According to the American Bar Association, a mere 10% of all documents created since 1999 are not digitally produced; the vast majority of existing records are now in some type of digital format. Deleting digital documents or failing to retrieve digital records when needed can increase a company’s risk of legal liability.
To minimize exposure to risk, many companies have employed a data retention process to aid in electronic discovery and computer forensics. Although both areas encompass the preservation and use of digital data, there are key differences between electronic discovery and digital forensics.
The Data Collection Process
Ediscovery is summarized as the process of collecting, preparing, reviewing, interpreting and producing electronic documents from hard disks and other forms of storage. During litigation, eDiscovery firms may be subpoenaed to give testimony on the methods a company used to collect the data. On the other hand, computer forensics involves the use of a forensic expert to protect data integrity and to bring forth the data stored on a hard disk. During discovery, forensic experts use particular software applications and may call forth analysts to provide their testimony as expert witnesses.
Reviewing and Interpreting Data
Another significant difference between both disciplines is the method used to analyze the data. Ediscovery firms typically do not analyze the data they collect. Additionally, they usually do not clarify the intent of a computer user and they generally don’t provide clients with legal advice. Ediscovery is the process of gathering all of the data and supplying the client’s legal counsel with the data and relevant tools, then allowing the client’s legal counsel to perform their own thorough review.
Forensic experts assist legal teams with producing evidence for their case. Forensic experts can also partner with attorneys to pinpoint keywords related to the case, and then cross-reference those keywords against the collected data. Forensic experts can discover encrypted information such as passwords, and they can access email messages and reassemble an Internet user’s history. An analyst will not only search for intact records, but will scan for deleted records and file fragments to attempt full recovery of the files needed to support or defend the claim.
The Roles Served by Both Disciplines
Unlike digital forensics, eDiscovery is not used to analyze or investigate data and its uses. It serves to gather and organize information that everyone can view, access and duplicate. If that data has been deleted or is unseen by the computer’s operating system, that information could possibly be retrieved with digital forensics, but not electronic discovery.
In the eDiscovery process, a computer forensic expert will need to be called upon at some point or another. An example of such a matter would be a company receiving a set of files on a hard drive. Once received, it is realized that the size of the data on the drive is less than what was anticipated and recorded. After further review, an employee is suspected of intentionally destroying information on the hard drive. A forensic specialist will be needed to determine if the claim of intentional destruction is true, and if so, how the data was destroyed by the user.
Although eDiscovery and digital forensics are very similar in nature, the key differences revolve around how the data is collected and presented, how it is reviewed and interpreted, how much data is involved, and whether professionals are needed to provide forensic data recovery. Forensics gather, preserve and restore data, and Ediscovery processes and delivers the data to the appropriate parties. Choosing a litigation support company with experience in both disciplines is crucial—technology leaders such as Teris.
Electronic discovery is rapidly changing the way courts do business. If there’s anyone in the legal world who still thinks ediscovery isn’t absolutely vital, here’s a few recent cases that should change your mind.
1. Oracle America v. Google
Oracle sued Google for alleged copyright infringement, stating that Google used Java programming language for its Android OS without obtaining licensing rights. Multiple emails were gathered through ediscovery and presented to the jury during arguments, including one from a chief engineer for Google which suggests negotiating a license from Java. Another email revealed that Google bigwigs requested that he research an alternative OS which was similar to Java.
2. State of Oregon v. Urbina
In this sexual assault case, the defendant was convicted of multiple sexual offenses. The defendant used computer software which allowed him to search for child pornography files and download them from a peer-to-peer filesharing network online. Although the defendant attempted to delete the incriminating evidence from his home computer, forensic software was able to find not only evidence that he attempted deletion, but also remnants of the pornography files themselves.
3. Danny Lynn Electrical v. Veolia Es Solid Waste
In this case, the plaintiff asked for sanctions against the defendant, stating the defendant had "blatantly disregarded their duty to preserve electronic information" because they had deleted pertinent emails after litigation had already begun in order to avoid ediscovery. The plaintiff additionally stated that the defendant had failed to properly maintain electronic records prior to litigation. As it turns out, the defendant was vindicated upon proving to the court they had recently implemented an email archiving system which automatically recorded and preserved all emails. The court ruled that there was insufficient proof to back the plaintiff's claim of evidence spoilation.
4. Northington v. H & M International
During these proceedings, the court issued an adverse inference instruction to the jury regarding destruction of emails and other relevant data. This evidence destruction occurred because ediscovery procedure regarding collection, identification, and preservation of pertinent data was not followed properly. Since several key documents were never found, the jury was instructed to presume that the company had destroyed the evidence.
5. United States v. Briggs
Through the U.S. Government produced thousands of pages of ediscovery in this criminal drug case, none of it was text searchable. The defense argued that presenting evidence in this manner made it nearly impossible for them to navigate, let alone mount any reasonable arguments. The court, in agreement with the defense, ordered the plaintiff to absorb the cost and time necessary to produce searchable materials for all parties instead
The many faces of evidence
Ediscovery is not just about finding supporting evidence which is used to prove or disprove a case; the electronic discovery process can also reveal if evidence has been destroyed or is missing. Sometimes the lack of evidence is just as elemental in winning a case as the evidence itself. The magic of ediscovery is that it addresses both sides of the evidence coin, while case histories are simultaneously building new guidelines regarding the responsibilities of companies to maintain proper electronic records.
