Effective and Cost-Efficient Enterprise E-Discovery

(1)

Effective and Cost-Efficient Enterprise E-Discovery

LEGAL WHITE PAPER

March 2005

John Patzakis and Victor Limongelli1

Abstract: This paper examines the current Electronic Evidence Discovery

landscape and the challenges companies face in dealing with a broken

eDiscovery Process. This paper also addresses the advantages of establishing an operational Electronic Evidence Discovery capability with EnCase® Enterprise software and how such a capability can reduce E-Discovery costs by up to 90 percent while enabling compliance with a highly defendable process.

Guidance Software is the world leader in providing computer and enterprise investigation solutions. With more than 14,000 corporate and government users worldwide and computer investigation methodology training provided to more than 3,500 students annually, Guidance Software’s Windows-based EnCase® computer forensic tool has been validated by several courts at the trial and appellate levels, and is the winner of numerous industry awards.

Guidance Software's EnCase Enterprise Edition is a powerful network-enabled

computer investigation system that provides rapid and thorough analysis and collection of data residing on servers and workstations anywhere on the network, without

disrupting operations. Without EnCase Enterprise Edition, organizations must resort to cumbersome and costly manual procedures that extend the investigation process by several weeks if not months, and require target systems to be taken out of service. This solution brings the highly successful and industry standard EnCase® computer forensic technology to the enterprise for unprecedented global computer investigation capability. EnCase Enterprise Edition represents best practices for enterprise e-Discovery

(2)

I. Introduction

Electronic discovery is now a standard component of the civil litigation process, fostered by a growing awareness amongst counsel and the bench that nearly all evidence is digital. Indeed, “Rules 26(b) and 34 of the Federal Rules of Civil Procedure instruct that

computer-stored information is discoverable under the same rules that pertain to tangible, written materials."2 Consequently, “[t]he discovery of electronic data . . . in today’s world includes virtually all cases.”3 The law now provides that companies must diligently comply with requests to produce reasonably accessible computer-based data.

Another factor impacting companies’ approach to eDiscovery is the line of recent case law that provides procedural guidelines to steer counsel through the litany of privilege, required diligence and cost-shifting issues. However, missing from the equation is awareness of an effective and cost-efficient enterprise class technology to enable rapid, thorough, and scalable data searching and collection across large global networks to enable fulfillment of these E-Discovery requirements and mandates. Without this

capability, a major organization’s E-Discovery experience is very painful in terms of cost and business disruption.

In assessing the current E-Discovery landscape, large organizations struggle with four major “areas of pain”:

1. High Costs. Major organizations incur tens of millions of dollars in out-of-pocket costs annually, mostly in the form of outside consultant fees to collect and process data.

2. Spoliation/Obstruction of Justice. Because court sanctions for destruction of computer evidence are common and highly costly, the prospect of such sanctions exists in every case. Indeed, there is widespread anecdotal evidence that in many cases the plaintiffs’ bar is primarily aiming for E-Discovery sanctions over a decision on the merits.

3. Business Disruption. Outdated (but still common) methods to search and collect computer evidence often require shutting down workstations and servers, resulting in substantial harm to business continuity. In addition, obtrusive methods of searching for potentially relevant data can impact employee morale and disrupt the workplace.

4. Loss of Control/Non-Compliance. If a court finds that a litigant failed to fulfill its obligations with respect to E-Discovery, the litigant faces the

prospect of severe sanctions, including a court order granting the other party’s expert access to its computer systems, with the resulting loss of control over the E-Discovery process.

The upshot of those “areas of pain” is that organizations without an effective computer evidence investigation capability are at a severe disadvantage. In order to address these issues, a corporation can deploy EnCase Enterprise, a powerful network-enabled computer data collection and analysis system that provides immediate and thorough collection and review of all data residing on servers and workstations anywhere on the

(3)

global network, without disrupting business operations. This paper will address how EnCase Enterprise protects organizations and significantly reduces costs by addressing each of these four “areas of pain” while mapping to key case law and other legal best practice requirements to provide a diligent, highly effective and cost-efficient enterprise E-Discovery process.

II. Addressing the High Costs of Electronic Evidence Discovery Pain

As the volume of electronic data, including email and instant messaging communications, continues to multiply, so do the costs of E-Discovery when out-of-date technology is used. In many instances, skyrocketing E-Discovery costs force organizations to prematurely settle cases or, at a minimum, compromise their litigation strategy. What should be fairly routine evidence computer collection and processing engagements can cost hundreds of thousands — or millions — of dollars in consulting fees.4 Without proper planning, established procedures, and enterprise-class technology to support a global computer investigation capability, E-Discovery costs at large businesses will continue to spin out of control.

