E-Discovery and Forensics: Effectively Preserving Evidence Presented by: Ronald I. Raether, Jr....

E-Discovery and Forensics: E-Discovery and Forensics: Effectively Preserving Effectively Preserving

EvidenceEvidence

Presented by: Presented by: Ronald I. Raether, Jr.Ronald I. Raether, Jr.

Faruki Ireland & Cox P.L.L.Faruki Ireland & Cox P.L.L.June 19, 2007June 19, 2007

Electronic Document Electronic Document DiscoveryDiscovery

Why all the FussWhy all the Fuss

Old Rules/New TricksOld Rules/New Tricks

Practice TipsPractice Tips


“The jury found [Anderson] guilty on the basis [of this statement]”

Houston Chronicle – June 25, 2002


$604m Compensatory Damages $604m Compensatory Damages $850m Punitive Damages $850m Punitive Damages ““Morgan Stanley executives had Morgan Stanley executives had

clearly misled the court and the clearly misled the court and the plaintiffs as to the existence of e-plaintiffs as to the existence of e-mails. “mails. “

Fourth District Reverses Based on Fourth District Reverses Based on Measurement of DamagesMeasurement of Damages

ELECTRONIC DISCOVERYELECTRONIC DISCOVERY

93% of Corporate documents created 93% of Corporate documents created electronicallyelectronically

70% of those NEVER migrate to 70% of those NEVER migrate to paperpaper

corporations are expected to corporations are expected to generate 17.5 trillion electronic generate 17.5 trillion electronic documents annuallydocuments annually

Office workers exchange est. 2.8 Office workers exchange est. 2.8 billion e-mails per day billion e-mails per day

ELECTRONIC DISCOVERYELECTRONIC DISCOVERY

Floppy DisketteFloppy Diskette 100 pages or ½ inch stack100 pages or ½ inch stack

CDCD 52,500 pages or 16 boxes52,500 pages or 16 boxes

DVDDVD 350,000 pages or about 117 boxes350,000 pages or about 117 boxes

1 Terabyte1 Terabyte 100,000,000 pages or about 30,000 100,000,000 pages or about 30,000

boxesboxes

Law DevelopsLaw Develops

1972 1993 1995 1999 2000

FRCP adds “data compilations

Printing data insufficient (Armstrong v. Executive Office of the President)

Electronic Discoverable; paper not substitute (Anti-Monopoly)

Request for “documents” includes deleted emails (Playboy)

Computerized data includes voice mail, email, back up files, data files, program files, system files, web site log files and more (Kleiner)

Law DevelopsLaw Develops

2002 2003 2004 2005

Negligence sufficient to impose adverse inference (Residential Funding)

Counsel must explain preservation obligation (Metropolitan Opera)

Counsel has affirmative obligation to become familiar with client systems and data retention policies (Zubalake V)

Adverse Inference and burden shifting for multiple violations (Morgan Stanley)

Landscape Shifts for Lawyers

Old Rules-New TricksOld Rules-New TricksDiscoverabilityDiscoverability

Amendments to Discovery Rules Amendments to Discovery Rules

Five Year ProjectFive Year Project What are the differences between paper What are the differences between paper

and electronic documents?and electronic documents? Do these differences create problems that Do these differences create problems that

can or should be addressed by changes to can or should be addressed by changes to the FRCP?the FRCP?

If there are problems that rulemaking can If there are problems that rulemaking can address, what rules can be crafted to suit address, what rules can be crafted to suit that purpose?that purpose?



TimelineTimeline 2000: Mini-conference (Hastings and 2000: Mini-conference (Hastings and

Brooklyn Law School)Brooklyn Law School) 2001: FJC studies electronic discovery 2001: FJC studies electronic discovery

disputesdisputes 2002/2003: Input solicited2002/2003: Input solicited Feb. 20-21, 2004: Formal Conference at Feb. 20-21, 2004: Formal Conference at

FordhamFordham May 2004 – Feb 2005: Public CommentMay 2004 – Feb 2005: Public Comment Effective December 1, 2006Effective December 1, 2006

Old Rules-New TricksOld Rules-New Tricks

DiscoverabilityDiscoverability

SpoliationSpoliation

AdmissibilityAdmissibility


"Rules 26(b) and 34 for the Federal "Rules 26(b) and 34 for the Federal Rules of Civil Procedure instruct that Rules of Civil Procedure instruct that computer-stored information is computer-stored information is discoverable under the same rules discoverable under the same rules that pertain to tangible, written that pertain to tangible, written materials.“ materials.“ Rowe Entm't, Inc. v. The Rowe Entm't, Inc. v. The William Morris AgencyWilliam Morris Agency (S.D.N.Y. May 9, (S.D.N.Y. May 9, 2002). 2002).



