• Home
  • About
  • CRAIGBALL.COM
  • Disclaimer
  • Log In

Ball in your Court

~ Musings on e-discovery & forensics.

Ball in your Court

Category Archives: E-Discovery

Busted! How Happy Accidents Help Forensic Examiners Prove Data Theft

26 Saturday Jan 2013

Posted by craigball in Computer Forensics, E-Discovery

≈ 12 Comments

datatheftA big part of my practice is assisting courts and lawyers in cases where it’s alleged that a departing employee has walked off with proprietary data. There’s quite a lot of that. Studies in the U.S. and abroad suggest that some two-thirds of departing white collar employees leave with proprietary data. So, it seems data theft is the norm.

Of course, not all data leaves with the requisite scienter (“evil intent”) to be called theft. In this wired world, who doesn’t have data on thumb drives, phones, tablets, backup drives, webmail accounts, legacy devices, media cards, CDs, DVDs, floppy disks and good ol’ paper? You work for a company a while and you’re going to end up with their stuff strewn all over your devices and repositories. But, few data theft lawsuits stem from stale data on forgotten media.

The “classic” data theft scenario is the after-hours mass movement of copious quantities of closely-guarded internal documents to an external USB hard drive or capacious thumb drive. While such actions look dastardly at first blush, a few dimmer bulbs may actually act with a pure heart, intending to take only their personal data (like family photos or music), but dragging entire folder families that also hold corporate ESI.

I tend to be skeptical of such claims unless the usage patterns that follow and other forensic evidence bear out the “I really thought it was just my stuff” defense.  It’s not hard to tell the difference, so long as devices aren’t lost or corrupted.

But you may be wondering: How do forensic examiners determine data was taken, and how do they identify and track storage devices used to carry away ESI? Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Pomp and Circumstance

24 Thursday Jan 2013

Posted by craigball in E-Discovery

≈ 10 Comments

Damn I'm GoodIt’s easy to get discouraged about the state of e-discovery education in America.  Within the bar, we trot out the same high level platitudes and shopworn caselaw at brief CLE sessions, omitting the technical content that lawyers desperately need but resolutely ignore.  So, it was heartening to be part of a weird and wonderful event this evening that restored a bit of my optimism.

Bill Hamilton, the Quarles & Brady partner from Tampa, is also Dean & Chairman of the Department of E-Discovery at Bryan University.  Bill has quietly and modestly made major contributions to e-discovery education in the United States, and I think it’s fair to label him the brains behind Bryan University’s flegling E-Discovery Project Management Certificate program.  It’s a splendid distance learning program, and whatever you may think about bricks-and-mortar universities versus their online counterparts, Bill and his distinguished Board and faculty have made sure that their classrooms of electrons preserve all the rigor of the ones made of atoms.

Dean Hamilton invited me to deliver the commencement address to the graduating class.  I was both flattered and flustered as I’d never given a commencement speech before and wasn’t sure how one would address the students and their proud family members and friends in a virtual environment.  I supposed it would be like a webcast, and it was, complete with my customary PowerPoint slides (Yes, it’s true I can’t sneeze without accompanying digital imagery). Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Spilling the Beans

23 Wednesday Jan 2013

Posted by craigball in Computer Forensics, E-Discovery

≈ Comments Off on Spilling the Beans

beansI don’t do paid product endorsements (though I’m flattered when someone asks that I do).  So, if I sound like a shill when I come across something that helps me, it’s because I want it to help you, too.  That said, if you buy something as important and expensive as an e-discovery tool or review platform just because I use and like it, you haven’t done your due diligence.

I do freely endorse products I use and love (and I try to be as reticient as my big mouth allows concerning products I use and don’t love).  There are a handful of tools that fall into the category of “What would I do without them?”   Some are free little gems, like FTK Imager.  Others, like X-Ways Forensics or Prooffinder, are extraordinary bargains that pay for themselves in every case.  Finally, there are tools that don’t come cheap but equip lawyers, firms and companies with such powerful capabilities that they tip the scales steeply in their users’ favor in terms of getting a handle on the cost and complexity of e-discovery.  One of these is Nuix, an Australian import that I turn to almost daily to gain the upper hand with the evidence in my cases.

