What is eDiscovery?

Why is eDiscovery important?

In essence, those who are put in charge eDiscovery forensics have the right and responsibility to gather relevant information on behalf of the litigator. Notice the emphasis is on the word “relevant”. While there may be 100 facts all equally true and factually correct, not all will be equally as relevant to resolving the dispute between the two parties or to establishing a point.

The document archives contain tons of facts, but not all will be equally as relevant when trying to prove a point in court.

Now let’s put that into the context of the digital world and smart devices that surround us in the 21st century. Try to imagine how many files there are to be discovered and categorized during the e-discovery forensics process.

Let’s throw all sorts of data into the mix that comes in the form of:

• App logs
• Recordings
• IoT data
• Social media posts
• Call history
• Browser history
• GPS data
• Emails sent and received
• etc.

It seems like a lot of work having to comb through it all and using traditional methods without the help of modern software, it sure can be. To make matters even more challenging, eDiscovery and forensics experts also need to maintain the chain of custody and make sure to never compromise the integrity of the evidence.

To answer the initial question, eDiscovery is an approach to sifting through electronically stored information (ESI) that incorporates all of the above while getting the job done in a scientifically impeccable manner. Without the help of a qualified expert to do this for them, lawyers and legal professionals would have to do it on their own (which, in practice, is often impossible due to time constraints and a lack of training in this field).

 

Phases of eDiscovery

The consensus is that eDiscovery solutions consists of 9 different phases. In practice, there may be some deviation from the norm, but it more or less boils down to a process that follows a sequential order.

Information governance

This phase is all about optimizing the process to keep the costs down. The goal is to envision the process before actually executing it to determine the best possible strategy of approach.

Identification

Are there any technical obstacles that could get in the way? Where is the evidence most likely going to be located? What volume of data are we working with? Who is in possession of the device where the sough-after data is stored? These are the questions to be asked in the identification phase of the eDiscovery forensics process.

Preservation

Too many times, data is deleted for various sorts of reasons that may or may not have malicious intent. For instance, someone might delete their digital inbox to preserve space and make room for more emails, but it could also be to hide evidence. One of the responsibilities of a computer forensics eDiscovery expert is to preserve the data they’re working with to make sure nothing is accidentally deleted, overwritten, or lost.

Collection

The data collected must be done so in a manner that is forensically sound and indisputable in court. It is NOT acceptable to alter it in any way, shape, or form – it must be presented “as is” (with a few notable exceptions such as converting it to a more easily accessible format which we’ll cover below).

Processing

By using the right software that is suitable for file conversion without significantly altering the content itself, it’s possible to convert the file into a more user-friendly and compatible format without compromising the integrity of the evidence. For example, SalvationDATA’s VIP 2.0 is an industry-leading digital video forensics software that can do this with the help of its Ultra Transcoder and Ultra Player features.

Oftentimes, the need for this arises when handling video footage and digital recordings, so it’s important for an eDiscovery forensics expert to have the right digital tools at hand.

Review

In this phase, it’s important to separate the evidence from privileged information. In case the privileged information is not necessary to be revealed to establish a point or to provide proof of X, that information should be kept away from the public eye.

Analysis

When analyzing the data collected, it’s important to present the relevant pieces in a coherent manner and give them a fitting context. eDiscovery forensics experts are tasked with pinpointing the points of interest and identifying key figures:

• Custodians
• Patterns
• Discussions
• Subjects

Thankfully, a good Big Data Forensics System that comes with Digital Forensic Lab can help you visualize the data in a coherent manner and allow you to spot the correlations with ease, all while automating a good portion of the process.

This is an advanced solution that not only takes the heavy lifting of manual work out of the equation but also improves the outcome of the analysis through greater accuracy.

eDiscovery experts love this comprehensive technology developed by SalvationDATA because it also allows them to automatically generate a detailed expert report to present their findings before the jury.

Production

This is the step to take before the material collected can be presented in court. Sometimes, it’s necessary to convert various files, documents, and other media from one format to another.

Presentation

In the grand scheme of things, only a tiny percentage of data is relevant to the legal proceedings, and it’s important to pick the most relevant pieces with care. Choose wisely, and the jury will be more likely to side with your story.

 

The role of eDiscovery in digital forensics

Among other things, eDiscovery digital forensics experts can:

• Perform paper discovery services
• Review documents
• Inspect devices
• Research
• Request documentation
• Prepare a presentation for legal proceedings
• Testify the findings in court

The objective of eDiscovery jobs and services

The process of eDiscovery is well defined and has a clear objective, which ensures full compliance with the law and maximizes the chances of a successful outcome. In fact, there are many goals eDiscovery jobs try to achieve:

Preserving the chain of custody

If the chain of custody is not preserved correctly, the opposing legal team can easily undermine the efforts of the eDiscovery team and the court may be unable to admit the evidence presented as a result. To satisfy the requirement, most modern eDiscovery tools come with an integrated chain of custody reporting features.

In addition to that, you will often find extended metadata and file fingerprinting functionality built into them.

Don’t let crucial evidence be dismissed due to a small technicality.

Finding hidden data

eDiscovery software solutions are not quite on the level of their digital forensics counterparts, but they can do a terrific job at amassing large volume of data in a small amount of time and thus using as little resources as possible to accomplish the objective. The goal is to reduce manual labor as much as possible and use smart automation to expedite the process.

Most modern eDiscovery software allows you to swiftly search the files across multiple devices by entering keywords, phrases, or search parameters. But it goes even deeper than that: with the use of metadata searching, it’s possible to do an in-depth search that goes beyond matching a file name or the contents of a message.

Annotation

Often, eDiscovery jobs involve reviewing documents, which could easily lead someone off-track and make the process non-time-efficient and non-focused as a result. However, with annotation, Annotation features can help keep the process structured and centralize information for reference.

Document annotation is synonymous with productivity.

Redaction

Any privileged information obtained during the process should be kept private, so redaction is a necessary component. However, doing it manually takes time and money, so you’ll burn through your resources pretty fast. Moreover, human beings are prone to error whereas eDiscovery software is not, so it’s vital to utilize it where possible.

File sharing and conversion

Before we can present the findings in court, we need to make sure they are in the correct format which makes the files easy to share. For this reason, many eDiscovery and digital forensics solutions such as SalvationDATA’s VIP 2.0 come with conversion features that preserve the integrity of the evidence while transcoding into a more accessible and compatible file format.

Notable differences between eDiscovery and digital forensics

Although similar in many aspects, the key difference between eDiscovery and digital forensics is that the former tends to work with easily accessible data and the latter with data that is hidden, deleted, corrupted, or obfuscated. Compared to eDiscovery, digital forensics requires more specialized knowledge and gear.

Other than that, keep in mind that:

• eDiscovery professionals typically are less experienced with technology
• eDiscovery relies on easily accessible data
• Digital forensics requires specialized training (not typically the case with eDiscovery software)
• eDiscovery services typically don’t analyze the data collected
• eDiscovery services typically don’t recover deleted or encrypted data

Both, however, are bound by the requirement to maintain the chain of custody and preserve the integrity of the evidence collected.

Conclusion

Without eDiscovery services and jobs, legal and law enforcement professionals would have to perform a significant amount of extra manual labor, many of which falls outside of the scope of their regular duties.

Due to how structured the process is, forensic electronic discovery can quickly locate the files of interest, the ones that contain evidence that is vital to the resolution of a case.