• Home
  • About
  • CRAIGBALL.COM
  • Disclaimer
  • Log In

Ball in your Court

~ Musings on e-discovery & forensics.

Ball in your Court

Category Archives: Uncategorized

Degradation: How TIFF+ Disrupts Search

15 Wednesday Jan 2020

Posted by craigball in Computer Forensics, E-Discovery, Uncategorized

≈ 7 Comments

broken searchRecently, I wrote on the monstrous cost of TIFF+ productions compared to the same data produced as native files.  I’ve wasted years trying to expose the loss of utility and completeness caused by converting evidence to static formats.  I should have recognized that no one cares about quality in e-discovery; they only care about cost.  But I cannot let go of quality because one thing the Federal Rules make clear is that producing parties are not permitted to employ forms of production that significantly impair the searchability of electronically stored information (ESI).

In the “ordinary course of business,” none but litigators “ordinarily maintain” TIFF images as substitutes for native evidence   When requesting parties seek production in native forms, responding parties counter with costly static image formats by claiming they are “reasonably usable” alternatives.  However, the drafters of the 2006 Rules amendments were explicit in their prohibition:

[T]he option to produce in a reasonably usable form does not mean that a responding party is free to convert electronically stored information from the form in which it is ordinarily maintained to a different form that makes it more difficult or burdensome for the requesting party to use the information efficiently in the litigation. If the responding party ordinarily maintains the information it is producing in a way that makes it searchable by electronic means, the information should not be produced in a form that removes or significantly degrades this feature.

 FRCP Rule 34, Committee Notes on Rules – 2006 Amendment.

I contend that substituting a form that costs many times more to load and host counts as making the production more difficult and burdensome to use.  But what is little realized or acknowledged is the havoc that so-called TIFF+ productions wreck on searchability, too.  It boggles the mind, but when I share what I’m about to relate below to opposing counsel, they immediately retort, “that’s not true.”  They deny the reality without checking its truth, without caring whether what they assert has a basis in fact.  And I’m talking about lawyers claiming deep expertise in e-discovery.  It’s disheartening, to say the least.

A little background: We all know that ESI is inherently electronically searchable.  There are quibbles to that statement but please take it at face value for now.  When parties convert evidence in native forms to static image forms like TIFF, the process strips away all electronic searchability.  A monochrome screenshot replaces the source evidence.  Since the Rules say you can’t remove or significantly degrade searchability, the responding party must act to restore a measure of searchability.  They do this by extracting text from the native ESI and delivering it in a “load file” accompanying the page images.  This is part of the “plus” when people speak of TIFF+ productions.

E-discovery vendors then seek to pair the page images with the extracted text in a manner that allows some text searchability.  Vendors index the extracted text to speed search, a mapping process intended to display the page where the text was located when mapped.  This is important because where the text appears in the load file dictates what page will be displayed when the text is searched and determines whether features like proximity search and even predictive coding work as well as we have a right to expect.  Upshot: The location and juxtaposition of extracted text in the load file matters significantly in terms of accurate searchability.  If you don’t accept that, you can stop reading.

Now, let’s consider the structure of modern electronic evidence.  We could talk about formulae in spreadsheets or speaker notes in presentations, but those are not what we fight over when it comes to forms of production. Instead,  I want to focus on Microsoft Word documents and those components of Word documents called Comments and Tracked Changes; particularly Comments because these aren’t “metadata” by any stretch.  Comments are user-contributed content, typically communications between collaborators.  Users see this content on demand and it’s highly contextual and positional because it is nearly always a comment on adjacent body text.  It’s NOT the body text, and it’s not much use when it’s separated from the body text.  Accordingly, Word displays comments as marginalia, giving it the power of place but not enmeshing it with the body text.

But what happens to these contextual comments when you extract the text of a Word document to a load file and then index the load files?

There are three ways I’ve seen vendors handle comments and all three significantly degrade searchability:

First, they suppress comments altogether and do not capture the text in the load files.  This is content deletion.  It’s like the content was never there and you can’t find the text using any method of electronic search.  Responding parties don’t disclose this deletion nor is it grounded on any claim of privilege or right.  Spoliation is just S.O.P.

Second, they merge the comments into the adjacent body text. This has the advantage of putting the text more-or-less on the same page where it appears in the source, but it also serves to frustrate proximity search and analytics.  The injection of the comment text between a word combination or phrase causes searches for that word combo or phrase to fail.  For example, if your search was for ignition w/3 switch and a four-word comment comes between “ignition” and “switch,” the search fails.

