Posts By :

Brad Jenkins

eDiscovery Trends: iDiscovery


Yesterday was a day that tech enthusiasts and ordinary people alike had circled on their calendar since it was confirmed as the date of Apple’s press event to unveil the iPhone5. Apple proudly boasted that it had sold 400 million iOS devices by the end of June of this year, which can in part be attributed to the smoothly operating software running on their devices. Advances in mobile high tech have made these portable computers accessible and their presence inescapable even among late adopters. What is simple and intuitive from a user standpoint, however, can prove challenging and fickle to a computer forensics expert.

Richard Lutkus of Law Technology News writes that there are many factors that must be considered when investigating an iOS device, such as “device model, generation, storage capacity, iOS version, iCloud activation status, and passcode protection status. One example of the importance of these identification questions is iCloud, which is Apple's information syncing service. The presence and status of this service may be important because information found on an iOS device could be automatically synced to one or several computers or other iOS devices.”

Lutkus points out that mobile device forensics requires skills that not all computer forensic professionals possess. For example, an important part of the preservation of a mobile device is isolation from all data networks to ensure no changes occur on the device, such as a remote wipe.  A few ways of isolating the hardware include a signal blocking “Faraday” bag, removing the SIM card, or enabling airplane mode. From there, the two methods of imaging an iOS device are logical capture and physical imaging. Lutkus explains, “Logical capture is the preservation of all active (no file fragments or other ephemera) files on a device. This method is similar to an iTunes backup in that it saves the same types of data as iTunes backups. In contrast, physical imaging captures everything that a logical capture does, but includes deleted file fragments, temporary cache files, and other ephemera. Generally, physical imaging is more desirable if it is technically possible. Though slower, this approach is widely accepted, is compatible with most forensic tools, and preserves all data on a device.”

There are other challenges in preserving the data in an iOS device, especially hardware newer than the iPhone 4S and Ipad 3, which include encryption of even unallocated space of memory when a passcode has been used. The quality of data one might expect to find after imaging and decrypting could include: “contacts, call logs, speed dials, voicemail, Bluetooth devices, screenshots, bookmarks, web clips, calendars, messages, email, attachments, internet history, internet cookies, photos, audio recordings, notes, videos, music, app list, keystroke information, GPS coordinates, wi-fi network memberships, user names and passwords, map searches, app-specific data, cell tower information, serial number, device name, device IMEI (international mobile equipment identify number), device serial number, version, and generation, etc.” This type of information can be crucial in the first 7 to 10 days after litigation hits, as we have previously covered here. These devices seem to know so much about us that companies like Apple have had to release statements to state they are not recording and storing your location in response to allegations of privacy invasion. With the number of expected sales of the iPhone5 potentially adding between a quarter and a half percent to America’s GDP, there will be millions more iPhone’s will making their ways into the hands of consumers and eventually, no doubt, into the hands of mobile forensic experts.

So, what do you think? Have mobile computing devices, such as smartphones and tablets, been material to your eDiscovery work? Have other mobile operating systems, such as Blackberry or Android, presented challenges that differ from iOS? Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Announcement: Trial Solutions is now CloudNine Discovery!


In addition to today’s regular blog post about eDiscovery case law, we have an important announcement: Trial Solutions is pleased to announce that we have officially changed our name to CloudNine Discovery!

After much discussion, we determined that a more accurate name was needed to represent our expanded products and services which have developed over the years, particularly in the areas of online data and document review hosting

We selected our new name, "CloudNine Discovery" with two goals in mind: 1) to continue providing customer service that puts our clients "on cloud nine" and 2) to lead the world in combining self-service with managed hosting and "cloud" storage.  Cloud storage is a model of networked online storage where data is stored on multiple virtual servers, generally hosted by third parties, rather than being hosted on local servers.

Our mission will continue to be to simplify the discovery process through innovative technology, transforming data hosting into a world-class experience that is easy and affordable. CloudNine Discovery will offer the same products and services offered by Trial Solutions, and our core leadership will remain intact.

As for the eDiscovery Daily blog?  While the name of the sponsor has changed, the blog will continue to provide daily eDiscovery news and analysis each and every business day, just as we always have.  We haven’t missed a day yet (knock on wood!) and will do our best to continue to provide useful information from an eDiscovery perspective.

