January 17, 2013 CLE 1 General Credit Presented to: Association of Corporate Counsel

Transcription

1 January 17, 2013 CLE 1 General Credit Presented to: Association of Corporate Counsel

2 Current Sources for Collection & Forensics Laptops, Desktops, Tablets Virtual Machines Cell Phones Network Shares CDs/DVD, Thumb Drive Social Media Webmail Cloud storage Back-up Tapes

3 Corporate Network Architecture

4 Duty to Preserve & Legal Holds

5 Duty to Preserve Once an entity reasonably anticipates litigation It must suspend its document destruction policies Zubulake IV: service of complaint is the latest possible date the duty to preserve may attach Recent Seventh Circuit (Pradaxa) decision supports the reasonable anticipation doctrine Court found that the duty to preserve arose after the at-issue information was destroyed in accordance with Defendant s document retention policies and that an adverse inference was not warranted. The duty to preserve is triggered only when a litigant knew or should have known that litigation was imminent (at least in the Seventh Circuit). In re Pradaxa (Dabigatran Etexilate) Prods. Liab. Litig., MDL No. 2385, 2013 WL (S.D. Ill. Sept. 25, 2013)

6 Litigation Holds Notify your response team Send an immediate notice of the Litigation Hold, including: Instruction to all impacted employees and IT Department to save e- mail and electronic documents, as well as paper files Broad description of possibly relevant documents (Wiginton v. CB Richard Ellis, Inc., 2003 U.S. Dist. LEXIS (N.D. Ill., Oct. 24, 2003). Suspend deletion policies for: Custodians identified or known to be relevant Servers, clouds, wikis, collaboration spaces, etc. Turn off automatic deletion defaults

7 Permissible Loss, Damage, Alteration or Overwrite of ESI? FRCP 37 (e) & Cal. C.C.P. govern Absent exceptional circumstances, a court may not impose sanctions under these rules for failing to provide [ESI] lost as a result of the routine, good-faith operation of an electronic information system. Five new CA provisions are based on FRCP 37(e) - [A]bsent exceptional circumstances a court may not impose sanctions... for failing to produce [ESI] lost, damaged, altered, or overwritten as a result of the routine, good faith operation of an electronic information system See also: C.C.P (l)(1), (i)(1), (d)(1), (j)(1) and (d)(1) Rule 37(f) responds to a distinctive and necessary feature of computer systems - the recycling, overwriting, and alteration of [ESI] that attends normal use.... Even when litigation is anticipated, it can be very difficult to interrupt or suspend the routine operation of computer systems to isolate and preserve discrete parts of the information they overwrite, delete, or update on an ongoing basis, without creating problems for the larger system. The Committee Note re the comparable F.R.C.P. Rule 37(f), Report of the Judicial Conference Committee on Rules of Practice and Procedure (Agenda E-18, Rules, September 2005) at 32.

8 Where do you start. Who are the relevant custodians? What is the key subject matter? When - What are the relevant dates? Where is the data stored? What types of data? What types of metadata?

9 Collections

10 Collections Interview Process 1. IT Questionnaire a. What did IT say about the potential data sources? 2. Custodian Questionnaire a. What did the end user say about where they store data?

11 Interview IT first when possible Provide IT the questionnaire regarding possible data sources. Have them review it prior to their interview. There are many times when IT knows of data sources or legacy data sources that could be overlooked. Ask questions about backups even though you may not need them.

12 IT Collection Questionnaire Custodian Information o Key Custodians o Key IT Personnel ESI Systems o Asset Library o Work Stations o Servers o Cloud Computing o Data Map & Protocols o Data Map o Data Retention & Destruction Other Media o External Media o Back-up Media o Personal Devices Functional Requirements o Multi Media Preservation or Litigation Holds o Efforts undertaken to date o Any suspension of document destruction practices, etc. Case Documentation o Pleadings o Production Protocol o Discovery Orders/Rulings Non Discoverable Data Sources o Undue Burden Miscellaneous o Safe Harbor o Privilege Terms o Claw Back

13 Data Map What is a data map? A roadmap of the known data locations for a specific matter. Laptops Network Shares Backups The collection methodology can easily be generated from the known data locations.

14 Data Map The following is a summary of the main sources of electronicallystored information (ESI): Employee Workstations o There are 25 Windows laptops. o Employees store local Outlook archives as well as native files on their local workstation. o Their My Documents folder is synced to a file server. Server Shares o There are individual and group file shares. The estimated volume of data is 250 to 300 GB s. Server o Location A (City A) is running a Microsoft Exchange Server o Location B (City B) is running a Microsoft Exchange Server o Location A is running a Blackberry Enterprise Sever (BES) to support their Blackberry users. o Location A uses RedGate for archiving. ERP Server o Company X is running Microsoft Dynamics NAV (Navision). This isan enterprise resource planning software product that is intended to assist with finance, manufacturing, customer relationship management, supply chains, analytics and electronic commerce.

15 Custodian Interview Based on the information you learned from IT, you can now customize the Custodian Questionnaire. The questionnaire will list common data sources used within the company as well as data sources that are commonly used for personal use. With BYOD, the lines are blurred between corporate assigned devices and personal devices.