Third, and frequently, vendors aggregate comments and dump them at the end of the load file with no clue as to the page or text they reference.  No links.  No pointers.  Every search hitting on comment text takes you to the wrong page, devoid of context.

Some of what I describe are challenges inherent to dealing with three-dimensional data using two-dimensional tools.  Native applications deal with Comments, speaker notes and formulae three-dimensionally.  We can reveal that data as needed, and it appears in exactly the way witnesses use it outside of litigation.  But flattening native forms to static images and load files destroys that multidimensional capability.   Vendors do what they can to add back functionality; but we should not pretend the results are anything more than a pale shadow of what’s possible when native forms are produced.  I’d call it a tradeoff, but that implies requesting parties know what’s being denied them.  How can requesting party’s counsel know what’s happening when responding parties’ counsel haven’t a clue what their tools do, yet misrepresent the result?

But now you know.  Check it out.  Look at the extracted text files produced to accompany documents with comments and tracked changes.  Ask questions.  Push back.  And if you’re producing party’s counsel, fess up to the evidence vandalism you do.  Defend it if you must but stop denying it.  You’re better than that.

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Preserving Social Media Content: DIY

24 Tuesday Dec 2019

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 3 Comments

Social Media Content (SMC) is a rich source of evidence.  Photos and posts shed light on claims of disability and damages, establish malicious intent and support challenges to parental fitness–to say nothing of criminals who post selfies at crime scenes or holding stolen goods, drugs and weapons.  SMC may expose propensity to violence, hate speech, racial animus, misogyny or mental instability (even at the highest levels of government).  SMC is increasingly a medium for business messaging and the primary channel for cross-border communications.  In short, SMC and messaging are heirs-apparent to e-mail in their importance to e-discovery.

Competence demands swift identification and preservation of SMC.

Screen shots of SMC are notoriously unreliable, tedious to collect and inherently unsearchable.  Applications like X1 Social Discovery and service providers like Hanzo can help with SMC preservation; but frequently the task demands little technical savvy and no specialized tools.  Major SMC sites offer straightforward ways users can access and download their content.  Armed with a client’s login credentials, lawyers, too, can undertake the ministerial task of preserving SMC without greater risk of becoming a witness than if they’d photocopied paper records.

Collecting your Client’s SMC
Collecting SMC is a two-step process of requesting the data followed by downloading.  Minutes to hours or longer may elapse between a request and download availability. Having your client handle collection weakens the chain of custody; so, instruct the client to forward download links to you or your designee for collection.  Better yet, do it all yourself.

Obtain your client’s user ID and password for each account and written consent to collect. Instruct your client to change account passwords for your use, re-enabling customary passwords following collection.  Clients may need to temporarily disable two-factor account security.  Download data promptly as downloads are available briefly.

Collection Steps for Seven Social Media Sites
Facebook: After login, go to Settings>Your Facebook Information>Download Your Information.  Select the data and date ranges to collect (e.g., Posts, Messages, Photos, Comments, Friends, etc.).  Facebook will e-mail the account holder when the data is ready for download (from the Available Copies tab on the user’s Download Your Information page). Facebook also offers an Access Your Information link for review before download. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Privacy: A Wolf in Sheep’s Clothing?

12 Tuesday Nov 2019

Posted by craigball in Computer Forensics, E-Discovery, Uncategorized

≈ 3 Comments

Next week is Georgetown Law Center’s sixteenth annual Advanced E-Discovery Institute.  Sixteen years of a keen focus on e-discovery; what an impressive, improbable achievement!  Admittedly, I’m biased by longtime membership on its advisory board and my sometime membership on its planning committees, but I regard the GTAEDI confab of practitioners and judges as the best e-discovery conference still standing.  So, it troubles me how much of the e-discovery content of the Institute and other conferences is ceded to other topics, and one topic in particular, privacy, is being pushed to be the focus of the Institute in future.

This is not a post about the Georgetown Institute, but about privacy, particularly whether our privacy fears are stoked and manipulated by companies and counsel as an opportunistic means to beat back discovery.  I ask you: Is privacy a stalking horse for a corporate anti-discovery agenda? Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

A Primer on Processing and a Milestone

04 Monday Nov 2019

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 9 Comments

Processing 2019Today, I published my primer on processing.  It’s fifty-odd pages on a topic that’s warranted barely a handful of paragraphs anywhere else.  I wrote it for the upcoming Georgetown Law Center Advanced E-Discovery Institute and most of the material is brand new, covering a stage of e-discovery–a “black box” stage–where a lot can go quietly wrong.  Processing is something hardly anyone thinks about until it blows up.

