Handling Large Data Sets

Transcription

1 Handling Large Data Sets Computer Forensics & Electronic Discovery Rob Weston

2 My Background Police Forensic Consultancy Kroll Ontrack Palmer Legal Technologies

3 Today s Talk Forensics and E-Discovery Modern Cases increased data volume Handling Large Data Sets Collection, Filtering and Review Proportionality Summary

4 Forensics and E-Discovery

5 Forensics and E-Discovery Computer Forensics The detailed analysis of media and data. Examples: Data Theft, inappropriate use of computer systems, fraud, internet investigations Electronic Discovery The review of very large amounts of data, often by multiple people, often for civil cases. Examples: Litigation, Fraud, M&A, internal investigations

6 Modern Cases and Large Data Sets

7 Modern Cases and Large Data Sets Example data set from a company with 100 staff: 100 users within the company, 1 file server, 1 server Six backup tapes from the server Six back tapes from the file server 100 Laptops How much data in total?

8 Modern Cases and Large Data Sets How much data? Each backup tape contains a back up of 100 users Each user has around 4,000 s and 500 attachments per backup 450,000 s and documents per backup 2,700,000 documents in the backup set for s File server back up has 15,000 files 90,000 files for the file server backups Each laptop: 5500 documents (each has an file) Laptops 550,000

9 Modern Cases and Large Data Sets Example company of 100 staff, total files available for review: Over 3 MILLION this is documents only, and does not include system files or junk data. If all the documents were printed out, this would be expected to take up around 150 tonnes of paper.

10 Modern Cases and Large Data Sets A single case can have a potentially colossal data universe How is this volume of data reviewed or investigated?

11 Handling Large Data Sets

12 Handling Large Data Sets Standard Process will be: Collection Filtering Review Proportionality Act Proportionally at all times

13 Collection

14 Collection Select the sources of data to be collected: Desktop Laptops Servers Backup tapes Select the method of collection Everything active, deleted, & fragmented Active files only Only required file types Plan the Collection: Allow for the scale of imaging and collection 1 or 2 desktops or 100 s of laptops? Do back up tapes exist? If so have they been preserved?

15 Collection Collection can be very technical. Ensure that the collection is conducted correctly and legally The collection is critical to the whole case and often can not be repeated

16 Filtering

17 Filtering Filtering is key as it radically reduces the volume of data. Traditional Methods Filter on Custodian Filter on Date, e.g a date range Filter on File type, e.g only office documents and no graphics Keyword Searching Remove Duplicates Improved Technology Conceptual Searching Near De-Duplication

18 Conceptual Searching Filtering

19

20 Near De-Duplication Filtering

21

22

23

24

25

26

27

28

29 Reviewing the Data

30 Review Tools Designed to review huge quantities of documents, e-documents, and Huge Market, rapidly growing Charges usually based per gigabyte Price varies depending on the tool and the company

31 Review Tools Plan the Review: Who is going to review the data? How many people want to review the data simultaneously? Is the data to be viewed locally, nationally or globally? What is the aim of the review: Prepare for Trial? Locate Documents?

32 Review Tools Software Includes: ReviewDoc Concordance Introspect I-connect Attenex

33 I-Connect Review Tools

34

35

36

37 Review Tools Attenex: Conceptual Searching Graphical Representation Social Networks

38

39

40

41

42

43

44

45

46 Proportionality

47 Proportionality What is reasonable for collection and review? reasonable not defined in law. No UK case law on the subject of E-Disclosure. Many decisions are made pre-trial The US has many more cases and so more case law Zubulake vs. UBS Warburg Guidelines Recent FTC Guidelines [Autumn 2006] Custodian Presumption (no more than 35) Two-Year Relevant Time Period Preservation of Backup Tapes no need to immediately push for restoration De-Duplication and Near De-duplication

48 Summary

49 Summary Large Data Cases will always require: Collection, Filter, and Review Consider the use of latest technology to aid in the filtering Concept Searching, near de-duplication Consider the issues of proportionality while planning and executing a review Cases will require a blend of legal and technical knowledge Get advice, get it early, and follow a plan

50 Questions?

51 Contact Rob Weston