No Hard Drives Were Harmed in the Making of this Picture

Last week, one of my son’s friends lost a summer of work he’d done filming a documentary.  It was a crucial college project for which he’d solicited and received considerable financial support via Kickstarter.  He’d backed up months of footage garnered from extensive travel and interviews to an external hard drive.  Secure that he had a backup, he deleted the source data to gain more room on his Mac.  It wasn’t until the external hard drive failed that it dawned on him that a backup isn’t a backup if it’s your only copy.

My son’s friend was distraught and ready to run all manner of over-the-counter recovery programs in a desperate attempt to salvage his labors.  That would have been about the worst possible thing to do since running these tools against a mechanically compromised or logically corrupted drive often extinguishes any hope of data recovery.

By virtue of the superior genetic material and parenting skills of his mother, my son Madison is a very bright young man and had the presence of mind to intercede and tell his buddy to stop, do nothing and bring the drive to my lab to see what could be done.  My son also understood that data recovery is uncharacteristically economical when you know someone who will do it for free. Continue reading

Custodial Hold: Trust But Verify

Long before the Pension Committee opinion, my dear friend and revered colleague, Browning Marean, presciently observed that the ability to frame and implement a legal hold would prove an essential lawyer skill.  Browning understood, as many lawyers are only now coming to appreciate, that “legal hold” is more than just a communique.  It’s a multi pronged, organic process that must be tailored to the needs of the case like a fine suit of clothes.  For all the sensible emphasis on use of a repeatable process, the most successful and cost-effective legal holds demonstrate a bespoke character from the practiced hand of an awake, aware and able attorney.

Unfortunately, that deliberate, evolving character is one of the two things that people hate most about legal holds (the other being the cost).  They want legal hold to be a checklist, a form letter, a tool–all of which have value, but none of which suffice, individually or collectively, to forestall the need for a capable person who understands the ESI environment and is accountable for getting the legal hold right.  It’s a balancing act; one maximizing the retention of relevant, material, non-duplicative information while minimizing the cost, complexity and business disruption attendant to meeting one’s legal responsibilities.  Achieving balance means you can’t choose one or the other, you need both.

Both.

This post is about custodial hold.  It’s a very hot topic in e-discovery, and for some lawyers and companies, custodial hold is perilously synonymous with legal hold:

“How do you do a legal hold in your organization?”
“We tell our people not to delete relevant stuff.”

Continue reading

Do Black Swans Swim in the Mains of Monterrey?

This post isn’t about e-discovery or computer forensics.  Not at all.  But as it’s about the near-fatal, self-inflicted wound Knight Capital suffered from a software snafu early on 8/1/12, it will touch on the immense power of technology

Doesn’t the whole fiasco bear an uncanny similarity to the old Matthew Broderick movie, “War Games,” where the NORAD W.O.P.R. computer thinks its being tested in a bracing game of “Global Thermonuclear War” but is actually connected to live warheads poised to annihilate hundreds of millions?  Indications are that Knight Capital’s shiny new software was running test trades in the 24 hours after its installation, but no one at Knight Capital realized that W.O.P.R. was actually executing those trades on the New York Stock Exchange!  Forty-five minutes and $440 million in losses later, the Big Board interceded, perhaps sparing us all from another financial meltdown.

Someone in IT needs to start packing up his or her Star Trek bobbleheads. Continue reading

Train, Don’t Cull, Using Keywords

I’ve been thinking about how we implement technology-assisted review tools and particularly how to hang onto the on-again/off-again benefits of keyword search while steering clear of its ugliness.  The rusty flivver that is my brain got a kickstart from many insightful comments made at the recent CVEDR e-discovery retreat in Monterey, California.  As is often the case when the subject is technology-assisted review (by whatever name you prefer, dear reader: predictive coding, CAR, automated document classification, Francis), some of those kicks came from lawyer Maura Grossman and computer scientist Gordon Cormack.  So, if you like where I go with this post, credit them.  If not, blame me for misunderstanding.

Maura and Gordon are the power couple of predictive coding, thanks to their thoughtful papers and presentations transmogrifying the metrics of NIST TReC into coherent observations concerning the efficacy of automated document classification.  While they’re spinning straw into gold.  I’m still studying it all; but from where I stand, they make a lot of sense.

Maura expressed the view that technology-assisted review tools shouldn’t be run against subset collections culled by keywords but should be turned to the larger collection of ESI (i.e., the collection/sources against which keyword search might ordinarily have been deployed).  The gist was, ‘use the tools against as much information as possible, and don’t hamstring the effort by putting old tools out in front of new ones.’ [I’m not quoting here, but relating what I gleaned from the comment]. Continue reading

Can I get to their Facebook Page in Discovery? (and Ten Features I’d Like to See in a Social Media Discovery Tool)

I just edited a student law review article about discovery of social media content in which I despaired of the author’s failure to distinguish between the right to compel one’s opponent to make discovery from social media content versus the effort to directly access an opponent’s social media content.  To my mind, this is ground zero in the global conflict of social media discovery; and it’s a topic that evokes passionate–even combative–responses from people of all ages, particularly Gen-Xers and Millennials.   “Don’t f**k with my FaceBook” is their rallying cry.

I’m not too exercised about discovery of social media because I think the issues are simpler than we make them out to be.  When someone asks me, “Is social media discoverable?,” I answer, “Sure, in the same way potentially relevant, non-privileged and accessible ESI you store anywhere else is discoverable.”  It makes little difference whether a litigant stores potentially relevant, non-privileged information on a hard drive, server, thumb drive, floppy disk, Cloud VM or social media resource–or, for that matter, on a pressed, bleached and dried glob of pulverized pine tree.  The content of information is the principal determinant of its discoverability.  If relevant content is (a) not privileged, (b) reasonably accessible and (c) within a responding party’s care, custody or control, it’s discoverable.  There are exceptions,  but they don’t make Swiss cheese of the rule.