Rule 16 – Early Meet and ConferRule 16 – Early Meet and Confer Modification of disclosure timingModification of disclosure timing Disclosure or discovery of electronically Disclosure or discovery of electronically

stored informationstored information PreservationPreservation Permits agreements regarding privilegePermits agreements regarding privilege FormatFormat


Amendments to Discovery Rules Amendments to Discovery Rules O’Bar v. Lowe’s Home Centers, Inc O’Bar v. Lowe’s Home Centers, Inc (W.D.N.C. (W.D.N.C.

May 2, 2007)May 2, 2007)Adopts “Suggested Protocol for Discovery of ESI,” Adopts “Suggested Protocol for Discovery of ESI,” Maryland U.S.D.C.Maryland U.S.D.C. Scope of RequestsScope of Requests Meta-DataMeta-Data Methods of ProductionMethods of Production PreservationPreservation

In re Seroquel Prods. Liab. Litig.In re Seroquel Prods. Liab. Litig. (M.D. Fla. Jan. 26, (M.D. Fla. Jan. 26, 2007), MDL Case Management Order addresses 2007), MDL Case Management Order addresses e-Discoverye-Discovery



Rule 26Rule 26 Includes “electronically stored information”Includes “electronically stored information” Identify (but not produce) electronically Identify (but not produce) electronically

stored information not “reasonably stored information not “reasonably accessible because of undue burden or accessible because of undue burden or expense”expense”

Rule 45 – includes electronically stored Rule 45 – includes electronically stored informationinformation


Fed. R. Civ. P. 34 requires a party to Fed. R. Civ. P. 34 requires a party to produce documents "as they are kept in produce documents "as they are kept in the usual course of business." the usual course of business."

"electronic documents [must be produced] "electronic documents [must be produced] in the native electronic format (or a in the native electronic format (or a mutually agreeable format)." mutually agreeable format)." United States United States v. First Datav. First Data, 287 F. Supp. 2d 69 (D.D.C. , 287 F. Supp. 2d 69 (D.D.C. 2003). 2003).

Exceptions – Delaware does not require Exceptions – Delaware does not require Native Format or Metadata. Native Format or Metadata. Wyeth v. Wyeth v. Impax Labs., Inc.Impax Labs., Inc. (D. Del. Oct. 26, 2006) (D. Del. Oct. 26, 2006)



Rules 33 and 34Rules 33 and 34 Can produce electronically stored information Can produce electronically stored information

as responseas response May be required to explain how to access dataMay be required to explain how to access data

Can request information to be produced in Can request information to be produced in specific formatspecific format

Form normally maintainedForm normally maintained Reasonably usableReasonably usable Only one formOnly one form

Discoverability Discoverability

"The law is clear that data in "The law is clear that data in computerized form is discoverable computerized form is discoverable even if paper 'hard copies' of the even if paper 'hard copies' of the information have been produced . . . . information have been produced . . . . [T]oday it is black letter law that [T]oday it is black letter law that computerized data is discoverable if computerized data is discoverable if relevant." relevant." Anti-Monopoly, Inc. v. Hasbro, Anti-Monopoly, Inc. v. Hasbro, Inc.Inc., No. 94 Civ. 2120, 1995 WL 649934, , No. 94 Civ. 2120, 1995 WL 649934, 1995 U.S. Dist. LEXIS 16355, at *1 (S.D.N.Y. 1995 U.S. Dist. LEXIS 16355, at *1 (S.D.N.Y. Nov. 3, 1995). Nov. 3, 1995).


Rule 26(b)(2)(ii) – whether the “burden or Rule 26(b)(2)(ii) – whether the “burden or expense of the proposed discovery expense of the proposed discovery outweighs its likely benefit.”outweighs its likely benefit.”

