Question

1. What issues do you anticipate attorneys having with the e-Discovery process in general, and how could a digital forensics professional help relieve those issues?

Answer 1

Answer:-

What issues do you anticipate attorneys having with the e-Discovery process in general,

1. Stop Notice As soon as parties become aware of the possibility of Irish litigation they are under an obligation to the Court to preserve relevant evidence. This extends to preserving electronic data and other documents. Such documentation should be secured at the first sign of a possible claim. Clients and their lawyers must act as early as possible to retain and preserve any documents that appear likely to be necessary or relevant in the dispute. This extends to both hard copy and electronic files and includes a consideration of all possible repositories, such as back up tapes, decommissioned servers, hard drives of departing employees and information in other media. Parties should take a broad view at an early stage in determining what documents should be preserved. They may not know exactly documents will be relevant and necessary as the issues in dispute may not crystallise until later

2. Early assessment of size/numbers of documents From an organisational perspective it is important to assess the size, number and type of documents held that may be responsive. A rigorous scoping process involving the client, its management and IT function and the legal advisors is essential to ensure that the project is undertaken properly and also cost effectively. External IT forensics expertise will be invaluable at this stage in large cases.

3. Categories of documents In Ireland a party seeking discovery must identify the categories of documents sought and give reasons to justify their relevance and the need for their disclosure. The party furnishing discovery will try to narrow the categories as much as possible, limiting them by reference to certain dates etc. By contrast the party seeking discovery will seek to make the categories as broad as possible

4. Custodians The importance of identifying potential document custodians is particularly important in the context of ESI. This is especially important if the litigation involves a large transaction, has an international dimension or if a large number of stakeholders in an organisation are involved. Emails are frequently sent to multiple recipients many of whom may only have a peripheral involvement

5. Key words A key word search can be used to electronically filter a large volume of data so as to identify documents requiring disclosure. For example, you can identify all emails passing between key protagonists or between certain dates or in which certain terms appear. This technique avoids the need to review other data which is likely to be irrelevant. However, care is required in selecting the key words

6. Document Review The process of reviewing documents is critical and can be expensive depending on the volume and complexity of the documentation involved, especially with electronic data. The review will generally be undertaken or supervised by lawyers who will review the hard copy and electronic data to determine whether it is required to be disclosed or whether it is irrelevant. Other documents may be exempt from disclosure on grounds of legal privilege

how could a digital forensics professional help relieve those issues?

Digital Forensics and eDiscovery professionals help our clients navigate the legal and business processes mandated by critical events—such as disputes, enforcement matters, cyber breaches, investigations, litigation and whistleblower allegations. We help you plan for and anticipate expectations, draw insight from your data and make informed decisions under pressure. That’s what we mean by clarity and confidence in crisis.

• Automatically stored data, for instance, a file that was purged from the server and its copy still exists on the hard drive of the user.
• Files that were deleted by the user and not destroyed. These files stay on the hard drive until they are wiped or overwritten.
• Ghost data which is not readily accessible but recoverable.
• System data which gives an electronic trail of all the activities performed on the computer or the network.
• If wiping software was used on the computer to wipe data, then it can be detected using computer forensic software.