With that gassy preface, let me spill the beans on a little video that offers a lively perspective on data volumes in e-discovery.  It commits the cardinal sin of offering a byte equivalency for ESI, but it does it in the right way: by stating its assumptions up front and identifying the composition of the data used for the extrapolation.  Above all, I applaud Nuix’ courage in choosing beans to make its point.  Considering the well-known propensities of the musical fruit, it’s hard to conceive of a better analogue for the gusts of hype that will waft through the halls of LegalTech New York next week!  See you there!

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Master Bates Numbers in E-Discovery

28 Friday Dec 2012

Posted by craigball in E-Discovery

≈ 12 Comments

 Rat VorgasmThe sophomoric title of this post strives to underscore the trial bar’s proclivity to self-abuse when it comes to the petulant insistence on Bates numbers embossed on each “page” of ESI produced in discovery.  My previous post on native production began by referencing a famous psychology experiment.  Comments to that post concerning Bates numbers prompted my recall of another famous psychology experiment, where McGill University’s James Olds and Peter Milner set up an apparatus electronically stimulating the pleasure (i.e., orgasm) center of rats’ brains.  Given control of their stimulus, the rats began virtually tossing one off about 2,000 times an hour, ignoring food, water and hockey.  This is why men must rest between orgasms; else, we would die of dehydration in adolescence. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Blind as a Cat: Lawyers vs. Native Production

27 Thursday Dec 2012

Posted by craigball in E-Discovery

≈ 14 Comments

Blind as a catI took Introductory Psychology with a phalanx of freshmen in the cavernous Hamman Hall amphitheater at Rice University. Thirty-five years later, I best remember the astounding experimental work of Cambridge researchers, Colin Blakemore and G.F. Cooper, proving the ability to see isn’t born in us, but must be learned. Blakemore and Cooper reared kittens in darkness save for five hours a day when the kittens were placed in environments rigged so they could see only horizontal or vertical stripes.  When later exposed to a dangling black rod, the felines reared with horizontal stripes could see the rod only when it was positioned horizontally. As the rod was turned vertically, only the vertical world kittens saw it.  The rod “disappeared” in the eyes of the horizontal world kittens. Deprived of experience with the other plane, each group of kittens was incapable of seeing it. Their visual cortices didn’t develop the cells to see the horizontals or verticals they’d never experienced.

I think of those poor kittens as I ponder the relentless pushback I face trying to help lawyers see the unmistakable advantages of native review and production of ESI versus TIFF image and load file productions.  I’m starting to appreciate that what strikes me as pig headedness may just be kitten headedness. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Congratulations to Paul Grimm, U.S. District Judge

03 Monday Dec 2012

Posted by craigball in E-Discovery

≈ 4 Comments

http://chrisdale.files.wordpress.com/2011/05/judgegrimm.jpg?w=450Today was the last class of the semester for the Electronic Discovery & Digital Evidence course I teach at the University of Texas School of Law.  It’s been a great semester thanks to a luminous group of students who patiently endured fourteen three-hour classes and shined in six practical exercises on data mapping, encoding, legal hold, metadata and hash analysis, meet-and-confer and search and review.  But, there is nothing I could have done to make our final class more remarkable and memorable than the  excitement and joy of having today’s distinguished guest speaker, Magistrate Judge Paul Grimm, confirmed by the U.S. Senate as the nation’s newest Article III District Judge at the very moment he was concluding his videoconference with my class.

Congratulations, Judge Grimm!  No one more richly deserves this rare distinction, and everyone in the class will long remember that they were privileged to be part of the moment.  Thank you.

That Judge Grimm took the time during the Senate roll call vote to keep his promise to teach the class is so characteristic of the man’s honor, generousity and longstanding commitment to legal education, especially with respect to electronic discovery and digital evidence.  It felt like President Obama was teaching my Constututional Law class on election night.  Thanks again, Your Honor, and congratulations!  May you enjoy a long and healthy life to go with your new lifetime appointment.