Amended Rule: Identify electronically stored information not Amended Rule: Identify electronically stored information not “reasonably accessible because of undue burden or expense”“reasonably accessible because of undue burden or expense”


““((11) The extent to which the request is specifically tailored to ) The extent to which the request is specifically tailored to discover relevant information; discover relevant information;

((22) The availability of such information from other sources;) The availability of such information from other sources;(3) The total cost of production, compared to the amount in (3) The total cost of production, compared to the amount in

controversy;controversy; (4) The total cost of production, compared to the resources (4) The total cost of production, compared to the resources

available to each party; available to each party; (5) The relative ability of each party to control costs and its (5) The relative ability of each party to control costs and its

incentive to do so; incentive to do so; ((66) The importance of the issues at stake in the litigation; and ) The importance of the issues at stake in the litigation; and ((77) The relative benefits to the parties of obtaining the ) The relative benefits to the parties of obtaining the

information." information."

Zubulake v. UBS WarburgZubulake v. UBS Warburg, 217 F.R.D. 309, 320 (S.D.N.Y. , 217 F.R.D. 309, 320 (S.D.N.Y. 2003). 2003).


Trolling for impeachment evidence in Trolling for impeachment evidence in home computer denied. home computer denied. Hedenburg v. Hedenburg v. Aramark Am. Food Servs.Aramark Am. Food Servs. (W.D. Wash. Jan (W.D. Wash. Jan 17, 2007)17, 2007)

Fishing Expedition seeking access to hard Fishing Expedition seeking access to hard drives denied. drives denied. Balfour Beatty Rail, Inc. v. Balfour Beatty Rail, Inc. v. VaccarelloVaccarello (M.D. Fla. Jan. 18, 2007) (M.D. Fla. Jan. 18, 2007)

Undue Burden requires narrowing of Undue Burden requires narrowing of discovery requests. discovery requests. Ameriwood Industries, Ameriwood Industries, Inc. v. LibermanInc. v. Liberman (E.D. Mo. Feb. 13, 2007) (E.D. Mo. Feb. 13, 2007)

Discoverability Discoverability Cost ShiftingCost Shifting

Plaintiff ordered to convert a Plaintiff ordered to convert a simulation program and data on a simulation program and data on a nine-track magnetic tape if the nine-track magnetic tape if the defendant agreed to "pay all the defendant agreed to "pay all the reasonable and necessary costs that reasonable and necessary costs that may be associated with the may be associated with the manufacture of the computer-readable manufacture of the computer-readable tape." tape." In re Air Crash Disaster at Detroit In re Air Crash Disaster at Detroit Metro. Airport on Aug. 16, 1987Metro. Airport on Aug. 16, 1987, 130 F.R.D. , 130 F.R.D. 634, 636 (E.D. Mich. 1989).634, 636 (E.D. Mich. 1989).


Accessible Data must be produced at cost of Accessible Data must be produced at cost of producing party. producing party. Peskoff v. FaberPeskoff v. Faber (D.D.C. (D.D.C. 2007).2007).

Marginal Utility Test used to deny motion to Marginal Utility Test used to deny motion to compel. compel. Oxford House, Inc. v. City of TopekaOxford House, Inc. v. City of Topeka (D. Kan. Apr. 27, 2007).(D. Kan. Apr. 27, 2007).

Conclusory statements about costs Conclusory statements about costs insufficient. insufficient. Best Buy Stores, L.P. v. Best Buy Stores, L.P. v. Developers Diversified Realty Corp.Developers Diversified Realty Corp. (D. Minn. (D. Minn. Feb. 1, 2007)Feb. 1, 2007)

Production of back-ups ordered; cost-shifting Production of back-ups ordered; cost-shifting determined later. determined later. In re Veeco Instruments, In re Veeco Instruments, Inc. Sec. LitigInc. Sec. Litig. (S.D.N.Y. Apr. 2, 2007).. (S.D.N.Y. Apr. 2, 2007).