Laying the foundation for a deep dive on processing required I include a crash course on the fundamentals of digitization and encoding.  My students at the University of Texas and at the Georgetown Academy have had to study encoding for years because I see it as the best base on which to build competency on the technical side of e-discovery.

The research for the paper confirmed what I’d long suspected about our industry.  Despite winsome wrappers, all the leading e-discovery tools are built on a handful of open source and commercial codebases, particularly for the crucial tasks of file identification and text extraction.  Nothing evil in that, but it does make you think about cybersecurity and pricing.  In the process of delving deeply into processing, I gained  greater respect for the software architects, developers and coders who make it all work.  It’s complicated, and there are countless ways to run off the rails.  That the tools work as well as they do is an improbable achievement.  Stilli, there are ingrained perils you need to know, and tradeoffs to be weighed.

Working from so little prior source material, I had to figure a lot out by guess and by gosh.  I have no doubt I’ve misunderstood points and could have explained topics more clearly.  Please don’t hesitate to weigh in to challenge or correct.  Regular readers know I love to hear your thoughts and critiques.

I’ll be talking about processing in an ACEDS/Logikcull webcast tomorrow (Tuesday, November 5, 2019) at 1:00pm EST/10:00am PST.  I expect it’s not to late to register.

The milestone of the title is that this is my 200th blog post and it neatly coincides with my 200,000 unique visitor to the blog (actually 200,258, but who’s counting?).  When I started blogging here on August 20, 2011, I honestly didn’t know if anyone would stop by.  Two hundred thousand kind readers have rung the bell (and that’s excluding the many more spammers turned away).  I hope something I wrote along the way gave you some insight or a chuckle.  I’m intensely grateful for your attention.

By the way, if you’d like to come to the Georgetown Advanced E-Discovery Institute in Washington, D.C. on November 21-22, 2019, please use my speaker’s discount code to save $100.00.  The discount code is BALL (all caps).  Hope to see you!

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Apple Card: Heavy Metal

03 Thursday Oct 2019

Posted by craigball in General Technology Posts, Personal, Uncategorized

≈ 3 Comments

IMG_4773I just got my Apple Card and, while I hardly need another credit card, I thought readers might be curious what the fuss is about. After all, it’s just a credit card, right?

Right, but it has some fancy features that set it apart from the other plastic in your wallet or purse.  First, it’s scarily easy to obtain.  On my iPhone, it took under a minute to be issued the electronic card with a $9,000 spending limit available in Wallet.  That was Tuesday.  Thursday morning, a courier dropped off the physical card packaged in the sleek style of all Apple’s premium products.  The fun began even before it was out of the box!

IMG_4777Although my Apple Pay credit account went live in a minute, as with all physical credit cards, the Apple Card must be activated before use.  For most cards, this requires time online or a phone call where you dial or speak a lot of digits.  With the Apple Card, you just hold the colorful sleeve it comes in against your iPhone and the NFC contactless communication capability embedded in the card does the rest.  

The next surprise is that the card is crafted from laser-etched titanium, giving it a striking heft and rigidity.  Hone the edge of this baby and you’re MacGyver (or Oddjob, hat in hand).  Investing so much in the aesthetics of a credit card may seem silly; but, I confess that the, well, the beauty of the card impressed me.  Is it so wrong that something we touch several times daily be pleasing?

The next surprise is what’s not on the Apple Card versus every other card: There are no numbers.  No card number.  No CID security identifier.  No expiration date.  No signature block.  Just your name, three corporate logos, a chip and a swipe strip.  Here are photos of both sides of my Apple Card, something I’d never post for a conventional card:

IMG_4771
IMG_4772

IMG_4774If you want to know the card number and CID for the Apple Card, you must retrieve them in Wallet.  That’s a genuine layer of security.  By the same token, heaven help anyone who comes across a neanderthal with a carbon charge slip (anyone remember those?) who tries to rub transfer the card number.

