• the burden or expense of the proposed discovery outweighs its likely benefit, taking into account the needs of the case, the amount in controversy, the parties' resources, the importance of the issues at stake in the litigation, and the importance of the proposed discovery in resolving the issues. The court may act upon its own initiative after reasonable notice or pursuant to a motion under Rule 26(c).



Zubulake Cost-Shifting Factors

• The court should consider shifting costs only when inaccessible data is at issue.

• Inaccessible data is data that is not online or near line and includes data on backup tapes.

• Court must determine what data may be found on inaccessible media. “Sampling” approach.

• In conducting the cost-shifting analysis, a seven-factor test should be applied with priority given to the first two factors.



Zubulake balancing test:

1. The extent to which the request is specifically tailored to discover relevant information.

2. The availability of such information from other sources.

3. The total cost of production, compared to the amount in controversy.

4. The total cost of production, compared to the resources available to each party.

5. The relative ability of each party to control costs and its incentive to do so.

6. The importance of the issues at stake in the litigation.

7. The relative benefits to the parties of obtaining the information.


Duty to Preserve and Legal HoldsDuty to Preserve and Legal Holds

• Defined

• Trigger

• Scope

• Current Cases

• Best Practices


Duty to PreserveDuty to Preserve

• An entity is required to preserve documents and electronic data when it “knows or reasonably should know” that information may be relevant to pending or anticipated litigation.

• Once litigation is anticipated, a party must suspend its routine document retention/destruction policy and put in place a legal hold to preserve what it knows, or reasonably should know, is relevant to the action.


Legal Holds - TriggerLegal Holds - Trigger

• Fact Specific• Rambus Decisions

• Hynix Semiconductor, Inc. v. Rambus, Inc., 2006 U.S. Dist. LEXIS 30690 (N.D. Cal. Jan. 4, 2006)

• Although Rambus contemplated litigation prior to holding its annual “shred day,” court held the duty to preserve evidence did not arise until later when Rambus initiated a “beauty contest” to select litigation counsel.

• Samsung Elecs. Co. v. Rambus, Inc., 2006 U.S. Dist. LEXIS 50007 (E.D. Va. July 18, 2006)

• Court rejects Hynix noting that by the time Rambus initiated “shred day,” it had identified most likely and attractive litigation targets, settled on possible legal theories, and identified relevant documents for both preservation and destruction

• Preservation Orders


Legal Holds - Scope Legal Holds - Scope

• A party or anticipated party must retain all relevant documents (but not multiple identical copies) in existence at the time the duty to preserve attaches, and any relevant documents created thereafter.

-Zubulake v. UBS Warburg, (“Zubulake IV”) 220 F.R.D. 212 (S.D.N.Y. 2003).


Duty to Preserve – Current CasesDuty to Preserve – Current Cases

• Miller v. Holzmann, 2007 U.S. Dist. LEXIS 2987 (D.D.C. Jan. 17, 2007

• Reino De Espana v. American Bureau of Shipping, 2007 U.S. Dist. LEXIS 5693 (S.D.N.Y. Jan. 25, 2007)

• Floeter v. City of Orlando, 2007 U.S. Dist. LEXIS 9527 (M.D. Fl. Feb. 9, 2007)

• Griffin v. GMAC Comm. Fin., 2007 U.S. Dist. LEXIS 10504 (N.D. Ga. Feb. 15, 2007)

• Cache la Poudre Feeds v. Land O’Lakes, Inc., 2007 U.S. Dist. LEXIS 15277 (D. Colo. March 2, 2007)


1. Trigger Considerations

2. Understand Client’s Data Storage/Data Map

3. Be Familiar with Client’s Document Retention Policy

4. Define Scope of Information that must be Produced

5. Send Legal Hold Letter

6. Communicate with Key Custodians

7. Communicate with IT and Records Management

8. Assure that Information is Preserved in Proper Format

9. Continue to Monitor and Audit

10.Continue to Communicate

11.Keep Detailed Records of Preservation and Production

Legal Holds Best PracticesLegal Holds Best Practices


EXAMPLE IT ORGANIZATION EXAMPLE IT ORGANIZATION Very large OrganizationVery large Organization

Chief Information

Officer

Director – Office of IT Planning &

Policy

Director – Office of IT

SecurityInfrastructure

AndTechnology

Director – Office of

Networking & Telecom

Operations

Director – Office of Systems

Development & Support

Director – Office of Computer Services


EXAMPLE IT ORGANIZATIONEXAMPLE IT ORGANIZATION Small OfficeSmall Office

BackupAdministrator

DesktopSupport

EmailAdministrator

File ServerAdministrator

Database Administrator

IT Director


Mandatory DisclosuresMandatory DisclosuresDuty to Disclose/Duty to InvestigateDuty to Disclose/Duty to Investigate

Rule 26(a): Initial Disclosures

• Must disclose early on documents and “electronically stored information.”