Comments to 26(b)(2)(B)Comments to 26(b)(2)(B) Sampling, inspection or depositions Sampling, inspection or depositions

appropriate to test accessibility, and appropriate to test accessibility, and nature and volume of electronically stored nature and volume of electronically stored informationinformation

Developed sampling protocol. Developed sampling protocol. Zurich Am. Zurich Am. Ins. Co. v. Ace Am. Reinsurance Co.Ins. Co. v. Ace Am. Reinsurance Co. (S.D.N.Y. Dec. 22, 2006)(S.D.N.Y. Dec. 22, 2006)

Developed imaging, recovery and Developed imaging, recovery and disclosure protocols. disclosure protocols. Cenveo Corp. v. Cenveo Corp. v. SlaterSlater (E.D. Pa. Jan. 31, 2007) (E.D. Pa. Jan. 31, 2007)

DiscoverabilityDiscoverabilityRule 16 ConferenceRule 16 Conference

• Identify Sources

• Technical Meet and Confer

• Experts

• Complexity

• Internal Resources

DiscoverabilityDiscoverabilityLocating Electronic DocumentsLocating Electronic Documents

I.T. – 30(b)(6)I.T. – 30(b)(6)

InterrogatoriesInterrogatories

On-Site InspectionsOn-Site Inspections


Numbers, Types and LocationsNumbers, Types and Locations Operating Systems/Application SWOperating Systems/Application SW File Naming/Saving ConventionsFile Naming/Saving Conventions Disk /Tape Labeling ConventionsDisk /Tape Labeling Conventions


Retention Policies/ProceduresRetention Policies/Procedures Employee Policies/ProceduresEmployee Policies/Procedures Identity of Key EmployeesIdentity of Key Employees Backup/Archiving Backup/Archiving

Schedule/ProceduresSchedule/Procedures

DiscoverabilityDiscoverabilityDocument RequestsDocument Requests

E-Mail (Local and Exchange)E-Mail (Local and Exchange) Document Files – DirectoryDocument Files – Directory Internet Browsing Records (E.g., Internet Browsing Records (E.g.,

Cookies)Cookies) Proprietary FilesProprietary Files Site InspectionSite Inspection

DiscoverabilityDiscoverabilityInterrogatoriesInterrogatories

Persons Assisted in CollectionPersons Assisted in Collection Steps TakenSteps Taken System ArchitectureSystem Architecture Knowledgeable PersonsKnowledgeable Persons

DiscoverabilityDiscoverabilityTestifying ExpertsTestifying Experts

Computer data and calculations discoverable. Computer data and calculations discoverable. City of Cleveland v. Cleveland Electronic City of Cleveland v. Cleveland Electronic Illuminating Co. Illuminating Co. (N.D. Ohio 1980).(N.D. Ohio 1980).

Final and draft computerized accident Final and draft computerized accident simulations discoverable. simulations discoverable. Bartley v. Isuzu Bartley v. Isuzu Motors Ltd.Motors Ltd. (D. Colo. 1993). (D. Colo. 1993).

Expert ordered to preserve evidence. Expert ordered to preserve evidence. In re In re Zyprexa Prods. Liab. Litig.Zyprexa Prods. Liab. Litig. (E.D.N.Y. Dec. 28, (E.D.N.Y. Dec. 28, 2006)2006)

No sanctions for failing to retain drafts or No sanctions for failing to retain drafts or preserve email. preserve email. Univ. of Pittsburg v. TownsendUniv. of Pittsburg v. Townsend (E.D. Tenn. Mar. 30, 2007).(E.D. Tenn. Mar. 30, 2007).

DiscoverabilityDiscoverabilityNon-Testifying ExpertsNon-Testifying Experts

Non-testifying expert computer Non-testifying expert computer program discoverable when program discoverable when necessary to depose testifying necessary to depose testifying expert. expert. Pearl Brewing Co. v. Jos. Pearl Brewing Co. v. Jos. Schlitz Brewing Co.Schlitz Brewing Co. (S.D. Texas 1976). (S.D. Texas 1976).

Methods used by Non-testifying Methods used by Non-testifying expert used to generate tables expert used to generate tables discoverable. discoverable. Derrickson v. Circuit Derrickson v. Circuit City StoresCity Stores (D. Md. 1999). (D. Md. 1999).

