Click to download post as a PDF

A computer or smart phone under forensic examination is like a sprawling metropolis of neighborhoods, streets, buildings, furnishings and stuff–loads of stuff.  It’s routine for a single machine to yield over a million discrete information items, some items holding thousands of data points.  Searching so vast a virtual metropolis requires a clear description of what’s sought and a sound plan to find it.

In the context of electronic discovery and digital forensics, an examination protocol is an order of a court or an agreement between parties that governs the scope and procedures attendant to testing and inspection of a source of electronic evidence.  Parties and courts use examination protocols to guard against compromise of sensitive or privileged data and insure that specified procedures are employed in the acquisition, analysis, and reporting of electronically-stored information (ESI).

A well-conceived examination protocol serves to protect the legitimate interests of all parties, curtail needless delay and expense and forestall fishing expeditions.  Protocols may afford a forensic examiner broad leeway to adapt procedures and follow the evidence, or protocols may tightly constrain an examiner’s discretion, to prevent waiver of privilege or disclosure of irrelevant, prejudicial material.  A good protocol helps an examiner know where to start his or her analysis, how to proceed and, crucially, when the job is done.

As a litigator for over 35 years and a computer forensic examiner for more than 25 years, I’ve examined countless devices and sources for courts and litigants.  In that time, I’ve never encountered a forensic examination protocol of universal application.  “Standard” procedures change over time, adapted to new forms of digital evidence and new hurdles–like full-disk encryption, solid-state storage and explosive growth in storage capacities and data richness.  Without a protocol, a forensics examiner could spend months seeking to meet an equivocal examination mandate.  The flip side is that poor protocols damn examiners to undertake pointless tasks and overlook key evidence.

Drafting a sensible forensic examination protocol demands a working knowledge of the tools and techniques of forensic analysis so counsel doesn’t try to misapply e-discovery methodologies to forensic tasks.  Forensic examiners deal in artifacts, patterns and configurations.  The data we see is structured and encoded much differently than what a computer user sees.  The significance and reliability of an artifact depends on its context.  Dates and times must be validated against machine settings, operating system functions, time zones and corroborating events.

Much in digital forensics entails more than meets the eye; consequently, simply running searches for words and phrases “e-discovery-style” is far less availing than it might be in a collection of documents.

If you can conceive of taking the deposition of a computer or smart phone, crafting a forensic examination protocol is like writing out the questions in advance.  Like a deposition, there are basic inquiries that can be scripted but no definitive template for follow-up questions.  A good examiner–of people or computers–follows the evidence yet hews to relevant lines of inquiry and respects boundaries.  A key difference is, good advocates fit the evidence to their clients’ narrative where good forensic examiners let the evidence tell its own story.

If you’ve come here for a form examination protocol, you’ll find it; but the “price” is learning a little about why forensic examination protocols require certain language and above all, why you must carefully adapt any protocol to the needs of your case. Continue reading →

Can anyone doubt the changes wrought by the modern “smart” cellphone?  My new home sits at the corner of one-way streets in New Orleans, my porch a few feet from motorists.  At my former NOLA home, my porch faced cars stopped for a street light.  From my vantage points, I saw drivers looking at their phones, some so engrossed they failed to move when they could.  Phones impact how traffic progresses through controlled intersections in every community.  We are slow-moving zombies in cars.

Distracted driving has eclipsed speeding and drunken driving as the leading cause of motor vehicle collisions.  Walking into fixed objects while texting is reportedly the most common reason young people visit emergency rooms today.  Instances of “distracted walking” injury have doubled every year since 2006.  Doing the math, 250 ER visits in 2006 are over half a million ER visits today, because we walk into poles, doors and parked cars while texting.

Look around you.  CAUTION: This will entail looking up from your phone.  How many are using their phones? At a concert, how many are experiencing it through the lens of their cell phone cameras?  How many selfies?  How many texts?  How many apps?

Lately I’ve begun asking CLE attendees how many are never more than an arm’s length from their phones 24/7.  A majority raise their hands.  These are tech-wary lawyers, and most are Boomers, not Millennials.

Smart phones have changed us.  Litigants are at a turning point in meeting e-discovery duties, and lawyers ignore this sea change at peril.  The “legal industry” has chosen self-deception when it comes to mobile devices. It’s a lie in line with corporate bottom lines, and it once found support in the e-discovery case law and rules of procedure.  But, no more.

Today, if you fail to advise clients to preserve relevant and unique mobile data when under a preservation duty, you’re committing malpractice. 

Yes, I used the “M” word, and not lightly. Continue reading →

I’m livid about FBI Director James Comey’s handling of the Huma Abdein e-mails. “Reckless” doesn’t begin to describe Comey’s self-indulgent decision to release information about a situation he clearly does not yet grasp, in a manner that elevates Jim Comey above longstanding Justice Department policy and the integrity of a Presidential election.  Mr. Comey’s justification is couched entirely in his personal predilections, not those of the Bureau or Justice.  It is all “I, I, I” and none of  “we the Bureau” or “we the Justice Department.”  Mine is a procedural objection, not a political one. Whatever my glee at seeing Trump exposed for the weasel I know him to be, I would be every bit as critical had Comey’s half-baked announcement concerned Trump’s e-mail as Clinton’s.  But, Comey’s folly is an opportunity to glean some e-discovery insight.   Continue reading →

In the wee hours last evening, I received a question posed by Angela Bunting with Nuix down in Sydney, Australia.  Angela has such deep knowledge of e-discovery above and below the Equator that I was flattered to be queried by someone I’d go to for guidance.  It was a magnificent hypothetical question.

Angela posited a scenario where a producing party used emerging technolgies to either mechanically translate foreign language text to English or voice recordings to text.   In each instance, the quality of the resultant searchable text was poor, akin to bad OCR, and characterized by poor searchability due to malformed and missing words, misleading substitutions, etc.  As a  consequence of  this poor searchability, some documents that should have been produced were not and, to make matters worse, the requesting party had some of the omitted documents, so could readily demonstrate serious flaws in production.

Challenged by the requesting party, the producing party defends the use of the automated transcription or translation based on proportionality.  To do the same work any other way would have required use of costly and time-consuming manual labor.

So, there you have it: the automated approach was faster and cheaper, but also much less accurate and complete, resulting in a failure to produce non-privileged responsive material.

Angela asked what I believed the view of the courts might be in such a situation?  Would the Court require the work be done again using a more accurate, more expensive method? Might sanctions issue?  Would the Court excuse the failure based on proportionality?

Predicting what courts will do based on skeletal hypotheticals is a crap shoot.  Outcomes turn on the peculiar facts of each case and, when the issue is e-discovery, on counsels’ skill in acquainting the judge with the technical underpinnings.

But, I gave it a shot, and here’s my reply:

Continue reading →