• Information that may be used to support “claims or defenses”

• Do not have to disclose information that you do not intend to use. In re Novellus Systems, Inc. Case No. 5:06-cv-03514-RWM (N.D. Cal. Jan. 5, 2007)(not for publication).


Duty to InvestigateDuty to Investigate

Duty to Investigate:

• Phoenix Four, Inc. v. Strategic Resources Corp., 2006 US Dist. LEXIS 32211 (S.D.N.Y. May 23, 2006)

• 3M Innovative Properties Co. v. Tomar Electronics, Inc., 2006 U.S. Dist. Lexis 80571 (D. Minn. July 21, 2006)


Meet and ConferMeet and Confer

Rule 26(f): Conference of the Parties

• Parties directed to discuss e-discovery issues during their discovery planning conference. Must discuss Issues related to the disclosure or discovery of electronically-stored information, including:

• Preservation of evidence

• Form of production

• Consideration of inadvertent production and potential waiver of privilege


Meet and ConferMeet and Confer

Rule 16(b) (Scheduling Order) and

Form 35 (Report of Parties’ Planning Meeting)

• Scheduling order may include provisions governing the discovery of electronically-stored information.

• And agreements on inadvertent production

• Report of parties’ planning meeting required by Form 35 must include proposals regarding electronic information.


Prior to the Conference• Exchange information on Electronically Stored Information (ESI)

prior to the conference• Network Design• Types of Database• Database Dictionaries• Access Control List/Security Access Logs• Document Retention Policy• Organizational Chart for Information Systems Personnel• Backup and Systems Recovery Routines

• Discuss scope/time frame parameters of ESI

• Discuss internally – ESI Coordinator for both sides

• Secure Litigation Hold* Adapted from District of Maryland Suggested Protocol for Discovery of Electronically Stored Information,

2007

Meet and Confer Best Practices*Meet and Confer Best Practices*



At the Conference• Nature of Information Systems & Custodians• Anticipated Scope of Requests/Tiered Production• Objections• Form of Production, (including production in paper), how organized,

bates, redacted• Production and Cost of Metadata• Costs and Burdens Generally/Cost – Shifting/ASP• Preservation Issues/Protective Orders• Discuss “Claw-Back,” “Quick Peek” Agreements or How Privileged

Information May Be Handled• Information Not Reasonably Accessible/Testing or Sampling Search

methodologies• 30(b)(6) Depositions



Report of the Parties (after Meet and Confer)

• Any areas where parties have reached agreement

• Any areas where parties are in disagreement and request intervention by the Court.• Specify Proposed Treatment of Privileged Information,

Metadata & Proposed Order Regarding Privilege• Specify Proposed Treatment of Sampling or Testing of Data

if Appropriate• Set out Protocol and Conditions for on-Site Inspections of

Electronically Stored Information Under Rule 34• Proposed Preservation Order• Any agreements regarding the need for Experts



• Who Should Attend:

• Lead Counsel

• Representative of the Parties

• Who May Attend

• ESI Coordinator

• Forensic Experts

• Third Parties Served with Subpoena

• In House IT/Litigation Support


Inadvertent Waiver of PrivilegeInadvertent Waiver of Privilege

Rule 26(b)(5) and Rule 45(d)(2)(B):

• “Quick Peek” Agreements

• “Claw Back” Agreements

• Hopson v. Mayor, 2005 U.S. Dist. LEXIS 29882 (D.Md. Nov. 22, 2005).

• Judge Grimm discusses problems with privilege waiver in review of electronic records/costs

• “Quick Peek” and “Claw-back Agreements” v. Full Privilege Review

• Proposed Rules and Substantive Law

• Third Party Waiver

• Proposed FRE 502

• Williams v. Taser, 2007 U.S. Dist. LEXIS 40280 (N.D.Ga. June 4, 2007)


Form of ProductionForm of Production

Rule 34 and Rule 45:

• If document request or subpoena does not specify the form for producing “electronically-stored information” (and absent other agreement by the parties), the responding party must produce in the form in which it:

• Ordinarily maintains the information or

• Form or forms that are reasonably usable

• Electronic information need only be produced in one form.


