Electronic discovery, while undergoing constant change, is still considered uncharted territory. What kinds of information is discoverable is still debated, along with methods for recovering that information. More and more businesses conduct electronic discovery, but examining hard drives is still very expensive. The amount of information available, however, is not in doubt. As this recent article notes, Google stores search data forever.

After 9 months, Google wipes the last octet of IP address, which means there are 256 possibilities for each piece of data. After 18 months, Google anonymizes cookie data. During the first 9 months, searches are easily identifiable. Compared to other search engines, Google maintains this data for a long time. Yahoo scrubs data in 90 days. Bing anonymizes the IP address after 6 months.

Even after the 18 month period, however, the data can still be traced to a unique user. The data can be still be identified by zip code or the name of the town. Combined with other electronic information available, electronic discovery could turn up much more data then you realize.

Obviously there are a number of evidentiary hurdles with gathering this type of evidence. But the more activity a person engages in online, the longer and deeper the trail is. Many people incorrectly consider search data to be anonymous. Most browsers automatically save your search requests; ever notice that previous searches pop right up?

What this means is that clients who are willing to pay for in-depth electronic discovery should be able to recover more information then many lawyers realize. If internet usage is important to your case, be sure to do your due diligence. Things that your client did online they thought were anonymous may in fact be traceable to them.

(photo: saibotregeel)

Google Keeps Your Digital Tail is a post from: Lawyerist

Guest post by Steven Rodin.

E-discovery can quickly get out of hand, sometimes costing millions of dollars. An example was seen in the Office of Federal Housing Enterprise Oversight, where one single e-discovery request cost taxpayers over $6,000,000.

Thankfully, there are third-party solutions available that can help lower some of the administration and legal costs associated with e-discovery.

It is important for the IT personnel in charge of e-mail administration and e-mail archives to clearly understand what their responsibilities are (what they must do, and how quickly it must be delivered) when asked to provide information as part of an investigation or trial.

Because of the need for access, any cloud-based service must carry with them a guarantee of uptime, availability, and rapid search capability. This can be requested when crafting your service-level agreement.

Although it is the responsibility of the IT department to provide the technical foundation for searching archival data, the most ideal solution is to provide a utility that allows for the requester to conduct the investigation directly. Providing such an interface relieves the IT staff from the mundane task of conducting an extensive search. It also allows the legal department to be more efficient in their research. This interface need not be limited to the legal department. Every department may have their own legitimate reasons for requesting archived information.

For purposes of compliance with various regulations, though, an audit trail must be available to show who has accessed the resources, and when. All access of the e-mail archives should be governed by authorization schemes and authentication procedures.

Furthermore, an executive e-discovery policy should be put in place. Such a policy would be governed by internal procedures and government regulations concerning storage of this data.

When using a cloud-based service however, e-discovery needs must be kept in mind from the beginning. It’s important to take into account the ease of search, data security, and the authentication and authorization procedures that are in place governing access.

Moving your IT infrastructure to the cloud can be a great way to save time and money. And if you do your homework, it can also help you maintain better regulatory compliance in case of a discovery request.

(photo: the|G|™)

Steven Rodin is president of Storagepipe Solutions and an expert in business continuity topics such as e-mail archiving and server backup.

Ensure E-Discovery Readiness For Your Hosted & Managed Systems is a post from: Lawyerist

So says Eric J. Sinrod, a California attorney who criticizes the courts for taking e-discovery requirements to extreme lengths.

I have found the best course is to find out what sort of electronic data exists, and early–at the 26(f) meeting with opposing counsel, if possible. With that knowledge, I can make an intelligent decision as to whether I actually need things like meta data, or whether printouts of the electronic data will satisfy my needs.

But this will not handle every situation, of course, and I can think of many situations in which discovery costs could skyrocket due to e-discovery requirements.

Have you run into e-discovery issues? How have you handled them?

Perspective: The new e-discovery burden | CNet

Federal e-discovery rules can create a crushing financial burden is a post from: Lawyerist

PING (Partimage is Not Ghost) is a Linux-based LiveCD for backing up your system by making an image of the hard drive (or smaller partitions, if you have them). In other words, you boot a simplified version of Linux (it doesn’t matter what operating system you normally use on the computer–just pop the CD in the drive and turn the computer on) from the CD drive. It allows you to make an exact copy of any drive or partition on the computer without booting up the operating system on the computer (which can alter the data). It just copies everything to a file that you can store anywhere and that should adequately preserve electronic evidence on a small scale.

Most importantly, it is easy enough to use that you should be able to burn a copy to CD and send it home with your client (with an external hard drive for the image file) so that they can make the hard drive image themselves, which keeps you out of the chain of evidence. (Don’t make this decision without carefully considering the issues and the disadvantages of doing it yourself.)

PING is also a fantastic backup tool. Unlike a regular backup, PING makes a copy of the drive. If you just back up your files and your computer dies, you have to re-install Windows, update it, install all your software, and then restore your files once you are back up and running. With PING, just restore the image to the new hard drive, re-activate Windows, and go. You’ll save hours (or days) of recovery time.

[photo: Chance Agrella]

Image hard drives for e-discovery or backup with PING is a post from: Lawyerist

E-discovery has existed since computers have existed, but it has only become a hot (if dry) topic in recent years. For the solosmall practitioner, e-discovery can be an extra-large headache, since capturing and preserving electronic data in compliance with the rules and case law can be confusing, time-consuming, and, most importantly, expensive.

However, Law.com’s Legal Technology just ran an article on e-discovery in which Seattle litigation support consultant Tom O’Connor said that divorce cases are the busiest when it comes to e-discovery. This means that family law practitioners, who are usually solosmall, as well, may be dealing with e-discovery more than anyone else.

Once you have identified that your client may have electronic evidence, the article gives two important cautionary bits of advice:

1. Don’t touch the evidence. Don’t even turn the computer on. Doing so may lose important data. If you have to turn on the computer, make detailed notes on everything you do. Every file you look at, whether you saved it, whether you copied it, etc.
2. Make a forensically-sound copy of the data. The best practice is to use an expert, despite the cost. The cost of not hiring an expert can be much greater. Also, you do not want to become part of the chain of evidence and therefore a fact witness in the lawsuit.

All that is very true. However, sometimes you or your client just can’t afford to spend thousands on a forensic expert. Or the evidence seems sufficiently peripheral that hiring a forensic expert would be overkill. In these situations, you might take a do-it-yourself approach. Use your best judgment. I don’t think you risk extreme sanctions for attempting to preserve evidence in good faith, but your decision how to preserve that evidence must be an informed decision appropriate under the circumstances.

That said, there is a great, free solution for attorneys wishing to preserve electronic evidence on a hard drive. I would not say this is as “forensically sound” as what a professional would do, but it should preserve the evidence sufficiently for most purposes, if not all. And since it is open source, as well, the method by which it preserves electronic evidence is something an expert can easily discover if necessary.

PING is a Linux-based LiveCD. In other words, you boot a simplified version of Linux (it doesn’t matter what operating system you normally use on the computer) from the CD drive. It allows you to make an image of the files on any drive or partition on the computer without booting up the operating system on the computer and altering the data. It just copies everything to a file that you can store anywhere and that should adequately preserve electronic evidence on a small scale.

Most importantly, it is easy enough to use that you should be able to burn a copy to CD and send it home with your client (probably with an external hard drive for the image file) so that they can make the hard drive image themselves.

It is also a fantastic backup tool, so you may want to use it yourself to get the hang of it.

E-discovery chain of custody is a post from: Lawyerist