visual evidence / e-discovery llc visual evidence / e-discovery llc 60th annual meeting of the ohio...

Visual Evidence / E-Discovery LLCVisual Evidence / E-Discovery LLC

60th Annual Meeting of the Ohio Regional 60th Annual Meeting of the Ohio Regional Association of Law LibrariesAssociation of Law Libraries

E-Discovery & Trial Demonstrative E-Discovery & Trial Demonstrative PresentationPresentation

Presented by John WinklerPresented by John WinklerVisual Evidence / E-Discovery LLCVisual Evidence / E-Discovery LLC

1382 West Ninth Street, Cleveland, OH 441131382 West Ninth Street, Cleveland, OH 44113Direct: 216.407.3939 – Headquarters: 216.241.3443Direct: 216.407.3939 – Headquarters: 216.241.3443

[email protected]@vevidence.com – www.vevidence.com – www.vevidence.com

What is Electronic Discovery?What is Electronic Discovery?

Electronic DiscoveryElectronic Discovery: Identifying, preserving, : Identifying, preserving, collecting and producing Electronically Stored collecting and producing Electronically Stored Information (ESI) in response to a discovery Information (ESI) in response to a discovery request or “reasonable anticipation of request or “reasonable anticipation of litigation.litigation.

May also be conducted in response to or in May also be conducted in response to or in furtherance of an investigation furtherance of an investigation (external/internal), compliance requirement or (external/internal), compliance requirement or subpoena request.subpoena request.

Sample Case to Think AboutSample Case to Think About

Case ScenarioCase Scenario:: Employee Jane Jones is a regional manager for ABC Employee Jane Jones is a regional manager for ABC

Medical. Jane leaves ABC Medical for employment Medical. Jane leaves ABC Medical for employment with new competitor XYZ Medical. with new competitor XYZ Medical.

Alleged: Jane Jones has violated her non-compete Alleged: Jane Jones has violated her non-compete and also has taken ABC Medical corporate and also has taken ABC Medical corporate documents to XYZ Medical.documents to XYZ Medical.

These documents were taken, forwarded by e-mail These documents were taken, forwarded by e-mail and removed on a USB driveand removed on a USB drive

Sample CaseSample Case

Documents include client contacts, proposal worksheets, Documents include client contacts, proposal worksheets, contracts and company financials. XYZ has recently won contracts and company financials. XYZ has recently won several contracts with prior ABC Medical clients since several contracts with prior ABC Medical clients since Jane joined them.Jane joined them.

Another Sample CaseAnother Sample Case

John Smith sues former employer, 123 Corp. for John Smith sues former employer, 123 Corp. for wrongful termination / Age Discriminationwrongful termination / Age Discrimination

123 Corp denies discrimination123 Corp denies discrimination Mr. Smith has copy of damaging e-mailMr. Smith has copy of damaging e-mail

Preliminary Steps for Arriving at a Preliminary Steps for Arriving at a Cost- Effective Solution: “IDEA”Cost- Effective Solution: “IDEA”

1.1. IIdentify where is the ESI stored/sourcesdentify where is the ESI stored/sources

2. 2. DDetermine how much data/ESI is to be collectedetermine how much data/ESI is to be collected

3.3. E Establish best methods for collectionstablish best methods for collection

4.4. A Analyze resources/methods for review and/or nalyze resources/methods for review and/or productionproduction

Step 1: Step 1: Identifying Sources of ESI:Identifying Sources of ESI:

Laptop/desktop computer Laptop/desktop computer Professional/personalProfessional/personal

Company or home network servers Company or home network servers Data, email, application, archive, voice mail and Data, email, application, archive, voice mail and

message systemsmessage systems External storageExternal storage

Backup tapes, Redundant off-site systemBackup tapes, Redundant off-site system External storage devices External storage devices

External hard drives, Floppy drives, CD’s, DVD’s, External hard drives, Floppy drives, CD’s, DVD’s, USB flash driveUSB flash drive

Portable devicesPortable devices PDA, Cell phone, Blackberry, Voice recorders, Game PDA, Cell phone, Blackberry, Voice recorders, Game

systems (Play Stations, Xbox, etc.)systems (Play Stations, Xbox, etc.)