Sorry Marshall McLuhan, it’s not the medium, it’s the message.   Continue reading

1, 2, 3. Testing, Testing: Better Keyword Search for a Sou

I give about 50-70 educational presentations each year, so I do a fair number of sound checks.  “Testing. one, two, three.  Testing, testing.”  Scintillating stuff, and hopefully not the highlight of the show.

But “testing, testing” may indeed be the most important point I make, because “testing, testing” should be the mantra of all who use keyword search in e-discovery.  Few actions deliver as much bang for the buck as simple testing of search terms, or do more to forestall boneheaded mistakes.

The tip I share today is one that will cost you little and but could save your client or company a lot of time, money and grief.  It’s a capability lawyers can and should have at the ready, on their very own desktops. Continue reading

Free CLE Alert: Computer Forensics for Legal Professionals

There’s always so much great stuff to do in Washington D.C. in the summertime.  If I could be there next Friday evening, July 13, I might (as I did last month) take in the patriotic repertoire of the U.S. Army Band on the west steps of the Capitol or catch the comedic Capitol Steps at the Ronald Reagan Center.  Plus, there’s Cirque de Soleil at the Verizon Center.  But if I were in D.C. next Friday, the event I surely wouldn’t miss would be to hightail it over to the Hilton Washington at 1919 Connecticut Avenue NW from 6:15-7:15PM to hear the DOJ’s incomparable Ovie Carroll talk about Computer Forensics for Legal Professionals in the International Ballroom East. Continue reading

A Bit About Deduplication

The 4th of July is one of my very favorite holidays, second only to Thanksgiving.  We try to do patriotic things like construct kitschy neighborhood parade floats or, as we did at breakfast, stand and sing a rousing rendition of the national anthem, hoping that I can still hit the high notes (I did).  Last night, to get in the mood, I watched the 2008 BBC 6-part series Stephen Fry in America, which follows the wry English entertainer as he races about all fifty U.S. states in his trademark London cab.  In Boston, Fry discussed contradictions in the American character with the late Peter Gomes, a pastor and Harvard professor of divinity who Fry described as “a black, gay, Republican Baptist.”  Gomes observed that, “One of the many things one can say about this country is that we dislike complexity, so we will make simple solutions to everything that we possibly can, even when the complex answer is obviously the correct answer or the more intriguing answer.  We want a simple ‘yes’ or ‘no,’ or a flat out ‘this’ or an absolutely certain ‘that.’”

Gomes wasn’t talking about electronic discovery, but he could have been.

For a profession that revels in convoluted codes and mind-numbing minutiae, lawyers and judges are queerly alarmed at the complexity and numerousity of ESI.  They speak of ESI only in terms that underscore its burden, never extoling its benefits.  They demand simple solutions without looking beyond the (often misleading) big numbers to recognize that the volume they vilify is mostly just the same stuff, replicated over and over again.  It’s a sad truth that much of the time and money expended on e-discovery in the U.S. is wasted on lawyers reviewing duplicates of information that could have been easily, safely and cheaply culled from the collection.  Sadder still, the persons best situated to eradicate this waste are the ones most enriched by it.   Once, I might have said “innocently enriched by it,” but no more.

The oft-overlooked end of discovery is proving a claim or defense in court. So, the great advantage of ESI is its richness and revealing character.  It’s better evidence in the sense of its more-candid content and the multitude of ways it sheds light on attitudes and actions.  Another advantage of ESI is the ease with which it can be disseminated, collected, searched and deduplicated.  This post is about deduplication, and why it might be attorney malpractice not to understand it well and use it routinely. Continue reading

CEIC 2012: From an iPad Aloft

20120520-215126.jpgI’m writing this post from 36,000 feet on my way to Las Vegas for the annual CEIC (Computer Enterprise and Investigations Conference) that begins tomorrow at the Red Rock Resort in Summerlin, NV, ten miles off the Strip. Between my personal Scylla and Charybdis of e-discovery and digital forensics, I attend a ridiculous number of forensic technology conferences each year (merely ridiculous, as I cede “insane” to the Grand Dukes of EDD, the always avuncular Browning Marean and ever erudite Chris Dale). Some, like CEIC and New York LegalTech are big, bustling events in splendid venues that feel more like family reunions than trade shows. Others, like my trek to this Friday’s Appalachian Institute for Digital Evidence in Huntington, West Virginia, are intimate gatherings sized to local law enforcement and student budgets. Big event or small, I’m grateful to be invited to play my part in the educational components of them all.

But I confess that CEIC is one conference that I look forward to more than most. Sure, I love its alternate annual situs in Las Vegas and Orlando; but, the real draw to CEIC is the quality and breadth of its educational offerings and the collegiality of the mixed group of attendees: cops, techies, warriors, lawyers, judges and three-letter agency types (and a few booth babes–it’s Vegas after all). Continue reading

A Bill of Rights for E-Discovery

Sometimes you write something that strikes a chord and the hits go off the charts.  That’s a good day.  Other times, you pen something you’re proud of and the silence is deafening.  Two years ago, I wrote a column putting forward a Bill of Rights for E-Discovery that set out expectations and obligations of requesting parties.  As we used to say back in New York, “ya coulda hoid a pin drop.”  Since it fell flat before, you may wonder why I’d trot it out again.  Truth is, I still think it’s the germ of something worthwhile.  Perhaps I missed the mark, but someone needs to hit it; and I keep hoping it might be something like this: Continue reading