ELECTRONIC DISCOVERY LAW:  e-discovery
DISCOVERY OF
ELECTRONIC DATA
© Richard E. Best 1998-2003 All Rights Reserved

THIS SITE DOES NOT PROVIDE LEGAL ADVICE

HOME
EXPERT ADVICE &
ASSISTANCE

See also Expert Case Outline & Referee Case Outline
For names and web sites of experts without rec see "SERVICE PROVIDERS / COMPUTER FORENSIC EXPERTS" at Electronic Discovery Websites

THE ROLE OF EXPERT CONSULTANTS AND WITNESSES IN E-DISCOVERY

SELECTION OF EXPERTS FOR E-DISCOVERY

EXPERT ASSISTANCE & TESTIMONY ON E-DISCOVERY

NEUTRAL / COURT APPOINTED EXPERTS FOR E-DISCOVERY

THE ROLE OF EXPERT CONSULTANTS AND WITNESSES
Professional obligations of attorneys to obtain skills and expert assistance

Need for precautions and concerns in accessing and preserving data

Booting, turning the system on, may alter critical time-stamps and other hidden evidence
Recycling tapes used for backup purposes overwrites old evidence
Performing system maintenance activities such as deleting, de-fragmenting, or compressing data, or disposing of any electronic media may alter or destroy evidence
Saving new data to media containing data may overwrite existing data.
Installing new software on any media with data may overwrite evidence
Using inadequate software to make duplicate copies of the storage media may alter data
Virus program operation may alter data
Problems of accessing and reading legacy data created with hardware or software no longer available
Problem of accessing data stored without meaningful search and retrieval protocols
Transferring data to new media may cause loss of data
Disorganized backup tapes may not be easily searched

Presentation to court

Credibility of outside, independent expert
Testimony re meeting industry standards for quality and reliability
Authentication of data
Chain of custody testimony

SELECTION OF EXPERTS

Certifications, training and experience on variety of hardware and software
Knowledge of outmoded software and programming language of legacy systems
Familiarity with diverse array of software and hardware
Capable of providing advice, analysis, recovery, testimony
Familiar with legal requirements for admissibility of evidence
May need multiple experts with different computer and electronic skills and specialized knowledge

TOP

EXPERT ASSISTANCE & TESTIMONY

See also Expert Case Outline

Advise re your client's data identification, preservation;

Formulate and/or advise re discovery and follow-up

Identify sources of information and formulate search protocols
Nature of computer software, system, network, backup and storage
ID & access databases, documents, and data
ID original software and hardware used to create data
Advise re software, command structure, & how to access data
Formulate procedure for sampling data to determine probability of locating relevant data

Perform basic discovery

Maintain control copy of evidence to avoid damage, claims of tampering or alteration
Create mirror image of hard drive; document system configuration used to create evidence

Simon Property Group v. mySimon (S.D.Ind.2000), 194 F.R.D.639
Gates Rubber Co. v. Bando Chemical Industries (D.Colo. 1996), 167 F.R.D. 90
Kupper v. State of Texas(Tex App.2004), 2004 Tex. App. LEXIS 337 [child sex assault conviction affi'd.; recovery from image of computer hard drive including deleted material and email message and photo from temporary internet file; chain of custody and authentication issues raised on appeal but rejected; ]

Search, retrieve and sort data using specialized software

Search and retrieve software
Index created
Search with Boolean logic
Document comparison software

Negotiate with opposing experts, instruct on searches to be performed by opponent
Advise during deposition of opponent's computer personnel
Access data protected by passwords or encryption
Guard against virus infections and logic bombs planted by opponent
Protect against infection of opponent's system with virus

Perform recovery work: trained computer expert required to recover some items

Evaluate email headers for forgeries and true sources;
Anonymous remailers to delete headers; sent through numerous remailers in various juris.
Software for review of electronic data produced
Software for old disks & tapes otherwise inaccessible
Knowledge of outmoded software and programming language
Make complete copy [sector by sector or "image copy" or mirror image]

All data including residual data [deleted files & fragments]
File by file copy only gets active data & may be inadmissible
Gates Rubber Co. v. Bando Chemical Indus.(D.Colo. 1996) [criticized for not imaging hard disk]

Reliable copy process: software and media

Industry standard for quality & reliability
Capable of independent analysis and verification of accuracy
Tamper proof copies: write protection

Write protect and virus check: assure accuracy and lack of modification

Document fully all steps taken in acquiring electronic evidence to establish chain of custody

document system configuration: hardware, software, OS used
how the file was found
what tools were used to locate it
where it was found
how it was transferred to its current format
show document is actually what it purports to be
trace document back to original source