As always, please share any comments you might have or if you'd like to know more about a particular topic.

eDiscovery Budgeting, Part 3: Understanding the Elements Contributing to Cost


We've spent some time in Part 1 and Part 2 of this series discussing the factors and assumptions that go into eDiscovery budgeting, but what about the concrete eDiscovery process itself? In addition to understanding the factors that go into budgeting, it's important to recognize the elements that contribute to eDiscovery costs.

There are five primary factors that contribute to the costs of eDiscovery in progress:

  • Collection: Collection of ESI can be simple and effortless, conducted by the client itself, or it may require the assistance of a hired third party to gain access to the ESI. The cost of collection can go up depending on the level of travel required. Forensic investigation and custodian interviews are not always necessary, but also increase the cost in cases requiring them.
  • Volume: The raw volume of ESI is one factor in the cost of eDiscovery, but not necessarily the one that counts. What's most important is the volume that must be reviewed by human eyes—and that can mean all of it, or only a fraction of the total ESI retrieved. It's possible to filter eDiscovery data by removing unwanted file types, limiting a search to a particular date range, or searching for relevant key words and phrases in documents. In order to moderate cost, it's usually wise to start with a more limited eDiscovery scope and expand it to cover a larger volume if necessary.  Many eDiscovery service providers offer free early cost assessment services to help attorneys estimate the volume of potentially responsive data that needs to be processed and reviewed. 
  • Number of Custodians: The number of sources involved in the collection of data can increase exponentially the amount of time and effort involved in eDiscovery, thereby increasing the cost accordingly.
  • Human Review: This is the most expensive factor in eDiscovery, requiring as much as 80% of the total eDiscovery budget.  It requires not only human beings working on an hourly wage, but time spent on training and the learning curve as they become more adept at recognizing and refining the key elements and terms required to be produced in a particular case. The more people and time involved in data review, the greater the probable expense.
  • Case Complexity: While a simple case may require a limited scope and review process, complex court cases can involve searching the same documents for multiple types of information for discovery. As a result, complex cases require more time spent on a document review strategy, as well as on a more elaborate review process.

So, what do you think? Are there any other major factors in eDiscovery budgeting or expense? Please share any comments you might have or if you'd like to know more about a particular topic.

eDiscovery Budgeting, Part 2: Key Assumptions and Choices That Affect eDiscovery Budgeting


Friday, we talked about assumptions and elements that contribute to cost that need to be considered when budgeting for eDiscovery activities.

Now that you know a bit about the factors surrounding the cost of eDiscovery, let's take a look at budgeting and the estimates that attorneys provide to a client before beginning eDiscovery work. The first step in budgeting is to prepare an estimate based on your and your client’s best guesses and assumptions. What are some of these assumptions?

  • Volume: Volume is almost always the largest driver of cost, as it will affect not only the quantity of data to be collected and processed, but also the amount of time human beings must spend reviewing discovery documents for relevance and privilege. Volume is also one of the more ambiguous factors. The most accurate estimate of volume is in megabytes (MB), gigabytes (GB) or terabytes (TB), but you won't always have access to these kinds of size descriptions. Instead, a client may tell you that there are "50,000 or so pages" of data, or "about 10,000 emails". The size of pages can vary widely depending on whether they are in an email, a PDF, or a word document, so it can be very difficult to estimate volume with any degree of accuracy.
  • Scope: It's wise to start with the smallest possible scope and expand if necessary, but that can be an inefficient way to review documents for eDiscovery, as it may mean going over the same files twice for different aspects of your eventual scope.
  • Efficiency: Whenever possible, it's important to plan an eDiscovery strategy in advance that will allow for a more efficient review of documents and data. The ability to maintain an efficient process of eDiscovery is largely dependent on timing and the ability to plan.
  • Timing: More time for eDiscovery activities means that the scope and search details can be refined, optimizing efficiency and minimizing costs. If the eDiscovery must be done in a hurry, efficiency suffers and costs rise.
  • Risk: Risk tolerance is a factor in cost, determining how much attention must be paid to refining every aspect of document review and data access. Mitigating risk up front through agreement and cooperation with opposing counsel can clearly define the risk so that you know where you stand.
  • Location: Where the data is located can affect costs and so can the jurisdiction of the case.  For example, different courts have provided different rulings on spoliation claims, so it’s important to consider location as part of the budgeting process.