Form of Production - MetadataForm of Production - Metadata

• 2005: Williams v. Sprint/United Mgmt. Co. 2005 U.S. Dist. LEXIS 21966 (D. Kan. 2005)

• General presumption in favor of production of metadata

• 2006: Kentucky Speedway v. Nat’l Ass’n of Stock Car Auto Racing, Inc., 2006 U.S. Dist. LEXIS 92028 (E.D. Ken. Dec. 18, 2006)

• General presumption against the production of metadata


““Safe Harbor” ProvisionSafe Harbor” Provision

Rule 37(f):

• “Safe harbor” provision provides:

• Absent exceptional circumstances (judge’s discretion)

• Court may not impose sanctions under rules

• If party fails to provide electronically stored information lost as a result of the routine, good faith operation of an electronic information system.


SanctionsSanctions

Or perhaps more importantly, avoiding them.


SanctionsSanctions

• Typically for lack of preservation• Also fact-specific

• Wachtel v. Health Net, Inc., 2006 US Dist. LEXIS 88563 (D. N.J. Dec. 6, 2006)(not for publication). • one of the “wors[t] cases of litigation abuse,” • deemed the facts of spoliation and willful conduct admitted• precluded evidence • ordered monetary sanctions and the appointment of a

discovery monitor• outside counsel was also found to have engaged in

sanctionable conduct


Type of SanctionsType of Sanctions

Sanction Powers

• Court’s Inherent Powers

• Rule 37

• State law

Some Types of Sanctions

• Dismissal

• Adverse Inference Instruction

• Monetary sanctions


DismissalDismissal

• Dismissal as a Sanction:

(a) Willfulness or bad faith of the noncompliant party

(b) History, if any, of noncompliance

(c) Effectiveness of lesser sanctions

(d) Whether non-compliant party had been warned about sanctions

(e) Client’s complicity

(f) Prejudice to moving party

-Metropolitan Opera Ass’n, Inc. v. Local 100, 212 F.R.D. 178 (S.D.N.Y. 2003)


SanctionsSanctions• Default Judgment:

• Quintus Corp. v. Avaya, Inc. (In re Quintus Corp.), 2006 Bankr. LEXIS 2912 (Bankr. D. Del. Oct. 27, 2006)

• Destruction of evidence deliberate and prejudicial• Judgment in the amount of $1.8 million

• Krumwiede v. Brighton Associates, LLC, 2006 U.S. Dist. Lexis 31669 (N.D. Ill. May 6, 2006)

• Failure to put in legal hold• Default judgment for spoliation

• Dismissal & Monetary Sanctions:• Leon v. IDX Systems Corp., 2006 U.S. App. LEXIS 23820 (9th

Cir. Sept. 20, 2006)• Affirming monetary sanction of $65,000

• Burkybile v. Mitsubishi Motors Corp., 2006 U.S. Dist. LEXIS 84864 (N.D. Ill. Oct. 17, 2006)

• Monetary sanction more appropriate than default judgment.


Adverse Inference InstructionAdverse Inference Instruction

Party seeking adverse inference instruction for

destruction or late production of evidence must show:

(i) Obligation to preserve or timely produce

(ii) Culpable state of mind

(iii)Evidence is relevant to the party’s claim or defense.

• In 2nd Circuit, “culpable state of mind” can be satisfied by a showing of ordinary negligence.


SanctionsSanctions

• Adverse Inference Instruction Granted• In re NTL, Inc. Sec. Litig., 2007 U.S. Dist. LEXIS 9110

(S.D.N.Y. Jan. 30, 2007)• 3M Innovative Properties Co. v. Tomar Electronics,

Inc., 2006 U.S. Dist. Lexis 80571 (D. Minn. July 21, 2006)

• In re Napster, 2006 US Dist. LEXIS 79508 (N.D. Cal. Oct. 25, 2006)

• Shaffer v. ACS Gov’t Services, 2006 U.S. Dist. LEXIS 73148 (D. Md. Sept. 30, 2006)

• Optowave Co. v. Nikitin, 2006 U.S. Dist. LEXIS 81345 (M.D. Fla. Nov. 7, 2006)

• Louis Vuitton Malletier v. Dooney & Bourke, Inc., 2006 U.S. Dist. LEXIS 87096 (S.D.N.Y. Nov. 30, 2006)


SanctionsSanctions

• Adverse Inference Instruction Not Granted

• Reino de Espana v. American Bureau of Shipping, 2007 U.S. Dist. LEXIS 41498 (S.D.N.Y June 6, 2007)

• Consolidated Aluminum Corp. v. Alcoa, Inc., 2006 U.S. Dist. LEXIS 66642 at *18 (M.D. La. July 19, 2006)

• Austin v. City of Denver, 2006 U.S. Dist. 47451 (D. Colo. July 13, 2006)


““Safe Harbor” ProvisionSafe Harbor” Provision

Rule 37(f):• “Safe harbor” provision provides:

• Absent exceptional circumstances (judge’s discretion)• Court may not impose sanctions under rules• If party fails to provide electronically stored

information lost as a result of the routine, good faith operation of an electronic information system.

