Print This Article

Mark Sableman – A lot of great stories arise on the forensics side – when experts dig up embarrassing material that the writer thought had been deleted or hidden or never recorded. But I really think the forensics finds are a small part of electronic discovery, and most of the good stuff comes when you are persistent at going after the modern electronic equivalents of paper records – e-mails, e-mail attachments, and drafts of important operative documents. In a software case recently, our adversary did everything it could to avoid producing all of its internal e-mails. We persisted, took special discovery about their backups and system, and eventually obtained what we wanted. The internal e-mails were full of revealing admissions – the boss’s directive to “bill, bill, bill” on what was supposed to have been a fixed-fee contract, internal tests proving that the product couldn’t meet our client’s specifications, and an e-mail exchange where a sales rep asked a project manager to create a misleading project budget. The lesson is that if only you are persistent, and have the tools you need to get through huge electronic files, will you find gems in electronic discovery.

Craig Ball – Early in the Enron debacle, I was hired to observe as Andersen’s attorneys made a nationwide sweep to collect and preserve digital evidence. In Chicago, they opened a storeroom and proudly showed neatly wrapped and tagged Palm handhelds surrendered by Andersen employees. PDA’s lose their data when they lose power, so I asked, “How are you going to keep the batteries charged?” Oops. They hadn’t thought of that. In two or three weeks, that evidence would have been lost forever. Instead, they had to quickly arrange to keep all these gadgets charged. That may be my sole contribution to the Enron effort, but it makes the point that digital is different and we can’t treat it like paper. Most of my stories involve the astounding stuff I find on workplace hard drives, but I can’t share them, except to wonder, “Does anyone work anymore, or is the entire business day spent watching porn and surfing the ‘Net?”

David Goldstone – I have a couple. First, my all-time favorite example involved a fraud case where we found that, in addition to the core fraud in the case, the other side had been making additional false statements under an assumed identity in various Internet forums in order to promote the core fraud. By forensic analysis of the individual's hard drive, we could show that it was he who had made these false statements. The effect of showing the additional false statements under an assumed name was simply devastating.

Another example: I once worked on a matter where one of the other parties converted their electronic files into a non-searchable format for production, even though producing the documents in a searchable format would have been no extra cost to them. They thought that not letting the other side search the documents would give them some kind of a strategic advantage. When the other side found out, they were furious. The producing party's argument was, "Paper isn't searchable, and that is how productions have been made in the past, so we are not providing that capability." This argument didn't get them very far. Ultimately, they had to produce the documents in a searchable format, and they had lost an enormous amount of goodwill.

Lee Neubecker – In a medical malpractice case that has settled, there was a claim made by the physician that a CD-ROM produced was an authentic copy of a medical procedure performed years previously. One of the medical image movie clips was deleted. The remaining clips that followed the deleted clip were renamed by the physician in an attempt to hide the deletion. The physician was caught red handed by our forensic review. Not only were we able to determine that the CD-ROM had just recently been created, but we were also able to prove the CD-ROM as being a fraud by examining the internal Meta data of the file as well as the dates and time stamps in a compelling way. The case quickly settled after we gave our deposition.

Alex Lubarsky – There are so many out there, but I would still have to say the one where the settlement offer came in as an e-mail attachment in Word from opposing counsel and the recipient law firm was able to open it up, track changes, show revisions and watch the settlement offer rise and fall over several revisions... allowing the recipient party to know just where them million dollar pressure points were. Word to the wise, strip your meta data, convert to .pdf and before hitting that ominous send button... or use the trusted "snail" mail when getting busy an the bargaining table.

Denise Howell – My colleague Morgan Tovey was trying a case on behalf of FareChase against American Airlines in Texas. He discovered a key bit of electronic information on the fly in the courtroom, just in time for a devastating cross-examination, as reported by the Star-Telegram on2/17/03:

"You've probably never thought about buying a ticket for Southwest Airlines on American Airlines' Web site.

But in a Tarrant County district courtroom last week, lawyers for FareChase, a New York software firm, proved that you could do just that.

American Airlines is suing FareChase for using a software program that surveys airline Web sites and aggregates the fare and schedule information on the FareChase site. American says FareChase is taking its private property.

During a temporary injunction hearing Thursday, AA.com's managing director, Scott Hayden, testified that his company would never use another Web site's content without its permission and would stop immediately if it learned that American did not have permission.

Hayden also said that American would not display another site's content with an American frame around it.

But on cross-examination by FareChase attorney Morgan Tovey, Hayden was shown evidence that American does that with its corporate Web site. On AMR.com's press room is a link to a popular Internet search engine, Google.com. Tovey asked a courtroom technician to use that search to locate Southwest.com.