So, what do you think? Have you found any of these assumptions to be especially problematic in your own eDiscovery budgeting estimates? Please share any comments you might have or if you'd like to know more about a particular topic.

eDiscovery Budgeting, Part 1: Assumptions and Elements that Contribute to Cost


While attorneys may struggle with the regional and international regulations surrounding eDiscovery, your client is likely to be less concerned with the practical legal details of your discovery request, and more concerned with the financial cost.

Whether you're working with the plaintiff or the defense, one of the most important considerations in preparing for eDiscovery is presenting the expense accurately and completely to the client – and that means understanding for yourself the factors that go into budgeting for eDiscovery. There are two main sets of elements to consider: those that affect budgeting and estimates, and those that will have a direct impact on the ultimate cost of eDiscovery.

Understanding Assumptions in eDiscovery

Because so much of the eDiscovery process cannot be predicted without accurate information, it's important to confirm any estimates from a client or from opposing counsel before proceeding with a budget.

Does your client really know the volume of data that is likely to be contained in certain files or backups, or are they providing generalized figures that may not be accurate? Do you know for certain the precise scope of the information you need to examine for discovery? Attorneys need to verify as many estimates as possible, noting any and all assumptions in their estimates so that the client can prepare for potential changes in eDiscovery costs if those early assumptions prove to be inaccurate.

eDiscovery budgeting is predicated on guesswork and assumptions that may include:

  • Volume
  • Scope
  • Efficiency
  • Risk
  • Timing

Each of these factors will be discussed in an upcoming blog post next week detailing the assumptions that go into estimating a budget for eDiscovery.

Breaking Down the Cost of eDiscovery

Once the estimate is complete and you’re ready to tackle the real work of eDiscovery, there are particular elements that contribute to the cost, while others are more minimal.

Some of the major elements comprising the cost of eDiscovery include:

  • Collection: including factors such as travel, retrieval, custodian interviews, and forensic collection (if necessary)
  • Volume of data
  • Number of custodians
  • Human review: the most expensive factor in eDiscovery costs
  • Case complexity

I'll discuss more on each of these factors in an upcoming blog post, as well.

The cost of eDiscovery can also be affected by the degree of open communication with opposing counsel. A cooperative relationship with the opposition can streamline discovery, while a contentious relationship makes it likely that discovery-related motions and court appearances will increase the total cost of this process.

So, what do you think? How much up front effort goes into your eDiscovery budgeting process? How do you monitor progress against the budget?  Please share any comments you might have or if you'd like to know more about a particular topic.

Case Law: Spoliate Evidence and Go to Jail–OR NOT?!?

As previously referenced in eDiscovery Daily, defendant Mark Pappas, President of Creative Pipe, Inc., was ordered by Judge Paul W. Grimm to  “be imprisoned for a period not to exceed two years, unless and until he pays to Plaintiff the attorney’s fees and costs that will be awarded to Plaintiff as the prevailing party pursuant to Fed. R. Civ. P. 37(b)(2)(C).”.

Judge Grimm found that “Defendants…deleted, destroyed, and otherwise failed to preserve evidence; and repeatedly misrepresented the completeness of their discovery production to opposing counsel and the Court.”  As a result, he ordered “that Pappas’s pervasive and willful violation of serial Court orders to preserve and produce ESI evidence be treated as contempt of court”, resulting in the severe sanction.

Pursuant to Magistrate Judge Grimm’s September 9 decision and order and the relevant local rule, however, defendants were allowed to object to the same order. In that briefing, Mr. Pappas’ counsel argued that “[t]his Court’s power to impose a coercive civil contempt sanction … is limited by a party’s ability to comply with the order,” and further that, “[i]f the fee awarded is so large that Mr. Pappas is unable to pay it, the ordered confinement would not be coercive, but punitive, and could not be imposed without criminal due process protections.” Defendants thus requested that Magistrate Judge Grimm’s order be modified such that, following the quantification of the fee award, Mr. Pappas be permitted to demonstrate his inability to pay it, and further to provide that Mr. Pappas would only be confined if he is able to pay but refuses to do so. The District Court agreed with Mr. Pappas’ counsel and, on November 1, 2010, issued a Memorandum and Order holding as follows: “[T]he Court does not find it appropriate to Order Defendant Pappas incarcerated for a future possible failure to comply with his obligation to make payment of an amount to be determined in the course of further proceedings. Certainly, if Defendant Pappas should fail to comply with a specific payment order, the Court may issue an order requiring him to show cause why he should not be held in civil contempt for failure to comply with that payment order. Also, under appropriate circumstances, criminal contempt proceedings might be considered.”