Photo credit: Chris Dale

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

HP Autonomy A Bit Off the Mark on Autonomy

20 Tuesday Nov 2012

Posted by craigball in E-Discovery

≈ 4 Comments

Tags

HP Autonomy fraud Hewlett-Packard Lynch

Some weeks ago, I again slammed HP’s acquisition of Autonomy and forecasted a $4 billion dollar write down on the deal.  Well, I blew it.  Turns out the deal was far worse than even this vocal naysayer imagined.  Today, HP conceded that Autonomy was more scam than wham and took an $8.8 billion charge against the $10.3 billion purchase price of barely a year ago.  I’m guessing that HP is attributing some value to fancy teas in the break rooms.

In the final analysis, it can be safely concluded that the acquisition will indeed pump millions into the e-discovery economy as HP sues everyone in sight.  I wouldn’t want to be, say, KPMG or Deloitte, right about now, sheepishly defending my due diligence on the acquisition or the audit.  Has everyone lost the ability to gauge real value anymore?  Let the finger pointing begin!

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Patently Unclear

11 Sunday Nov 2012

Posted by craigball in E-Discovery

≈ 7 Comments

Back when I first heard about credit default swaps and mortgage backed securities, I applied my rule-of-thumb for non-traditional investments.  That is, if I try to understand the mechanics and value of a process and can’t, maybe there’s less there than meets the eye.  It’s an egocentric approach but, it’s kept me from following the crowd into some pretty awful investments.  If I don’t get it, I don’t buy it.

Searching ESI is what I do during much of my waking hours, so I pretty well “get” searching ESI.  I still regard myself as more a student than a teacher of technology assisted review, but I’m trying very, very hard to “get” all the variations of these advanced analytic technologies…with mixed success.  I should mention: You can’t use the If I don’t get it, I don’t buy it credo unless you also bust your hump trying to get it.

I mention all of this by way of noting that Nicholas Economou, the Chairman and CEO of e-discovery service provider H5, kindly dropped me a note to announce that H5 had secured a patent for its “high recall and high precision relevancy searching” process.  Per H5’s press release, U.S. patent number 8,296,309 covers H5’s method for “generating and iteratively refining relevance rules used as complex search queries to find relevant documents. Based on direction from counsel and informed by review of example documents, relevance rules are populated with linguistic search terms and iteratively refined to increase accuracy.”

Holy smokes!  That’s what I do!  H5 has patented practical keyword search! Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Are They Trying to Screw Me?

09 Tuesday Oct 2012

Posted by craigball in E-Discovery

≈ 14 Comments

The title of this post is the question posed by a plaintiffs’ lawyer who called because he didn’t know what to make of a proposal from opposing counsel.  The lawyer explained that he’d attended a Rule 26(f) “Meet ‘n Confer” where he’d tried to manifest the right grunts and signs to convey that he wanted electronically-searchable production.   As neither of the lawyers conferring knew how they might achieve such a miracle, they shared a deer-in-headlights moment, followed by the usual “let me ask my client and get back to you” feint.  Some years back, I defined a Rule 26(f) conference as “Two lawyers who don’t trust each other negotiating matters neither understand.”  That definition seems to have withstood the test of time.

Before my high-handed cynicism turns you off completely, let me explain that I appreciate that many fine lawyers didn’t grow up with this “computer stuff.”  They earned their stripes with paper and, like me, leapt to law from the liberal arts.  They’re crazy busy with the constant demands of a trial practice, and ESI is just not a topic that excites their interest.  Some are still recovering from the last time they tried to pick up pointers from a tech-savvy person and nearly drowned in a sea of acronyms and geek speak.

I feel your pain.  I do.  Now, let’s ease that pain:

The other side proposed:

Documents will be produced as single page TIFF files with multi-page extracted text or OCR.  We will furnish delimited IPRO or Opticon load files and will later identify fielded information we plan to exchange. 

Are they trying to screw you?  Probably not.
Are you screwing yourself by accepting the proposed form of production?  Yes, probably.

Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Got TAR?

04 Tuesday Sep 2012

Posted by craigball in E-Discovery

≈ 13 Comments

If you talk frankly with those in the predictive coding business, it won’t be long until they lament, “Our beans are so magical, we just can’t fathom why more customers aren’t planting them.”  They insist that lawyers (or corporations or judges) don’t “get it.”  That is, those who hold the purse strings or call the shots don’t appreciate how much money can be saved, how much better the result can be or how much tedious review can be delegated to tireless technology tools.

