Preparing for E-Discovery, Step Three: Preservation of Evidence

Guest post by Jeff Kerr.

Assume you’ve just been retained by a new client in a case that is headed to litigation. As you know, your client is required to preserve evidence related to the case. Indeed, the court can impose stiff penalties on parties who neglect this duty. Unless your client is a sophisticated business with in-house e-discovery and forensics resources, it falls on you to advise and assist your client with regard to preserving evidence and avoiding spoliation sanctions.

In the 21st century, this is no simple task. The most important evidence in many cases consists of electronic items like emails, text messages, computer files, metadata, and databases. As such, the evidence is more likely to consist of bits of data in the cloud or unallocated space on your client’s hard drive than in a central file room. This evidence isn’t static; it could be overwritten or lost as a result of simply continuing to use the computer system. But all litigants face this burden equally, and the standard for success is reasonableness, not perfection.

There are no easy answers when it comes to preservation—no bright-line rules to tell you which sources need to be preserved and how. Instead, deciding how to preserve electronic evidence is a balancing exercise that involves comparing the cost of different methodologies with the importance of the evidence to be preserved. By having a plan, you’ll be better off than the many lawyers who seem never to think of digital preservation until the other side starts talking about spoliation.

Methods of Preserving Electronic Data

There are multiple levels of preservation that can be applied to a given source of electronic evidence. The highest level is a forensic copy or “image,” in which all of the binary data on a particular source (such as a computer’s hard drive) is copied to a secure evidence repository (often another disk). Specialized equipment and software are needed to perform a forensic image—both to retrieve the data without modifying it and to ensure that all of the data is copied. Forensic images are appropriate when there’s a reason to believe that important files were deleted from the filesystem, or, in contrast, to prove that critical files were not deleted.

An intelligent alternative to a forensic image is a process called system sequestration. If the system in question isn’t in use (e.g., a former employee’s computer), then all you need to do is turn the computer off and lock it in a safe. Be sure to make a log of when you locked it up, who has access, and any other pertinent info.

But many sources don’t require either forensic imaging or sequestration. Instead, it’s often perfectly reasonable to make a so-called “logical copy” of the file system—namely, copying the directories and files on the computer to an external drive. As always, be sure to log your activities.

The Importance of a Litigation Hold

No preservation plan is complete without issuing a litigation hold to your client. This is a letter with instructions to all individuals whose computers, smartphones, or cloud accounts might contain relevant data. The letter should provide instructions in plain English. For example, sentences like “do not delete any files or communications related to X, Y, and Z” are much better than sentences like “cease and desist from rotation of backup media.”

If your client has IT personnel, work with them to ensure that the letter makes sense in light of the systems that your client uses. When you distribute the letters, have the recipients sign to acknowledge receipt, and tell recipients to contact you or IT if they have any questions about the directions. You’ll also want to follow up with recipients to confirm that they’ve taken the steps you identified.

An Essential Admonition: Stop Making New Evidence

Aside from preserving evidence, you also need to tell clients to stop creating new evidence. It seems that most clients cannot resist the urge to discuss the case with friends, family, and colleagues. Those communications are absolutely discoverable and relevant, and they can be toxic. Consider the case of a female associate who sued her employer in New York for sexual harassment. The jury’s sympathy for her was surely reduced by her Gmail chats where she discussed her plans for moving to a tropical paradise after recovering millions and described her case as an “experiment with the legal system.” Thoughts like these are best kept to oneself, or expressed in emails to counsel (with no CC or BCC recipients). In general, you should advise your client to cease and desist from writing any words about the case with anyone other than you.

Concluding Thoughts

Most of the wisdom provided to lawyers about e-discovery can be boiled down to the following advice: “Hire a vendor! It’s too hard for you!” But this won’t always work. Requiring parties to hire a third-party vendor in every case involving electronic evidence would make litigation too expensive for many parties. Lawyers can do a great deal themselves and, even if a vendor is needed, it is critical for counsel to know enough to pilot the ship and direct the vendor so that costs stay within bounds.

Whether you retain a vendor or not, you must begin thinking about e-discovery at the earliest possible stage. Waiting until there’s a discovery dispute to start thinking about how your client’s evidence should be preserved is a recipe for disaster. The most important time for lawyers to take control of e-discovery is at the beginning of the case, and the best way to do it is with a reliable method and a willingness to learn something new.

Jeff Kerr is CEO of CaseFleet, a platform for helping litigators manage their practices and win more cases. Before starting CaseFleet, Jeff was a managing partner at Mays & Kerr LLC, where he focused on employment litigation and eDiscovery and was selected as a Rising Star in 2015. Jeff frequently writes and speaks on the topics of legal technology and eDiscovery.

Leave a Reply