That same day, the Court further ordered that defendants must pay plaintiff the amount of $337,796.37 by November 5 and, if such payment is not made, defendants must appear on November 8 for a civil contempt hearing. Moreover, if defendants failed to pay and Mr. Pappas failed to appear at the civil contempt hearing, “a warrant may be issued for his arrest so that he shall be brought before the Court as soon as may be practicable.” From the docket it appears that ultimately the parties resolved the issue between them without the need for a further contempt proceeding.

So, what do you think?  What will happen next?  Please share any comments you might have (including examples of other cases where sanctions included jail time) or if you’d like to know more about a particular topic.

Case Summary Source: E-Discovery Law Alert, by Gibbons P.C.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

SaaS and eDiscovery: Load Your Own Data

Software as a Service (SaaS) applications hosted “in the cloud” are continuing to become more popular.  A new IDC study forecasts the SaaS market to reach $40.5 billion by 2014, an annual growth rate of 25.3%.  Also by 2014, about 34% of all new business software purchases will be via SaaS applications, according to IDC.

If you haven’t used a SaaS application, you haven’t used the Internet.  Amazon, Facebook, Twitter, eBay and YouTube are all examples of SaaS applications.  Ever shared a document via Google Docs with a colleague or business partner?  Use for Customer Relationship Management (CRM)?  These are SaaS applications too.

Like any software application, SaaS applications are driven by data.  Many enable you to upload your own data to use and share via the Web.  Facebook and YouTube enable you to upload and share pictures and videos, Google Docs is designed for sharing and maintaining business documents, and even allows you to upload contacts via a comma-separated values (CSV) file.

eDiscovery SaaS Applications

SaaS applications have also become increasingly popular in eDiscovery (especially for review and production of ESI) with several eDiscovery SaaS applications available that provide benefits including: no software to install, intuitive browser-based interfaces and ability to share the collection with your client, experts, and co-counsel without distributing anything more than a login.

However, most eDiscovery SaaS applications do not enable the user to upload their own data.  Or, if they do, it can be costly.

One exception is OnDemand™, which has now rolled out the new SelfLoader™ module in beta to enable clients to load their own data.  With SelfLoader, clients can load their own images, OCR text files, native files and metadata to an existing OnDemand database using an industry-standard load file (IPRO’s .lfp or Concordance’s .opt) format.

The best part?  You can load your data for free.  With SelfLoader, OnDemand provides full control to load your own data, add your own users and control their access rights.

Is this a start of a trend in eDiscovery?  Will more eDiscovery SaaS providers provide self-loading capabilities?  What do you think?  Please share any comments you might have or if you’d like to know more about a particular topic.

eDiscovery Best Practices: Cost of Data Storage is Declining – Or Is It?

Recently, I was gathering information on the cost of data storage and ran across this ad from the early 1980s for a 10 MB disk drive – for $3,398! That’s MB (megabytes), not GB (gigabytes) or TB (terabytes). What a deal!

Even in 2000, storage costs were around $20 per GB, so an 8 GB drive would cost about $160.

Today, 1 TB is available for $100 or less. HP has a 2 TB external drive available at Best Buy for $140 (prices subject to change of course). That’s 7 cents per GB. Network storage drives are more expensive, but still available for around $100 per TB.

At these prices, it’s natural for online, accessible data in corporations to rise exponentially. It’s great to have more and more data readily available to you, until you are hit with litigation or regulatory requests. Then, you potentially have to go through all that data for discovery to determine what to preserve, collect, process, analyze, review and produce.

Here is what each additional GB can cost to review (based on typical industry averages):

  • 1 GB = 20,000 documents (can vary widely, depending on file formats)
  • Review attorneys typically average 60 documents reviewed per hour (for simple relevancy determinations)
  • That equals an average of 333 review hours per GB (20,000 / 60)
  • If you’re using contract reviewers at $50 per hour – each extra GB just cost you $16,650 to review (333×50)

That’s expensive storage! And, that doesn’t even take into consideration the costs to identify, preserve, collect, and process each additional GB.