Protection of data during acquisition to avoid

damage or change to the original format
altering or tampering with data
introduction of virus into the computer being searched
inadvertently damaging or destroying data

Write protect originals before exam or copy to prevent alteration
Virus check with up to date virus check

computer, software, media to be used
cleaning virus alters document

TOP

Protection of data obtained - write protect & virus check

Analysis performed on copies: no alteration during analysis or manipulation `
Store originals in a secure place with limited and controlled access to avoid possibility of the data being corrupted through alteration or destruction.[? Use of independent 3rd party]

Expert witness:

Independent, objective witness with increased credibility
Declaration for discovery

United States ex rel Tyson v. Amerigroup Ill., Inc. (N.D.Ill.2005), 2005 U.S. Dist. LEXIS 24929.  "There must be affirmative and compelling proof. Ipse dixits will not suffice. [citations] HFS has provided such evidence in the form of the affidavit of a testimonially competent HFS employee."  The court reviewed the detailed explanation provided by one expert as to the efforts and costs involved in producing the e-mails and then noted the opponents deficiencies:

"Significantly, the defendants do not challenge any of Mr. Perry's assertions. This omission, they claimed at oral argument, was the inevitable result of having no familiarity with the internal systems used at HFS. The argument is unpersuasive. The defendants could have sought leave to depose Mr. Perry, and, of course, they could have retained an expert of their own to opine on the validity of Mr. Perry's statements -- at least in a general sense. "
"The defendants have dealt with the question of undue burden by essentially ignoring its existence. This mode of dealing with potentially dispositive argument is as "pointless" as is ignoring potentially dispositive authority that is contrary to a party's position. [citations] While ignoring the question of burdens, the defendants have not cited not a single case in which a non-party was subjected to the significant burden of restoring electronic data from backup tapes."

Playboy Enterprises v. Welles (S.D. Cal.1999), 60 F. Supp.2d 1050 [Tr Ct required an expert declaration confirming the feasibility and probability of discovery ---just as likely as not---and that no damage would occur to the opponent's computer]

Alexander v. Federal Bureau of Investigation (D.C.1998), 188 F.R.D. 111 [quality of expert declaration determinative]

Simon Property Group v. mySimon (S.D.Ind.2000), 194 F.R.D.639, 640-41 [court critical of sparse showing made re types of computers, networks, use, costs, potential disruption etc citing Alexander Court follows in part Playboy Enterprises, supra]

Trial witness: authentication & chain of custody for admissibility

Kupper v. State of Texas(Tex App.2004), 2004 Tex. App. LEXIS 337 [child sex assault conviction affi'd.; recovery from image of computer hard drive including deleted material and email message and photo from temporary internet file; chain of custody and authentication issues raised on appeal but rejected; ]

Authentication problems with electronic documents

Ease and lack of signs of alteration on hard copy
Verification of sender or recipient

Data & compilations: testify re retrieval of data , reliability of methods, chain of custody, lack of manipulation or corruption
Testify re reasonable efforts to preserve your client's data in case of spoliation claims

TOP

NEUTRAL / COURT APPOINTED EXPERTS

Federal Rule of Civil Procedure, Rule 53. Masters

California Code of Civil Procedure §§ 638, 639 et seq.
California Rules of Court, Rules 241.1, 241.2
Referee Case Outline

Playboy Enterprises v. Welles (S.D. Cal.1999), 60 F. Supp.2d 1050 [Tr Ct established protocol including mirror image by neutral expert at requesting party's expense; expert to be mutually agreeable or parties would submit names; expert was to be acting as an "officer of the court", was required to sign a protective order re confidentiality and was to report to the court on retrieval efforts if only portions of documents were recovered ]

Simon Property Group v. mySimon Inc.(S.D.Ind.2000), 194 F.R.D. 639 [Neutral selected and paid by party seeking discovery but designated to act as officer of the court and to report to the court]

Antioch Co. v. Scrapbook Borders Inc. (D.Minn. 2002), 2002 WL 31387731 [Defendant had not opposed a general preservation order. In addition, to protect "deleted data" from being overwritten during normal computer operations, court ordered mirror image by "neutral" expert selected by plaintiff of hard drives of all computers of defendant small business. The expert reported on hardware examined, maintained records on chain of custody, and was to maintain confidentiality. Copies were provided to the court and defendant. Thereafter, upon request in discovery, defendant would search mirror images of the hard drives for responsive information. Responsive documents and a privilege log would be produced by responding defendant. Note, defendant had requested an order for the "neutral" to mirror image the hard drives, keep the mirror image, and, upon formal discovery request, review the mirror image for responsive data subject to court prescribed parameters.]

TOP