Discovery conferences are an old topic. Where there is evidence, there must be discovery. The question, however is what kind of discovery do you need? It is safe to say that the days of banker’s boxes of paper files are on the decline. The days of electronic storage and cloud storage, however, are a completely different story.
Many people confuse the disciplines of e-discovery and forensic discovery. In fact, there are many ESI practitioners that can’t seem to delineate the differences. So, let’s begin with an easy rule of thumb – e-discovery deals with what visibly exists, and forensic discovery deals with things that may have been deleted, hidden, encrypted or destroyed.
We have all heard the 5W approach of who, what, when, where, why, (and arguably “how”) with respect to accurately determining the facts of a case. In the same way that you wouldn’t be satisfied with “Colonel Mustard hung Mr. Body last Saturday night in the ballroom with a rope because he was being blackmailed,” we cannot be satisfied with someone telling you “My client didn’t do it, and here is a picture of a fax of their unsigned affidavit saying so.”
This is why discovery is so important.
When the world was full of ribbon typewriters, and mimeograph machines, advanced forensics looked at typewriter ribbons and carbon paper for clues as to what occurred. In the days of high technology, however, things are not quite that simple. The first place to start is to determine what it is you are looking for. This is an area that I must leave to legal minds – however, once past that, we need to examine where things of interest might be. The obvious ones are office computers, mail systems, laptops and mobile phones. The not so obvious ones are flash drives, cloud accounts, portable music devices, tablets, DVDs, and various personal devices that may have been used to store corporate data. This may also include computers that are “family” computers that the custodian may have used, or even GPS units in automobiles.
There is so much data in so many places, how can one be certain of where things of interest are? We don’t want to look at everything; that would be overreaching and unnecessarily expensive. Instead, this is where the attorney must determine that “what” and the likely “where.” It would not be a bad idea to contact your IT expert to assist in the likely “where.”
A word about your IT Expert. Are they qualified to be an expert should the case go to court? We have seen small cases rapidly become big cases, and the “evidence” collected by the IT expert was so poorly done, it could not be entered as evidence. Be cautious whom you choose.
Every case is different when it comes to evidence, because the “where” can vary dramatically depending on the circumstance of the case. Because of that, there is the question of which method of discovery is required. The predominant choices are e-discovery and forensic discovery. As we stated earlier, e-discovery is the examination of various types of media to cull documents and associated metadata that is responsive to a request for discovery. forensic discovery is the search for data and associated metadata that may have been deleted, destroyed, obfuscated, encrypted, hidden, or altered.