Managing Storage Costs Effectively

One way to manage those costs is to limit the data retained in the first place through an effective records management program that calls for regular destruction of data not subject to a litigation hold. If you’re eliminating expired data on a regular basis, there is less data to go through the EDRM discovery “funnel” to production.

Sophisticated collection tools or first pass review tools (like FirstPass™, powered by Venio FPR™) can also help cull data for attorney review to reduce those costs, which is the most expensive component of eDiscovery.

So, what do you think? Do you track GB metrics for your eDiscovery cases? Please share any comments you might have or if you’d like to know more about a particular topic.

Social Tech eDiscovery: Twitter Guidelines for Law Enforcement

Tuesday, I provided information regarding Facebook’s Law Enforcement page with information about serving civil subpoenas. Facebook provides quite a bit of useful information regarding serving subpoenas, including the address for registered agent (to process requests), information required to identify users, fee for processing, turnaround time, and fee to expedite responses. Facebook is very informative with regard to how subpoenas are handled in terms of cost and time to process.

So, it makes sense to look at other popular social media sites to see how they are handling this issue. Twitter is probably right behind Facebook in terms of popularity in the social media world and they have a “Guidelines for Law Enforcement” page to address requests for non-public information for Twitter users.

As the Twitter policy notes, most Twitter profile information is public, so anyone can see it. A Twitter profile contains a profile image, background image, as well as the status updates, which, of course, they call “tweets”. In addition, the user has the option to fill out location, a URL, and a short “bio” section about themselves for display on their public profile. Non-public information includes “log data” such as IP address, browser type, the referring domain, pages visited, search terms and interactions with advertisements (as noted in their Privacy Policy page).

Twitter doesn’t provide any cost information regarding processing subpoena requests, nor do they address standard turnaround times or fees to expedite processing. Their policy is to notify users of requests for their information prior to disclosure unless they are prohibited from doing so by statute or court order and they do require the URL of the Twitter profile in question to process any subpoena requests. They do provide email, fax and physical address contact information to address user information requests. FYI, only email from law enforcement domains will be accepted via the email address. Preservation requests must be signed with a valid return email address, and sent on law enforcement letterhead. Non-law enforcement requests should be sent through regular support methods (via their main support page).

So, what do you think? Have you ever needed to file a subpoena on Twitter? Please share, or let us know or if you’d like to know more about a particular topic.

Social Tech eDiscovery: Facebook Subpoena Policy

As President and CEO of Trial Solutions, I’ve noted and embraced the explosion in use of social technology over the past few years (Trial Solutions has a Facebook, Twitter and LinkedIn page, and this blog, with more to come soon). According to new statistics from Nielsen, social network sites now account for 22.7% of time spent on the web, a 43% jump in one year (by contrast, email only accounts for 8.3%). With that explosion in social tech use, companies have had to address social media as another form of media to collect for eDiscovery. It seems there’s a new article or blog post online every week on the subject and there is a social media webinar at Virtual Legal Tech this Thursday.

As probably the most popular social media site, Facebook is one of the most likely sites for relevant ESI. There are already a number of stories online about people who have lost their jobs due to Facebook postings, such as these. There is even a Facebook group to post stories about Facebook firings. Oh, the irony!

Naturally, cases related to Facebook eDiscovery issues have become more prevalent. One case, EEOC v. Simply Storage Management, resulted in a May ruling that “SNS (social networking site) content is not shielded from discovery simply because it is ‘locked’ or ‘private’”. So, request away!

If the employee resists or no longer has access to responsive content (or you need to request from their online friends through “Wall” posts), you may have to request content directly from Facebook through a subpoena. Facebook has a Law Enforcement page with information about serving civil subpoenas, including:

  • Address for Registered Agent (to process requests)
  • Information Required to Identify Users – Facebook user ID (“UID”) or email address
  • Fee for Processing ($500, plus an additional $100 if you want a notarized declaration)
  • Turnaround Time (minimum of 30 days)
  • Fee to Expedite Responses ($200)

Obviously, fees are subject to change, so check the page for the latest before serving your subpoena.

So, what do you think? Have you ever needed to file a subpoena on Facebook? Aware of other case law related to Facebook eDiscovery? Please share, or let us know or if you’d like to know more about a particular topic.

  • 1
  • 2