DiscoverabilityDiscoverabilityPrivilegePrivilege

Rule 26(b)(5)(B) Rule 26(b)(5)(B) safe harbor for inadvertent productionsafe harbor for inadvertent production

Evid. Rule 502 Evid. Rule 502 Safe harbor ifSafe harbor if

Inadvertent productionInadvertent production Reasonable precautions to prevent Reasonable precautions to prevent

disclosuredisclosure Production in government investigation Production in government investigation

not general waivernot general waiver


Solution One: “Claw back” agreementSolution One: “Claw back” agreement Parties agree inadvertent production does Parties agree inadvertent production does

not constitute waivernot constitute waiver Protocol in place for identification and Protocol in place for identification and

return of privileged informationreturn of privileged information Solution Two: “Quick peek” agreementSolution Two: “Quick peek” agreement

Requesting party given access to Requesting party given access to unreviewed documents to designate unreviewed documents to designate responsive materialresponsive material

Privilege claims made as to designated Privilege claims made as to designated materialmaterial

DiscoverabilityDiscoverabilityPrivilege – Inadvertent WaiverPrivilege – Inadvertent Waiver

Reasonableness of PrecautionsReasonableness of Precautions Amount of Time to Correct ErrorAmount of Time to Correct Error Scope of Production Scope of Production Extent of Inadvertent DisclosureExtent of Inadvertent Disclosure Overriding Interest of Fairness Overriding Interest of Fairness

and Justiceand Justice


Waiver found with inadvertent production – attached Waiver found with inadvertent production – attached to proposed counterclaim. to proposed counterclaim. Marrero Hernandez v. Marrero Hernandez v. Esso Standard Oil Co.Esso Standard Oil Co. (D. Puerto Rico July 11, 2006). (D. Puerto Rico July 11, 2006).

No selective waiver when producing documents to No selective waiver when producing documents to federal agency during investigation. federal agency during investigation. In re Qwest In re Qwest Communications Int’l, Inc.Communications Int’l, Inc. (10 (10thth Cir. June 19, 2006). Cir. June 19, 2006).

Privilege not waived with inadvertent production of Privilege not waived with inadvertent production of spreadsheet. spreadsheet. Williams v. Sprint/United Mgmt. Co.Williams v. Sprint/United Mgmt. Co. (D. (D. Kan. July 1, 2006).Kan. July 1, 2006).

Conflict where ex-employee used company Conflict where ex-employee used company computercomputer Kaufman v. SunGard Inv. Sys.Kaufman v. SunGard Inv. Sys. (E.D.N.Y. May 15, 2006) – (E.D.N.Y. May 15, 2006) –

waiver.waiver. Curto v. Med. World Communications, Inc.Curto v. Med. World Communications, Inc. (E.D.N.Y. May 15, (E.D.N.Y. May 15,

2006) – no waiver.2006) – no waiver.

Old Rules-New TricksOld Rules-New TricksSpoliationSpoliation

All parties “are obligated to take All parties “are obligated to take appropriate measures to preserve appropriate measures to preserve documents and information . . . documents and information . . . reasonably calculated to lead to the reasonably calculated to lead to the discovery of admissible evidence and discovery of admissible evidence and likely to be requested during discovery.” likely to be requested during discovery.”

Amended Rule 37(f) – routine and good Amended Rule 37(f) – routine and good faith operation of system not faith operation of system not sanctionable.sanctionable.

Old Rules-New TricksOld Rules-New TricksSpoliationSpoliation

Preserve backup tapes for key employees Preserve backup tapes for key employees or others with relevant information or others with relevant information

Retain both current and archived backup Retain both current and archived backup tapes identified as potentially relevanttapes identified as potentially relevant

Catalog documents created after the duty Catalog documents created after the duty attaches in a separate file for easy attaches in a separate file for easy collection and reviewcollection and review

Take mirror images of computer hard Take mirror images of computer hard drives. drives.