The traditional approach to electronic evidence discovery involves gathering immense sums of data (which, as noted above has been increasing) and loading the data onto a system that allows for searching and processing. This process results in ever-increasing costs as the volume of data within a corporation grows, and it obtains no benefit from the corporation’s prior investment in its computer network. In fact, much of the expense and burden associated with electronic discovery is incurred in the collection aspect of the investigation process. For instance, without enterprise computer investigation technology, collecting files from hundreds or even thousands of computers distributed across multiple locations must be performed manually. With no means to triage and filter out irrelevant data, the collection is overbroad, with a great deal of irrelevant data aggregated into a central database where it is then finally processed and searched.

The traditional approach to initially identifying potentially relevant electronic documents is surprisingly non-technical. Typically, the corporation asks its employees if they have electronic documents or data that may relate to the applicable litigation. Often an

organization chart is referenced and certain employees are interviewed. Usually an email is sent to groups of employees asking for information and informing them of a litigation “hold.” If this manual process identifies any employees who are likely to have potentially relevant information on their computers, the company then may either remove the hard drives from the employees’ workstations or send a team of consultants to travel to various company locations and manually collect information from the computers one at a time. In addition to being extremely expensive, overbroad, untimely and often inaccurate, this obsolete process is highly disruptive of business operations. Non-enterprise based investigation techniques require physical access to (and often shutting down) each target computer for analysis by a consultant or even the end-users. The cost due to business disruption in such circumstances is often immense, particularly in situations involving servers. Additionally, internal investigations are compromised with significant loss of morale when such an unworkable investigation process is employed.

(4)

EnCase Enterprise addresses these serious problems by providing a highly cost-effective solution that can reduce E-Discovery costs by up to 90 percent. Built upon proven and industry leading computer forensics technology, EnCase Enterprise features a robust analysis process that enables very effective, customized and manageable system-wide searches of distributed workstations and servers throughout the global enterprise. As a result, a more targeted and presumptively relevant data set is returned to a centralized location in an automated fashion. EnCase Enterprise is highly flexible. For instance, it can copy entire hard drives if needed or perform very targeted system-wide keyword searches of emails and specific documents within a specified date range. This technology enables the live and remote analysis and collection of evidence over a network from centralized location in a sound and non-invasive manner and thus does not disrupt operations.

EnCase Enterprise represents a dramatic improvement over other computer investigation processes, at a fraction of the cost. For instance, in a recent matter involving due

diligence investigation for a merger and acquisition, consultants effectively employed EnCase Enterprise to search more than 5,000 computers distributed in dozens of locations worldwide in a few weeks, all without disrupting operations. EnCase Enterprise enabled the completion significantly under budget and within aggressive time constraints. EnCase Enterprise is specifically designed to perform efficient and effective enterprise computer investigations with best practices technology. This enables corporations to effectively manage and retain control of these investigations while substantially reducing cost.

III.Spoliation of Computer Evidence; a Common and Often Fatal Occurrence

Spoliation of computer evidence is a major problem, and by some estimates, occurs in some form in most cases. Organizations face criminal liability for obstruction of justice (such as in the case of Arthur Anderson) and in civil cases, evidentiary sanctions and even default judgments due to mishandled and destroyed computer evidence. A party may be sanctioned for destroying or even negligently altering evidence that it had a duty to preserve.5 In addition to severe monetary sanctions,6 courts are frequently issuing evidentiary sanctions such as adverse inference jury instructions that effectively determine the outcome of many cases.7

To address spoliation from both a proactive and reactive manner, there is simply no better process than EnCase Enterprise. EnCase Enterprise provides an important apparatus to manage and address digital spoliation in several respects.

First, EnCase Enterprise ensures that the data being collected and analyzed is properly handled. Computer investigations that do not follow non-invasive forensic methodologies will likely result in altering and even deleting the target data. EnCase Enterprise operates in a non-invasive manner, thereby preserving all key metadata and not altering critical information such as file time stamps. EnCase Enterprise can be used to obtain

forensically sound full disk images, or can quickly identify, collect, and preserve specific files responsive to customized search criteria performed system-wide.