Step 2: Step 2: Defining the Amount ESI to be Collected:Defining the Amount ESI to be Collected:

Typical PC 80-120 GBTypical PC 80-120 GB 1 GB = 35,000 typed pages 1 GB = 35,000 typed pages Usually 25% is captured after de-duplication & system Usually 25% is captured after de-duplication & system

file removal (20GB x 35,000=700,000 pages)file removal (20GB x 35,000=700,000 pages) Typical Company Server 300 GB to 1 TerabyteTypical Company Server 300 GB to 1 Terabyte

10,500,000- 500,500,000 typed pages10,500,000- 500,500,000 typed pages Usually higher percentage of retrieved filesUsually higher percentage of retrieved files

CD Rom (650 megabytes) = 325,000 typed pagesCD Rom (650 megabytes) = 325,000 typed pages Large corporation backup tapes (1 terabyte)Large corporation backup tapes (1 terabyte) In 2006, 135 billion email sent dailyIn 2006, 135 billion email sent daily

Company with 100 employees send/receive 50 e-mail Company with 100 employees send/receive 50 e-mail daily (understated) =over 1.2 million per year. daily (understated) =over 1.2 million per year.

Large Company e-mail = 300 million monthlyLarge Company e-mail = 300 million monthly

Step 3: Step 3: Determining Methods to Harvest ESIDetermining Methods to Harvest ESI

Custodian ControlCustodian Control Low cost, high risk spoliation and lost data, business Low cost, high risk spoliation and lost data, business

interruption, potential sanctionsinterruption, potential sanctions Copying of hard drives/files/network PathsCopying of hard drives/files/network Paths

Low cost, lost or disturbed metadata, no deleted data, Low cost, lost or disturbed metadata, no deleted data, minimal business interruption, potential sanctionsminimal business interruption, potential sanctions

Forensic imaging of hard drives/serversForensic imaging of hard drives/servers Minimal cost, litigation defensible, active/deleted data, Minimal cost, litigation defensible, active/deleted data,

business interruptionbusiness interruption Network HarvestingNetwork Harvesting

Low cost, no business interruption, large data collection, Low cost, no business interruption, large data collection, litigation defensible, active data litigation defensible, active data

Back-up Tape RestorationBack-up Tape Restoration High CostHigh Cost

Step 4: Step 4: Determining Methods to Review ESI:Determining Methods to Review ESI:

PaperPaper Costly, no metadata, time consuming review, limited by Costly, no metadata, time consuming review, limited by

data amountdata amount TIFF/PDF TIFF/PDF

Costly, no metadata, limited search ability, tedious review, Costly, no metadata, limited search ability, tedious review, limited by data amountlimited by data amount

Summation/Concordance load files Summation/Concordance load files Metadata, searchable, can code, review limited to seat Metadata, searchable, can code, review limited to seat

license and terminal, limited by data amount license and terminal, limited by data amount DVD/CDDVD/CD

Metadata, review limited to terminal and Microsoft tools, Metadata, review limited to terminal and Microsoft tools, limited by data amountlimited by data amount

Web-enabled ReviewWeb-enabled Review Metadata, full search and coding capabilities, web-secure Metadata, full search and coding capabilities, web-secure

24/7 service, unlimited data amount24/7 service, unlimited data amount

Preliminary Questions before Determining BestPreliminary Questions before Determining Best Methodology for Collection and Review:Methodology for Collection and Review:

Document/e-mail retention programsDocument/e-mail retention programs Hard ware & soft ware ageHard ware & soft ware age Individual custodian rights Individual custodian rights IT mapping/potential sources IT mapping/potential sources Back-up tape rotation and configurationBack-up tape rotation and configuration Client IT capabilitiesClient IT capabilities Client resources (financial/personnel)Client resources (financial/personnel) Firm resources (personnel/software & hardware)Firm resources (personnel/software & hardware)

• Industry data now suggests that 80% of Industry data now suggests that 80% of e-discovery costs are associated with review and e-discovery costs are associated with review and production!production!