Zubulake v. UBS Warburg LLCZubulake v. UBS Warburg LLC, 220 F.R.D. , 220 F.R.D. 212, 217 (S.D.N.Y. 2003) 212, 217 (S.D.N.Y. 2003)

Spoliation Spoliation Retention PolicyRetention Policy

“ “[D]ocument retention policies . . . do [D]ocument retention policies . . . do not trump the Federal Rules of Civil not trump the Federal Rules of Civil Procedure or requests by opposing Procedure or requests by opposing counsel . . . . [E]xecution of a counsel . . . . [E]xecution of a document retention policy that is at document retention policy that is at odds with the rules governing the odds with the rules governing the conduct of litigation does not protect conduct of litigation does not protect [the party] from a finding of intentional [the party] from a finding of intentional destruction.“ destruction.“ Trigon Ins. Co. v. United Trigon Ins. Co. v. United StatesStates, 204 F.R.D. 277, 289 (E.D. Va. , 204 F.R.D. 277, 289 (E.D. Va. 2001). 2001).

Obligation ArisesObligation Arises

Prior LitigationPrior Litigation Notice of ComplaintNotice of Complaint Service of DiscoveryService of Discovery Court OrdersCourt Orders Statutes/Rules of ProcedureStatutes/Rules of Procedure Preservation LetterPreservation Letter

Preservation LetterPreservation Letter Litigation Hold Notices Protected from Litigation Hold Notices Protected from

Discovery Discovery Capitano v. Ford Motor Co.Capitano v. Ford Motor Co., (N.Y. Sup. Ct. 2007), (N.Y. Sup. Ct. 2007) Gibson v. Ford Motor CoGibson v. Ford Motor Co. (N.D. Ga. Jan. 4, 2007).. (N.D. Ga. Jan. 4, 2007).

Describe SubjectDescribe Subject Describe Relevant DataDescribe Relevant Data Generic Listing of LocationsGeneric Listing of Locations Retention PolicyRetention Policy System ArchitectureSystem Architecture

Suspend routine document destruction or alteration Suspend routine document destruction or alteration required under document retention policy.required under document retention policy.

Involve counsel in determining both issues relevant Involve counsel in determining both issues relevant to the cause and that may lead to relevant to the cause and that may lead to relevant discovery.discovery.

Send an order, with periodic reminders thereafter, Send an order, with periodic reminders thereafter, to the appropriate employees, including those in to the appropriate employees, including those in information technology, to preserve all information technology, to preserve all documentation relevant to the litigation. The order documentation relevant to the litigation. The order should include the issues involved in the litigation should include the issues involved in the litigation and remind the employees that the data retention and remind the employees that the data retention policy no longer applies to these issues.policy no longer applies to these issues.

Spoliation Spoliation Suggested ActionsSuggested Actions

Spoliation Spoliation Suggested ActionsSuggested Actions

Obtain copies of all hard copy documents.Obtain copies of all hard copy documents. Develop working knowledge of the technology Develop working knowledge of the technology

systems to determine storage media, locations systems to determine storage media, locations and length of storage. This knowledge should and length of storage. This knowledge should also include whether the system overwrites also include whether the system overwrites deleted information. Depending upon the deleted information. Depending upon the complexity of the system, this step may also complexity of the system, this step may also require consulting a computer forensics expert to require consulting a computer forensics expert to determine an effective strategy for preserving determine an effective strategy for preserving and maintaining electronic data.and maintaining electronic data.

Designate an employee to be responsible for the Designate an employee to be responsible for the collection and protection of relevant documents collection and protection of relevant documents and information.and information.

Spoliation Spoliation StandardStandard

the party with control over the the party with control over the evidence had a duty to preserve it at evidence had a duty to preserve it at the time of destruction;the time of destruction;

the records were destroyed with a the records were destroyed with a "culpable state of mind"; and"culpable state of mind"; and

the destroyed evidence was the destroyed evidence was "relevant" to the party's claim or "relevant" to the party's claim or defense and a reasonable trier of fact defense and a reasonable trier of fact might find that it would support that might find that it would support that claim or defense.claim or defense.

SpoliationSpoliation ConsequencesConsequences

Dismiss Complaint Dismiss Complaint – – Plasse v. Tyco Elecs. Plasse v. Tyco Elecs. Corp.Corp. (D. Mass. Sept. 7, 2006) (D. Mass. Sept. 7, 2006)

Default JudgmentDefault Judgment - - QZO, Inc. v. MoyerQZO, Inc. v. Moyer (S.C. (S.C. Ct. App. 2004). Ct. App. 2004).

