E-discovery chain of custody

E-discovery has existed since computers have existed, but it has only become a hot (if dry) topic in recent years. For the solosmall practitioner, e-discovery can be an extra-large headache, since capturing and preserving electronic data in compliance with the rules and case law can be confusing, time-consuming, and, most importantly, expensive.

However, Law.com’s Legal Technology just ran an article on e-discovery in which Seattle litigation support consultant Tom O’Connor said that divorce cases are the busiest when it comes to e-discovery. This means that family law practitioners, who are usually solosmall, as well, may be dealing with e-discovery more than anyone else.

Once you have identified that your client may have electronic evidence, the article gives two important cautionary bits of advice:

    1. Don’t touch the evidence. Don’t even turn the computer on. Doing so may lose important data. If you have to turn on the computer, make detailed notes on everything you do. Every file you look at, whether you saved it, whether you copied it, etc.
    2. Make a forensically-sound copy of the data. The best practice is to use an expert, despite the cost. The cost of not hiring an expert can be much greater. Also, you do not want to become part of the chain of evidence and therefore a fact witness in the lawsuit.

All that is very true. However, sometimes you or your client just can’t afford to spend thousands on a forensic expert. Or the evidence seems sufficiently peripheral that hiring a forensic expert would be overkill. In these situations, you might take a do-it-yourself approach. Use your best judgment. I don’t think you risk extreme sanctions for attempting to preserve evidence in good faith, but your decision how to preserve that evidence must be an informed decision appropriate under the circumstances.

That said, there is a great, free solution for attorneys wishing to preserve electronic evidence on a hard drive. I would not say this is as “forensically sound” as what a professional would do, but it should preserve the evidence sufficiently for most purposes, if not all. And since it is open source, as well, the method by which it preserves electronic evidence is something an expert can easily discover if necessary.

PING is a Linux-based LiveCD. In other words, you boot a simplified version of Linux (it doesn’t matter what operating system you normally use on the computer) from the CD drive. It allows you to make an image of the files on any drive or partition on the computer without booting up the operating system on the computer and altering the data. It just copies everything to a file that you can store anywhere and that should adequately preserve electronic evidence on a small scale.

Most importantly, it is easy enough to use that you should be able to burn a copy to CD and send it home with your client (probably with an external hard drive for the image file) so that they can make the hard drive image themselves.

It is also a fantastic backup tool, so you may want to use it yourself to get the hang of it.

Leave a Reply