Back to Our Sample Case……Back to Our Sample Case……

Case ScenarioCase Scenario:: Employee Jane Jones is a regional manager for ABC Employee Jane Jones is a regional manager for ABC

Medical. Jane leaves ABC Medical for employment Medical. Jane leaves ABC Medical for employment with new competitor XYZ Medical. with new competitor XYZ Medical.

Alleged: Jane Jones has violated her non-compete Alleged: Jane Jones has violated her non-compete and also has taken ABC Medical corporate and also has taken ABC Medical corporate documents to XYZ Medical.documents to XYZ Medical.

These documents were taken,forwarded by e-mail These documents were taken,forwarded by e-mail and removed on a USB driveand removed on a USB drive

Discovery StepsDiscovery Steps

Step 1Step 1. Image and restore the computers (2) used by . Image and restore the computers (2) used by Jane at ABC corporation. Investigation proves that Jane Jane at ABC corporation. Investigation proves that Jane emailed documents to her home computer and to an emailed documents to her home computer and to an XYZ email address. Jane also attached a USB drive to XYZ email address. Jane also attached a USB drive to her computer several times the last week of her computer several times the last week of employment.employment.

Discovery StepsDiscovery Steps

Step 2Step 2. Request that Jane Smith image and make . Request that Jane Smith image and make her home computer or computers available for her home computer or computers available for forensic reviewforensic review

Step 3Step 3. Request that XYZ Medical produce any and . Request that XYZ Medical produce any and all documents that were received by Jane Smith that all documents that were received by Jane Smith that are copies of or were derived from those documents are copies of or were derived from those documents that were originally ABC Medical property. In the that were originally ABC Medical property. In the production note the exact location of the documents in production note the exact location of the documents in questionquestion

Destroy all documents once discoveredDestroy all documents once discovered

Methods & CostsMethods & Costs

ABC Medical CostsABC Medical Costs Image, restore, and locate documents on ABC Medical Image, restore, and locate documents on ABC Medical

computerscomputers 2 computers at $2,500 each2 computers at $2,500 each

Total ABC Medical Cost Total ABC Medical Cost $5,000 $5,000


XYZ Medical CostsXYZ Medical Costs Image, restore and locate documents on Jane Smith’s Image, restore and locate documents on Jane Smith’s

home systemhome system 1 computer at $2,5001 computer at $2,500 Image, restore and locate documents on Jane Smith’s Image, restore and locate documents on Jane Smith’s

XYZ computersXYZ computers 2 computers at $2,500 each 2 computers at $2,500 each

Review of e-mail and data servers to locate any Review of e-mail and data servers to locate any additional documentsadditional documents Network harvesting using exact match keywords in Network harvesting using exact match keywords in

combinationcombination


Review of e-mail and data servers to locate any Review of e-mail and data servers to locate any additional documentsadditional documents Network harvesting using exact match keywords in Network harvesting using exact match keywords in

combination.combination. 3 servers, 750 GB searched 3 servers, 750 GB searched $21,000 $21,000

Permanent deletion of found filesPermanent deletion of found files 83 files found83 files found 12 hours @ 250 per hour12 hours @ 250 per hour $3,000$3,000

Total XYZ Medical CostsTotal XYZ Medical Costs $31,500$31,500

Sample Case #2Sample Case #2

John Smith sues former employer, 123 Corp. for John Smith sues former employer, 123 Corp. for wrongful termination / Age Discriminationwrongful termination / Age Discrimination

123 Corp denies discrimination123 Corp denies discrimination

Mr. Smith has copy of damaging e-mailMr. Smith has copy of damaging e-mail

Visual Evidence / E-Discovery LLCVisual Evidence / E-Discovery LLC

THANK YOUTHANK YOU

Presented by John WinklerPresented by John WinklerVisual Evidence / E-Discovery LLCVisual Evidence / E-Discovery LLC

1382 West Ninth Street, Cleveland, OH 441131382 West Ninth Street, Cleveland, OH 44113Direct: 216.407.3939 – Headquarters: 216.241.3443Direct: 216.407.3939 – Headquarters: 216.241.3443

[email protected]@vevidence.com – www.vevidence.com – www.vevidence.com