(5)

Further, EnCase Enterprise is specially designed to create and document a digital chain of custody to establish that the acquired computer evidence is not tampered with or

inadvertently altered, thereby insulating the investigator from even speculative

allegations of mishandled digital evidence. Computer evidence recovered with EnCase is placed into an EnCase Evidence file to protect the integrity of the data and to maintain and document a digital chain of custody. Importantly, the EnCase software is the only computer evidence software to be expressly validated at the appellate level. (See, State v. Cook8; Williford v. State9; State v. Morris10).

Finally, when data within a company is inadvertently deleted or intentionally destroyed in an unauthorized manner, EnCase Enterprise serves as a very powerful remediation

mechanism. With its ability to quickly identify and recover deleted files, EnCase Enterprise represents best practices to contain, mitigate and remediate the data loss. Utilizing this capability to diligently respond to unauthorized data destruction

demonstrates good faith and serves to help insulate a corporation from further liability. For public companies, this capability is also as important control measure as Sarbanes-Oxley imposes severe criminal liability on individuals and corporations that engage in destruction of computer evidence relevant to a government investigation. Additionally, many organizations must routinely respond to subpoenas from various regulators to produce computer data. These regulators routinely require that such data be produced in a forensically sound manner.

For organizations, EnCase Enterprise is thus essential to insulate an organization from allegations and liability for computer evidence destruction, and provides an ideal means to conduct internal investigations and diligently cooperate with information requests from regulatory agencies.

IV. Best Practices Technology Enables Compliance and Provides an Important Strategic Advantage

A new common tactic of the Plaintiff’s bar is to capitalize on the E-Discovery struggles of large corporations. Claimant’s lawyers seek to distract the defense with “litigation within a litigation” allegations of spoliation or lack of due diligence in complying with E-Discovery requests. Plaintiffs seek to gain a significant advantage by obtaining

evidentiary sanctions, petitioning the court for an order allowing their own experts to investigate the corporate defendants’ systems, or otherwise driving up the cost of litigation by forcing costly and overbroad computer evidence investigations.

EnCase Enterprise is a very powerful weapon against these tactics by providing a very effective, accurate and diligent enterprise computer investigation process. The EnCase technology is the clear industry leader, and the standard computer forensics process utilized by agencies such as the FBI, the SEC, The Department of Homeland Security, and many other key government agencies. Since 1998, over 14,000 professionals have utilized the EnCase technology in hundreds of thousands of criminal, government and

(6)

corporate investigations involving computer evidence. This solid foundation of credibility and reliability provides a highly defendable and diligent process to establish compliance with the courts in E-Discovery matters and with the government in regulatory

investigations.

Directly illustrating this point is Williams v. Massachusetts Mutual Life Insurance Company11, where the court denied a plaintiff’s motion to allow its own computer expert to perform an on-site computer forensic investigation at Massachusetts Mutual. In refusing what the court correctly described as “an intrusion into an opposing party's information system” the court determined to its satisfaction that Massachusetts Mutual had already performed a proper computer forensic search and collection effort of its systems in response to the litigation.12 As such, Massachusetts Mutual was able to establish a defendable process and thus defeated the plaintiff’s tactics.

In addressing the degree of diligence required to comply with E-Discovery requirements, recent case law instructs corporate counsel to actively monitor compliance with

preserving computer evidence throughout the enterprise. In addressing the issue of best practices concerning the searching and analysis of computer evidence, the court in the seminal Zubulake v. UBS Warburg, LLC,13 decision held that counsel “must take affirmative steps to monitor compliance so that all sources of discoverable information are identified and searched,” and that the client has a “duty to locate relevant information … to preserve and timely produce that information.”

Importantly, the Zubulake court further noted that in the case of larger investigations, counsel should oversee a “system-wide keyword search” as part of an initial preservation effort, based upon search terms and other parameters, and where the search “hits” are preserved for later review.14 EnCase Enterprise is the only technology at the time of this writing capable of performing such a “system-wide keyword search” and preservation effort as described by the Zubulake court. EnCase Enterprise is highly versatile, being able to collect full disk images if necessary, or preserving targeted system-wide keyword search “hits.” This enables the organization to prevent overbroad and costly “fishing expeditions” by executing a more narrow search and collection effort specifically tailored to the scope of the investigation.

V. Conclusion

EnCase Enterprise is proven effective in helping protect an organization from many of the pains associated with a broken E-Discovery process. The EnCase technology is a tested means to curb runaway costs and to help shield an organization from many of the liability risks associated with E-Discovery. With the capabilities of EnCase Enterprise uniquely mapping to many of the legal requirements established by recent case law concerning E-Discovery, EnCase Enterprise represents best practices for an effective Enterprise E-Discovery process.