• Two cases directly discussing “Safe Harbor” Provision (Rule 37): • Disability Rights Counsel of Greater Washington v. WMTA,

2007 U.S. Dist. LEXIS 39605 (June 1, 2007)• In re: Gary E. Krause, 2007 Bankr. LEXIS 1937 (U.S. Bankr.

KS June 4, 2007)


Data Collection Data Collection and Chain of Custodyand Chain of Custody

Making Your Job Easier From The Start


• Computer Evidence is VERY PERISHABLE!

• Can be created, altered, stored, copied, and moved with ease

• Can be changed during evidence collection

• Computer evidence must pass traditional admissibility tests

Computer EvidenceComputer Evidence


Data Collection QuestionsData Collection Questions

Collection Methodology: Chain of Custody Issues

• How are you collecting the relevant data?

• What software are you using?

• Are you following the same process consistently across all custodians and media forms?

• What type of media are you storing your collected data to?

• Where is this media stored?

• Who has access to it?

• Are you collecting data mindful of meta data and source location information?


Evidentiary IssuesEvidentiary Issues

Lorraine v. Markel American Ins. Co., PWG-06-1893 (D. Md May 4, 2007)

• After discovery, both parties moved for summary judgment to enforce a private arbitrator’s award that certain damage to plaintiff’s yacht was caused by lightening. Defendant sought to uphold the arbitrator’s decision limiting the extent of plaintiff’s damages. Plaintiff argued the arbitrator had exceeded his authority by limiting those damages. In denying both motions, the court held that emails attached to both motions and offered as parol evidence were inadmissible due to parties’ failure to lay the appropriate evidentiary foundation.


Evidentiary IssuesEvidentiary Issues

Lorraine v. Markel American Ins. Co., PWG-06-1893 (D. Md May 4, 2007) (con’t)

• The court held that whenever electronic documents are offered as evidence, the party proffering the electronic information must consider the following: • whether the electronic evidence is relevant (Rule 501);

• the authenticity of the information (Rule 901(a));

• whether the information is hearsay, including relevant expectation, if the document is offered for its substantive truth (Rule 801);

• the original writing rule (Rules 1001–1008); and

• whether the probative value of the document is substantially outweighed by the danger of unfair prejudice or other considerations (Rule 403).


Chain Of CustodyChain Of Custody

• Evidentiary integrity

• If appropriate, use forensically sound tools and procedures

• Do not alter data or meta data

• Preserve the evidence

• Chain of custody

• Confirms that evidence was not altered

• Follows the evidence during the entire data gathering lifecycle

• Describes who handled the evidence and why

• Must be kept and available for review


Chain of CustodyChain of Custody

• There is a 2-prong attack with regards to chain of custody issues

• What is your process?

• Did you follow your process?


Chain Of CustodyChain Of Custody

What is your process?

• How do you thwart this attack?

• Establish a standard operating procedure.

• Do the exact same thing each time.

• Establish a clearly delineated workflow• Who does what?

• Assign evidence handling responsibilities only to certain limited evidence custodians.

• Use court challenged industry standard tools and procedures.

• ** Use a checklist designed for evidence seizure.**


Chain of CustodyChain of Custody

Should Include• Date and time of collection

or receipt• Physical inspection of media

• Damaged• Write-protected

• Procedures used• Tools used• Person conducting

procedures• Outcome of procedures• Problems encountered

• Date and time of check-in and check-out of media from secure storage

• Media specific information• Media type, standard,

manufacturer• Serial numbers or volume

names• Writing on labels• Characterize data


Questions? Questions?

[email protected]

© 2007 LexisNexis. All rights reserved. Keating Muething & Klekamp E-Discovery Fundamentals CLE...

Documents

Transcript of © 2007 LexisNexis. All rights reserved. Keating Muething & Klekamp E-Discovery Fundamentals CLE...