16 Custodian Questionnaire If you have been contacted by Widgets Legal in connection with the Giants matter, there is a document collection process that is initiated in order to collect all relevant documentation related to this case. The following areas should be checked for any relevant materials: 1. Any and all computing and electronic devices used by a custodian during the course of employment at Widgets including: all Widgets assigned laptops, (shared) workstations or personal devices used to perform work duties. 2. Any network drive used for storage of materials. Please provide a listing of the folders that may contain relevant material. Here are some examples of network drives: H: Drive (Home Directory) W: Drive (Share Files) S: Drive (Employee Share) 3. All held by a custodian in any of the following locations: Lotus Notes Mailbox Lotus Notes (NSF) Message Files (EML) or other formats 4. All hard copy workbooks, notepads, files or any other written documentation in the possession of a custodian. 5. Any internal shared portals created, maintained, edited, or used by a custodian. For example: SharePoint Sites Please provide a URL of the site(s) you use Amazon Sites Please provide a URL of the site(s) you use 6. Any SaaS/ASP s maintained, managed, or used by a custodian. For example: Marketing Materials Administrative SAP Financial SAP Sales 7. Any PDA or portable media devices. For example: PDA USB Thumb Drive USB Hard Drive CD/DVD 8. Any personal computing devices not owned by Widgets that were used for work related activities. Virtual Drop Boxes (Box.net) Home or Personal Computer FTP Sites

17 Collection Options Guided Self Collection Traditional Collection Methods Full Forensic Images Targeted Collections Web Mail (POP vs IMAP) Network Server Shares SaaS Applications Cell phones, PDA, Smart Phones, PDA & Tablets SharePoint & Web Portals Personal Devices Remote Collection Methods Selective Forensic

18 Misguided Self Collection How not to do it. National Day Laborer Facts - Plaintiffs sought information from several U.S. Government Agencies; issued FOIA requests Defendant Agencies missed initial production deadline; Judge Scheindlin ordered new production drop dead date Agencies searched through records/esi and produced in accordance with new deadline. Plaintiffs argued that the searches didn t include custodians likely to possess relevant data, and that the search methodology employed on the custodians they did search wasn t adequate. The court reviewed the defendant Agency s retrieval process and agreed with the plaintiffs, noting: [I]t [is] abundantly clear that a court cannot simply trust the defendant agencies unsupported assertions that their lay custodians have designed and conducted a reasonable search... National Day Laborer Organizing Network et al v. United States Immigration and Customs Enforcement Agency, et al U.S. Dist. Lexis (SDNY, July 13, 2012)

19 Safe Methods of Self Collection: Training, Tools & Repeatable Standard Operating Procedures (SOPS) Examples of Tools: EnCase Portable Self Collection Nuix Collector Custodian Self Collection Examples of Self Collection SOPs: Self Collection of Local Outlook Archives

20 Traditional Collection Methods Forensic Collections Bit for bit copy of the original. Logical Collections Robocopy FTK AD1 File EnCase L01 Social Media X1 Cellular and Tablet Cellebrite

21 Remote Collections Full Forensic Images EnCase Portable Live Collection with FTK Selective File Collections with Total Discovery

22 Forensically Sound Method Change of Custody Preserves integrity of the data (hash values) Repeatable process Defensible

23 Chain of Custody

24 Hash Value Integrity

25 Challenges posed by Solid State Drives (SDD)

26 What is the challenge? Rotational Media Drives (HDD): Data from a deleted file is accessible Data is static and consistent Drive hash is always consistent Solid State Drives (SSD): Data from erased file may disappear immediately or over time Data changes over time Drive hash may not always be consistent

27 What is an SSD? a solid state disk is a high-performance plug-and-playstorage device that contains no moving parts. SSD components include either DRAM or EEPROM memory boards, a memory bus board, a CPU, and a battery card. An SSD (solid-state drive or solid-state disk) is a storage device that stores persistent data on solid-state flash memory. Advantages: fast, robust, low power Disadvantages: price per GB, lifespan

28 Types of SSD Volatile Memory (RAM) Static RAM Dynamic RAM Non Volatile Memory Flash (NOR, SLC, MLC, emlc) F-RAM ReRAM M-RAM PRAM

29 Best Practice Understand the differences between HDD and SSD imaging You may only get one chance Know the limitations of your lab/technology Litigation Hold Letters Consider specific instructions for SSD ESI requests Require immediate imaging of devices Delays? STOP! Power off equipment and get a hold of a specialist ESI will potentially degrade with any attempts

30 Overview Preservation Effort Duty to preserve beings with reasonable anticipation of litigation, not with a filed complaint Litigation Hold Document the entire process from custodian interviews, to responses Interviews Collaborate with IT to identify potential data sources Custodian interviews tailored to help them understand what you are looking for laymen's terms Collect the data Self collection, forensic, logical, targeted, remote, etc. Document all processes, procedures and parties who may have been involved in these efforts!

31 Any Questions? Adam Wells, Vice President ediscovery Consulting, Jack Grimes, Director of IT,