Witness ExcludedWitness Excluded - - United States v. Phillip United States v. Phillip Morris USA Inc. f/k/a Phillip Morris Inc.Morris USA Inc. f/k/a Phillip Morris Inc. (D.D.C. July 21, 2004).(D.D.C. July 21, 2004).

Dismissed CounterclaimsDismissed Counterclaims - - Long Island Long Island Diagnostic Imaging v. Stony Brook Diagnostic Imaging v. Stony Brook Diagnostic Assocs.Diagnostic Assocs. (N.Y. App. Div. 2001). (N.Y. App. Div. 2001).

Costs of Discovery Special MasterCosts of Discovery Special Master – – Padgett Padgett v. City of Monte Serenov. City of Monte Sereno (N.D. Cal. Mar. 20, (N.D. Cal. Mar. 20, 2007). 2007).

SpoliationSpoliation ConsequencesConsequences

Amended Rule 37(f) – Safe HarborAmended Rule 37(f) – Safe Harbor No sanctions for lost data where routine, No sanctions for lost data where routine,

good faith operation of electronic good faith operation of electronic information systeminformation system

Absent exceptional circumstancesAbsent exceptional circumstances No Spoliation sanctions where no No Spoliation sanctions where no

“desire to suppress the truth” and no “desire to suppress the truth” and no prejudice shown. prejudice shown. Greyhound Lines, Greyhound Lines, Inc. v. WadeInc. v. Wade (8 (8thth Cir. Apr. 24, 2007). Cir. Apr. 24, 2007).

AdmissibilityAdmissibility What to RecordWhat to Record

Lorraine v. Markel Am. Ins. Co.Lorraine v. Markel Am. Ins. Co. (D. Md. (D. Md. May 4, 2007)May 4, 2007)

"Date, time, and place of collection or "Date, time, and place of collection or receipt.receipt.

The name of the individual who The name of the individual who collected or received the evidence.collected or received the evidence.

A description of what was obtained, A description of what was obtained, including media-specific information.including media-specific information.

Media type, standard, and Media type, standard, and manufacturer.manufacturer.

AdmissibilityAdmissibility What to RecordWhat to Record

All movement of evidence (evidence All movement of evidence (evidence transfer) and the purpose of the transfer) and the purpose of the transfer.transfer.

Physical (visual) inspection of Physical (visual) inspection of evidence.evidence.

Procedures used in collecting and Procedures used in collecting and analyzing the data.analyzing the data.

Date and time of check-in and check-Date and time of check-in and check-out of media from secure storage." out of media from secure storage."

AdmissibilityAdmissibility AuthenticationAuthentication

Authenticity requires a showing that Authenticity requires a showing that the evidence "is what a proponent the evidence "is what a proponent claims." Fed. R. Evid. 901(a); Ohio R. claims." Fed. R. Evid. 901(a); Ohio R. Evid. 901(a). Authenticity may be Evid. 901(a). Authenticity may be established through witness established through witness testimony, distinctive characteristics testimony, distinctive characteristics of the evidence and the like. Fed. R. of the evidence and the like. Fed. R. Evid. 901(b); Ohio R. Evid. 901(b). Evid. 901(b); Ohio R. Evid. 901(b).

Admissibility Admissibility Authentication Authentication

Witness' testimony of personally receiving Witness' testimony of personally receiving and printing emails from the defendant was and printing emails from the defendant was sufficient to prove authenticity. sufficient to prove authenticity. Kearly v. Kearly v. MississippiMississippi, 843 So. 2d 66 (Miss.Ct. App. , 843 So. 2d 66 (Miss.Ct. App. 2002). 2002).

A witness authenticated documents A witness authenticated documents attached to a declaration when the "pages attached to a declaration when the "pages [were] printed from the Internet . . . by [were] printed from the Internet . . . by [him] or under his direction.“ [him] or under his direction.“ Perfect 10, Perfect 10, Inc. v. Cybernet Ventures, Inc.Inc. v. Cybernet Ventures, Inc., 213 F. Supp. , 213 F. Supp. 2d 1146 (C.D. Cal. 2002). 2d 1146 (C.D. Cal. 2002).