There are some nifty usage management features, but the major marketing hook for the Apple Card is daily cash back on purchases.  How much cash back?  I’m not entirely sure because it varies.  It seems you get three percent back for purchases made from Apple and a handful of other merchants like Walgreens and Uber.  But for the most part, the cash back percentage looks to be two percent if you pay with Apple Pay.  If a merchant isn’t set up for Apple Pay, then it appears you must use the Apple Card as a conventional MasterCard, and get just one percent cash back.  That’s about the same benefit I now get with my AmEx Membership Rewards program with (in my mind) less exposure to a whopping interest charge if I’m ever late with a payment.  Too, the AmEx offers many perks to protect my purchases and travel.  Now and then, those behind-the-scenes benefits have proven really worthwhile.   I wonder whether Apple will stand behinds its card users as reliably as AmEx?

Cash back is a splendid benefit, and beats the pants off cards that don’t offer rewards and perks.  So many cards do offer mileage benefits, club access and other rewards that it’s not easy to know which one is best.  The Apple Card carries no annual fee, making it worth a try, and if you buy a lot of Apple merchandise, that instant three percent back is a no-brainer.  Maybe the Apple Card will become my principal card; maybe not.  But, I’ll tell you one thing:  that titanium card is going to be hell to cut in half should I decide to close the account.

One last thing if it’s not already clear: Only iPhone users need apply.  An Android user might be able to finagle getting the Apple Card, but the real benefits only flow from using Apple Pay.

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

ILTACON 2019 at the Happiest Place on Earth

23 Friday Aug 2019

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 2 Comments

I’ve spoken at nearly all the legal technology conferences that have come and gone over the last thirty years.  Some, like LegalWorks and LegalTech West, are extinct (suggesting there is no appetite for legal technology west of Las Vegas).  Others, like ABA TechShow and LegalTech New York soldier on, shadows of what they once were, annually rearranging well-worn deck chairs.  They’re still frantic and fun to attend but TechShow has devolved to a mostly regional attendance and LegalTech’s influence has waned such that the most interesting meetings occur outside the Hilton.  Lately, the dynamic and influential meetups are those dedicated to a single product and its ecosystem (think Relativity Fest or ClioCon).  A stalwart exception, and an event I always try to cover, is ILTACON, the annual confab of the International Legal Technology Association. ILTACON remains vibrant and relevant, having found its compass after several rocky years of internal squabbling.

I just returned from Orlando and five days of impressive ILTACON content at the Swan and Dolphin hotels near EPCOT.  I talked about discovery tools and whether they’ve kept pace with the sea changes in electronic evidence.  My take: lawyers are behind the curve and tool vendors aren’t doing nearly enough to bridge the gap.

I’m a passionate student of architecture, with no particular skills, but boundless enthusiasm.  Thus, it was pleasing to experience the Swan and Dolphin Hotels, icons of post-modernism and two of the late architect Michael Graves’ most successful efforts.  Postmodernism was to last-century architecture what the leisure suit was to 1970’s fashion.  PoMo is no mo’, and none need mourn its passing.  Audacious in 1990, the Swan and Dolphin remain a good fit for the fever dream of Walt Disney World.  Outside of Orlando and Las Vegas, the absurd scale, palette and garish embellishment would have long lost its luster; yet in the House of the Mouse (and dead-flat Orlando), they still work.  Aesthetically, that is, not functionally.  The interiors are awful and the sprawl exhausting.  Home to ILTACON’s evening events, the dark, charmless Pacific Ballroom, should be renamed the Hangar of Terror (photo below.  Note the free throw competition hoop and backboard with tables beyond. What could POSSIBLY go wrong?).

 

Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Meet Bob Woodward, Living Legend

14 Monday Jan 2019

Posted by craigball in E-Discovery, Personal, Uncategorized

≈ 5 Comments

Bob WoodwardIt’s almost that time, two weeks from LegalTech New York (okay, LegalWeek for those who hang on for more wintry weather) and the fine folks at Zapproved have again asked me to interview a gifted interviewer–on Broadway, no less–for the annual Corporate E-Discovery Heroes Awards.  I’ve had past fireside chats with Nina Totenberg, Doris Kearns Goodwin and Eugene Robinson.  My subject this year is Bob Woodward.

OMG BOB WOODWARD!

I’ll use the same two words Woodward himself uttered on June 17, 1972 as a cub reporter for the Washington Post covering an arraignment of five well-dressed Watergate burglars.  On hearing perpetrator James McCord whisper “CIA” when asked his employer, Woodward exclaimed:

HOLY SHIT!

