Gaining Access to Computer Forensic Images

Although parties to litigation have a duty to preserve electronic data, they may not be required to produce the data that has been preserved. In this new article, Gregory Fordham analyzes two decisions where courts have denied production of the entire hard drive. (See, Peskoff v Faber, 2007 WL 2416119 (D.D.C.) and Calyon v Mizuho Securities USA, Inc., Slip Copy, 2007 WL 1468889 (S.D.N.Y.) ) With the advent of decisions like Peskoff and Calyon Fordham says litigators are likely to encounter greater resistance to production of entire computer hard drives unless the requesting party can effectively justify their requests by showing:

• discovery “discrepancies and inconsistencies”; or
• a nexus between the computer hard drive and the act initiating the lawsuit; or that,
• the producing party was not capable or willing to produce the requested information.

Although the first two criteria cited in Calyon v Mizuho should be easily understood by both requesters and courts, the third criteria is more involved and Fordham provides suggestions in his latest article. Read the entire article here.

Litigators can cut review time as well as production costs by de-duplicating e-mail so that each message in a population is reviewed only once.  De-duplicating e-mail is best done, as with other document types, by using the MD-5 or SHA message digest algorithms. 

De-duplicating e-mail is different from other document types, however, in that e-mail is a compound document.  In other words, it consists of a message and one or more attachments.

Although determining the duplicate e-mails at the compound level can reduce the population, even more efficiency can be gained when the e-mail message and attachments are considered separately.

In addition, the elements considered for de-duplication within the e-mail message itself should be narrowed in order to gain the most efficiency.  In other words, specific metadata properties within the e-mail should be selected for de-duplicating the e-mail message.  Otherwise, the same message sent to various parties could still appear as unique message simply because they passed through different servers when sent over the internet. 

Although de-duplication can increase efficiency, it must also be matched with the ability to track where all of the duplicates were found.  Simply eliminating duplicates without tracking their locations prevents the litigator from fully recognizing the consequence of key documents once they are identified.  Thus, tracking where the documents have been is just as important in the efficiency of de-duplication.