Old Rules-New TricksOld Rules-New TricksAdmissibilityAdmissibility

"although the legal requirements for "although the legal requirements for admissibility of downloaded documents admissibility of downloaded documents may not be well established, a party's may not be well established, a party's statement that 'I downloaded these statement that 'I downloaded these pages from the internet' is probably not pages from the internet' is probably not sufficient to authenticate a downloaded sufficient to authenticate a downloaded document." document." State ex rel. Leslie v. Ohio State ex rel. Leslie v. Ohio Hous. Fin. AgencyHous. Fin. Agency, 2003-Ohio-6560 , 2003-Ohio-6560 (Ohio Ct. App. Dec. 9, 2003) at ¶ 70 n.1. (Ohio Ct. App. Dec. 9, 2003) at ¶ 70 n.1.


Web address and path of the document;Web address and path of the document; Date and title of the document;Date and title of the document; Date the document was downloaded or Date the document was downloaded or

accessed; andaccessed; and Sworn statement to the court that the Sworn statement to the court that the

copy had not been altered from that found copy had not been altered from that found on the website.on the website.

State ex rel. Leslie v. Ohio Hous. Fin. State ex rel. Leslie v. Ohio Hous. Fin. AgencyAgency, 2003-Ohio-6560 (Ohio Ct. App. , 2003-Ohio-6560 (Ohio Ct. App. Dec. 9, 2003)Dec. 9, 2003)


The Court holds no illusions that The Court holds no illusions that hackers can adulterate the content hackers can adulterate the content of of anyany Web-site from Web-site from anyany location at location at anyany time." (emphasis in original). time." (emphasis in original). St. Clair v. Johnny's Oyster & Shrimp, St. Clair v. Johnny's Oyster & Shrimp, Inc.Inc., 76 F. Supp. 2d 773, 775 (S.D. , 76 F. Supp. 2d 773, 775 (S.D. Tex. 1999). Tex. 1999).


"[A]ny evidence procured off the "[A]ny evidence procured off the Internet is adequate for almost Internet is adequate for almost nothing, even under the most liberal nothing, even under the most liberal interpretation of the hearsay interpretation of the hearsay exception." exception." St. Clair v. Johnny's St. Clair v. Johnny's Oyster & Shrimp, Inc.Oyster & Shrimp, Inc., 76 F. Supp. 2d , 76 F. Supp. 2d 773, 775 (S.D. Tex. 1999). 773, 775 (S.D. Tex. 1999).


Fed. R. Civ. P. 803(6) permits the admission Fed. R. Civ. P. 803(6) permits the admission of computer business records if a party of computer business records if a party introduces a sufficient foundation. introduces a sufficient foundation. Hardison Hardison v. Balboa Ins. Co.v. Balboa Ins. Co., 4 Fed. Appx. 663 (10th , 4 Fed. Appx. 663 (10th Cir. 2001).Cir. 2001).

trial court should have admitted an email trial court should have admitted an email from the plaintiff to the defendant that was from the plaintiff to the defendant that was written within the scope of the author's written within the scope of the author's employment as a party admission. employment as a party admission. Sea-Land Sea-Land Servs., Inc. v. Lozen Int'l, LLCServs., Inc. v. Lozen Int'l, LLC, 285 F.3d 808 , 285 F.3d 808 (9th Cir. 2002). (9th Cir. 2002).


emails satisfied the requirements for a emails satisfied the requirements for a present sense impression because they present sense impression because they explained and the event in question explained and the event in question shortly after it occurred. shortly after it occurred. United States v. United States v. FerberFerber, 966 F. Supp. 90 (D. Mass. 1997). , 966 F. Supp. 90 (D. Mass. 1997).

emails offered by the defendant federal emails offered by the defendant federal agency were public records, which "are agency were public records, which "are generally admissible." generally admissible." Lester v. NatsiosLester v. Natsios, , 290 F. Supp. 2d 11, 26 (D.D.C. 2003). 290 F. Supp. 2d 11, 26 (D.D.C. 2003).

E-Discovery and Forensics: Effectively Preserving Evidence Presented by: Ronald I. Raether, Jr....

Documents

Transcript of E-Discovery and Forensics: Effectively Preserving Evidence Presented by: Ronald I. Raether, Jr....