I mean, BOB WOODWARD!  Author of nineteen  books, thirteen #1 national bestsellers.  The dean of investigative journalism.  The 2019 PEN America Literary Service Award winner (per this morning’s New York Times).  The man who helped earn two Pulitzer Prizes for the Post.  The man who brought down a President.  Robert Redford played him in All the President’s Men.  Not pruney 2019 Redford, either.  We’re talking 1976 sex symbol Robert Redford!

So, yeah, HOLY SHIT!  BOB WOODWARD!

I better get this right. Will you help me?  In the comments below, I invite you to suggest questions I might pose to the living legend onstage.  Don’t worry.  Woodward wrote “Fear.”  We will talk Trump.

It’s a very special night in another way.  My dear, dear friend, the Honorable John Michael (yada, yada, yada) Facciola, will receive the 2019 Hon. Shira Scheindlin Lifetime Achievement Award in recognition of a career that has advanced the practice of electronic discovery.  The “yada, yada, yada” denotes that Fatch has more middle names than a British nobleman.  Fitting, as John Facciola is truly a noble man and richly deserving of this award.  I’m excited about who the presenters will be; but, I’m not spoiling that surprise.  You’ll just have to attend.

Honored as well will be four “Corporate E-Discovery Heroes,” nominated by their peers and selected by an esteemed panel of judges.  What? FINE! Esteemed and me.  Who won?  Like I said, you’ll just have to attend.  Please do.

Though seating is limited, tickets are still available, and dinner and drinks are included.  It’s going to be a hell of a party!  Don’t miss it.

Where: Edison Ballroom, 240 W 47th St, New York, NY 10036
When: January 28, 2019 at 6:00pm
Register by: January 25, 2019 11:59 PM Eastern Time

Bring your copy of Fear, All the President’s Men, The Final Days, The Brethren, Wired or one of the others.  No promises, but I bet you can get it signed by the man who inspired a generation of journalists.

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Loving Location Histories

01 Saturday Dec 2018

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 5 Comments

I give dozens of talks each years on electronic evidence where I discuss geolocation data and its transformative potential as evidence in criminal prosecutions and civil litigation.  Smart phones constantly track our movements using gyroscopes, accelerometers, global positioning features, geolocation apps, cell tower triangulation and three independent radio systems. Our steps are tallied, altitudes logged, and, for many, vital signs are monitored, too.  We are earthbound astronauts, instrumented and coupled to sensors and telemetry as thoroughly as any who journey into space.

This doesn’t fully resonate with audiences until I guide them through their own phones, showing the level of detail with which movements are tracked.  Some listeners boast that they’ve set their privacy settings to block geolocation.  They’re the ones most surprised to learn that, although they can disable their ability to see their own geolocation history and stop geolocation data from being shared with apps, they can’t disable geolocation broadcasting and still have a functioning phone.  Here’s the bottom line: if a phone can operate as a phone, it must broadcast its geolocation coordinates with a precision of ten meters (~30 feet) or better.  U.S. law requires it.

When I broach geolocation data and see that look of “we already know this” creep across faces, that’s when I ask for a show of hands of how many in the audience use iPhones.  Nearly every hand shoots up.  I then invite them to drill down in their phone’s Settings with me to the Significant Locations logs.  Surprisingly, most have never done this before and are shocked, even frightened, by the richness of detail in the data.

To try it on your iPhone,navigate through Settings>Privacy>Location Service>System Services> Significant Locations.  Unless you’ve disabled your ability to see geolocation data, you’ll arrive at the phone’s History list setting out locales visited, and the number of sites gone to within those locales.

But, wait!  There’s more! Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Cloud Takeouts: Can I Get That to Go?

07 Wednesday Nov 2018

Posted by craigball in Computer Forensics, E-Discovery, General Technology Posts, Uncategorized

≈ 7 Comments

Apple take outTwo-and-a-half years ago, I concluded a post with this bluster:

“Listen, Amazon, Apple, Microsoft and all the other companies collecting vast volumes of our data through intelligent agents, apps and social networking sites, you must afford us a ready means to see and repatriate our data.  It’s not enough to let us grab snatches via an unwieldy item-by-item interface.  We have legal duties to meet, and if you wish to be partners in our digital lives, you must afford us reasonable means by which we can comply with the law when we anticipate litigation or respond to discovery. You owe us that.  Alexa, are you listening?”

Amazon hasn’t listened; but, Apple lately gave users the ability to download our data.  Credit for this awakening goes to the European Union’s Global Data Protection Regulation (GDPR) that went into effect on May 25.