It’s a common sentiment expressed by all in the business of selling technology assisted review; yet despite their shared frustration, I see no indication that they have laid down their arms and formed an industry association geared to jointly advancing shared goals and resolving common problems  The result has been widespread confusion about the technology and more heat than light when it comes to litigants having the confidence to not only use the emerging technologies but also to deploy them in ways that don’t trade one broken system for another.

It would be much easier to educate the bench and bar from a place of consensus; and cheaper, too.  As the small cadre of providers claw for their piece of a nascent market, they sow seeds of doubt.  The statistical precepts are identical.  The underlying technologies are substantially similar (although the particulars of the algorithms differ).  The tools have more in common than sellers care to admit.  Certainly, consumers think them much the same.

When the dairy industry wanted to float all boats, they asked, simply, “Got Milk?”  They didn’t ask “Got Milk from from Holstein-Friesian cattle milked in herringbone parlors and sterilized by plate heat exchangers?“

How is it a “Got Milk?” message that didn’t promote the interests of one supplier over another acquired a 90% awareness among U.S. consumers?  Could it be that members of milk boards put their common needs above their individual market share?

“But,” the sellers reply, “milk is a fungible good, and e-discovery services aren’t!”

Hmmm, Really?  Does it seem to you, dear reader, that consumers of e-discovery services seek highly-differentiated offerings, not commoditized services?  Are no suppliers being shut out by low bidders touting meat cleaver culling at rock-bottom per gigabyte pricing when technology-assisted approaches would be so much better?

It’s time to wake up and smell the TAR.  Predictive coding vendors (and others) need to band together, establish practical guidelines and reasonable standards, jointly promote education and research and see where a little shared effort can build a market big enough for all–not to fix prices or divvy up spoils, but to direct energy and creativity to secure a whole greater than the sum of its parts and to prevent quality from becoming the red-headed stepchild of EDD.

So, Bob, Craig, Arnaud, Quin, Herb, Steve, Ian, Jim, Amir, Warwick, Nicholas, and perhaps even you, too, Gordon, Maura, Bill and Karl.   Don’t wait for Sedona, EDRM, EDI or (heaven help us) one of the EDD lobbying groups to call the tune!  Form your own industry organization now.  Check your egos at the door, keep it simple, don’t fight over who will run it, have an organizational meeting, identify common interests, hire a part-time admin and write some modest checks.  The payback to you will be great, and the benefit to the justice system greater still.

And, no, there’s nothing in it for me.  I just think it’s a good idea.  Apologies to those whose names I omitted in my desire to avoid sounding like the start of a Mickey Mouse Club episode.

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...
← Older posts
Newer posts →
Follow Ball in your Court on WordPress.com

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,238 other subscribers

Recent Posts

  • Detecting Deep Fakes February 24, 2026
  • A Fun Way to Build AI Fluency February 21, 2026
  • Electronic Evidence Workbook 2026 February 18, 2026
  • The Most Important Thing I’ve Read This Year February 12, 2026
  • 2026 Guide to AI and LLMs in Trial Practice January 9, 2026

Archives

RSS Feed RSS - Posts

CRAIGBALL.COM

Helping lawyers master technology

Categories

EDD Blogroll

  • CS DISCO Blog
  • Basics of E-Discovery (Exterro)
  • The Relativity Blog
  • E-D Team (Ralph Losey)
  • Complex Discovery (Rob Robinson)
  • E-Discovery Law Alert (Gibbons)
  • Sedona Conference
  • Illuminating eDiscovery (Lighthouse)
  • eDiscovery Today (Doug Austin)
  • Minerva 26 (Kelly Twigger)
  • GLTC (Tom O'Connor)
  • eDiscovery Journal (Greg Buckles)
  • Corporate E-Discovery Blog (Zapproved )

Admin

  • Create account
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.com

Enter your email address to follow Ball in Your Court and receive notifications of new posts by email.

Website Powered by WordPress.com.

  • Subscribe Subscribed
    • Ball in your Court
    • Join 2,090 other subscribers
    • Already have a WordPress.com account? Log in now.
    • Ball in your Court
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar
 

Loading Comments...
 

    %d