Planning for digital forensic data collections is important before any work begins. ITAcceleration has, in the past, been engaged to perform searches on computer drives only to find our efforts (and the client’s dollars) wasted because the opposing counsel never agreed on the protocol, search terms or method of production.

Case Law: Inadequate Preservation and Search Terms

Environmental Complexity

Today, there are so many technical variables associated with data preservation and collection, it is absolutely necessary to engage the client’s technical liaison early on. Costs, findings, and outcomes of forensic preservation and electronic data collection all hinge on early discovery.

No longer can we assume that one’s hard drive is the sole repository for relevant information. The explosion of cloud and network services as well as portable computing devices has opened opportunities for data to be stored (and hidden!) in many different places.

Digital forensics requires access to private servers and data

There is also the small matter of gaining access to private and proprietary servers and applications. We have had times when we needed to re-engineer retired database programs so counsel could run searches independently on the data. In one such matter, we wrote queries against a Linux server’s database to provide financial spreadsheets to counsel review fraudulent charges. The bank who was on the defense side of this issue remarked that we had saved them a million dollars with this effort. This is just one example of one-off technologies that can be constructed to gain access to needed information and data.

Here’s an example of a case illustrating just how badly things can go wrong.

A Review of Improperly Preserved and Collected Search Terms

In the case “Procaps S.A. v. Patheon Inc., No. 12-24356-CIV, 2014 WL 800468 (S.D. Fla. Feb. 28, 2014); No. 12-24356-CIV, 2014 WL 1047748 (S.D. Fla. Mar. 18, 2014)”, the court issued an opinion that custodians must be consulted for input on search terms, as report by K&L Gates in this eDiscovery summary.

The court granted the defendant’s motion which required engaging a neutral 3rd party computer forensic examiner pursuant to a protocol drafted by the court and to be paid for by the plaintiff and their counsel.

“In the second opinion, the court addressed Defendant’s motion to compel Plaintiff to propose adequate search terms in furtherance of the forensic analysis discussed above. Broadly stated, Defendant was concerned that Plaintiff’s counsel had not consulted with his client’s ESI [electronically stored information] custodians when generating search terms and was further concerned by Counsel’s failure to communicate regarding that issue, including failing to respond to specific inquiries. Defendant initially became concerned when Plaintiff proposed only eight search terms, all in English, despite the fact that Plaintiff is headquartered in Colombia and that its employees speak Spanish. Those concerns were not allayed by Plaintiff’s counsels’ assurances that they would confer with their client as to an appropriate translation of any agreed-upon search terms.”

“…the court nonetheless granted the motion “and require[d] Procaps to have its counsel obtain search word input from all the ESI custodians.” The court also found that Defendant was entitled to attorney’s fees and specifically criticized Plaintiff’s counsel’s unwillingness to meaningfully communicate, resulting in the impression that Counsel had not, and would not, obtain client input on suggested search terms. This impression, in turn, “caused” Defendant to file its motion to compel. Ultimately, the court awarded $3750 in fees and required that Plaintiff’s lead attorney be personally responsible for payment of $1000, with the remainder to be paid by his firm.”

The full opinion can be read here.

Our Approach Is Consultative

Our digital forensic approach is consultative

When ITAcceleration is first contacted with a data collection request, we review with counsel the requirement and their understanding of the relevant data that needs to be forensically preserved and collected. Inevitably, there are more questions than counsel can provide answers to and we request access to a contact familiar with the client’s technical environment. In addition, we always ask for a copy of the complaint and any relevant legal briefs providing direction for electronically stored information.

Planning digital forensic data collections activities in advance lays a foundation for discovery and prevents unnecessary rework, expense and delays. With the evolving complexities of technology, the need to plan is more critical as each day passes. Remember the rule “measure twice, cut once” and ensure you have a clear, agreed-upon objective up front.

If you’re curious, you can read about our full ligitation support process here.

 

Share This