Data takeout capabilities are essential to protecting civil liberties and meeting legal duties.  Google’s given users a simple, effective means to repatriate data (including Gmail and calendar data) for five years, although search histories have only been supplied for two.  Twitter’s supported robust data takeout for five years; and eight years ago, Facebook became the first big social media site to offer its users the ability to download contributed content.

Apple is late to the party but it didn’t come empty-handed.  The Apple takeout is extensive and can be huge.  My download comprised 63GB in 26 compressed Zip archive files.  It took Apple five days to assemble the data and make it available for download; then, I had to download each file, one-by-one.  There’s no way to download them all, leaving the distinct impression that Apple doesn’t want takeout to be too easy.  In fairness, had I opted to have Apple deliver my data in 25GB chunks (the largest chunk option) instead of the 5GB file limit I specified, it would have been easier.

In my case, almost all the volume were photos replicated in iCloud.  Notably absent was my messaging, which Apple can’t archive and thus can only be obtained from the iPhone or a backup of same (see my post Mobile to the Mainstream). Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Mad About Metadata

02 Friday Nov 2018

Posted by craigball in Computer Forensics, E-Discovery, Uncategorized

≈ 2 Comments

mad about metadataIt’s the month for giving thanks, and I’m ever-grateful for the daily e-discovery blog penned by my friend, Doug Austin, for CloudNine.  It’s tough to get out a post every business day, and Doug’s done it splendidly for, what, nine years now?  Kudos!  Doug’s EDiscovery Daily blog is often my first heads-up for new e-discovery cases, true again for the decision he featured this morning,  Metlife Inv’rs. USA Ins. Co. v. Lindsey, No. 2:16-CV-97 (N.D. Ind. Oct. 25, 2018)

It’s a familiar scenario.  The requesting party expressly demands native file production.  The responding party, a big insurance company, produces static image formats as non-searchable PDFs.  When the requesting party objects, the carrier argues that the metadata it strips from the evidence isn’t relevant and that the request for native forms is disproportionate, again challenging relevance, and also claiming that producing in the native forms sought would be cumulative because (chutzpah!) they’d already produced in PDF over their opponent’s timely objection.

To its credit, the Court makes short work of MetLife’s high-handedness and orders native production but stumbles a bit on the relevance and scope issues.  The Court addresses the relevance objection by noting that native production may shed light on who accessed information and that this may inform whether the insurer had a duty to investigate the policy application.  Maybe.  More likely, it won’t.  But, the Court shouldn’t have let itself be drawn in by a specious relevance challenge.

There are two varieties of file metadata: application metadata and system metadata.  Relevance should never matter for application metadata or dog tag system metadata.  If a file is sufficiently relevant to be responsive, no requesting party should be required to further demonstrate that metadata within the file is independently relevant.  The burden to prove a right to excise parts of relevant files should rest with the party altering the evidence.  Moreover, a file’s name, path and last modified date (“dog tag” metadata) are so patently useful that their utility more than relevance should serve as  sufficient basis for the production of essential system metadata. Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...
← Older posts
Newer posts →
Follow Ball in your Court on WordPress.com

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,232 other subscribers

Recent Posts

  • The EDRM Isn’t Broken; It’s Misunderstood. March 18, 2026
  • Detecting Deep Fakes February 24, 2026
  • A Fun Way to Build AI Fluency February 21, 2026
  • Electronic Evidence Workbook 2026 February 18, 2026
  • The Most Important Thing I’ve Read This Year February 12, 2026

Archives

RSS Feed RSS - Posts

CRAIGBALL.COM

Helping lawyers master technology

Categories

EDD Blogroll

  • Sedona Conference
  • Basics of E-Discovery (Exterro)
  • CS DISCO Blog
  • E-Discovery Law Alert (Gibbons)
  • The Relativity Blog
  • eDiscovery Journal (Greg Buckles)
  • Illuminating eDiscovery (Lighthouse)
  • E-D Team (Ralph Losey)
  • GLTC (Tom O'Connor)
  • eDiscovery Today (Doug Austin)
  • Minerva 26 (Kelly Twigger)
  • Complex Discovery (Rob Robinson)
  • Corporate E-Discovery Blog (Zapproved )

Admin

  • Create account
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.com

Enter your email address to follow Ball in Your Court and receive notifications of new posts by email.

Website Powered by WordPress.com.

  • Subscribe Subscribed
    • Ball in your Court
    • Join 2,084 other subscribers
    • Already have a WordPress.com account? Log in now.
    • Ball in your Court
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar
 

Loading Comments...
 

    %d