'We're looking at something rather odd,' Hayden said as the Web site was projected in the courtroom.

The odd thing the courtroom was looking at was Southwest's Web site, framed by AMR's logo with a large American Airlines plane at the top of the page. The sight of the American Airlines plane looming over a smaller Southwest plane elicited chuckles from the courtroom gallery.

Tovey then asked Hayden if it would be possible to buy a Southwest Airlines ticket from the site, and Hayden reluctantly responded that it would be.

A check of AMR's press-room Web site Friday revealed a change. Now, Southwest's site launches into a separate window unframed by American."

Kristin Nimsger – Kroll Ontrack received a panic-stricken call requesting immediate assistance from a law firm representing a Fortune 100 corporation that had struck a deal to acquire one of its major industry competitors. Upon filing notice of the merger under the Hart-Scott-Rodino Antitrust Improvements Act (HSR) the FTC issued a Request for Additional Information, better known as a “Second Request.” The situation:

The “Second Request” sought corporate data that was spread over 11 geographic locations, including several sites in South America and Asia.

Data responsive to the request came from a total of 265 employees in the acquiring corporation.

The data had been generated on a wide array of operating systems, e-mail packages, and software applications. A portion of the data was even from Macintosh systems, which is challenging for any e-evidence expert!

Kroll Ontrack engineers were dispatched to retrieve the needed data. The data was captured in less than one week from the time of the firm’s initial phone call. Throughout the project, data from newly identified individuals came to us, primarily on CD-ROM. The project spanned a total time of three weeks and resulted in approximately 4.3 million pages of responsive documents — amounting to about 1,400 boxes when it was finally printed and produced to the FTC. Without filtering and deduplication, it was estimated that the production would have generated approximately 2,000 – 2,500 boxes of data.

Skip Walter – My current favorite was actually just published in LJN’s Legal Tech Newsletter. Jones Day had planned for the review and production of approximately 35 GB of data, mostly e-mail and office documents. They had agreed with the other side to start deliver rolling productions in four weeks. Unfortunately, the original estimates were off, additional custodians were added to the mix and “oh, by the way, what about these backup tapes?” Suddenly they were looking at about ten times the data, which could cost about ten times the calendar time and expense. Fortunately for Jones Day, they were not using a traditional electronic discovery approach. Because they were using Attenex Patterns, they were still able to complete their review on time and at a fraction of the cost of a traditional approach. What this story captured was the value of productivity. Prior to their use of Attenex Patterns, Jones Day estimated that a reviewing attorney could make between 250 and 300 document decisions per day. In their first matter using Attenex, they documented attorneys achieving 2000 or more document decisions per day. That ultimately saves the client both time and money. The complete story can also be downloaded from our Web site at http://www.attenex.com/pdf/LJN-AttenexPatterns.pdf.

Chris Paskach – In a recent KPMG-Attenex engagement, a large consumer products company was defending itself in a product liability matter. Faced with the discovery request to acquire the hard drives of over 100 sales personnel — as well as on-site paper and electronic data collection from three different office locations — the client needed an integrated approach to their discovery response. Had the client used a traditional approach and converted all of the resultant data — both responsive and non-responsive — to TIFF, the client would have spent between $700,000 to $1 million after the data collection phase alone. At the end of this process, the client would have selected meta data information and Boolean key-word search capabilities for loading into a standard discovery management tool.

Using the KPMG-Attenex model, however, the initial review was done in native file format and processed using the Attenex Patterns software. This approach provided a cost savings of over $300,000 when compared to simply converting responsive and non-responsive data to TIFF or PDF before an initial review. Further, by using the hosted, remotely accessible Attenex Document Mapper software to have a visual overview of their data and cluster similar documents together, the review team was able to quickly identify non-relevant information such as jokes, office pools and the like, and hone in on the relevant information. Upon completion of the initial review, only the 10 percent to 15 percent of the documents deemed responsive for production were converted to TIFF and subsequently produced.

Chris Kruse – One of our clients was served with a government subpoena. They had over 680 potentially responsive backup tapes that were created and stored in locations across the country. Worse, many of the tapes were mislabeled or not labeled at all! In addition, they had e-mail files located on PCs and servers throughout their network. They were required to provide access to multiple reviewing parties including government agencies, counsel for both sides and individual counsel. We worked with defendant’s counsel to limit the scope of the document request, reducing the number of responsive items to about 150 backup tapes containing 7 TB of data. After restoring the files, de-duplicating the data set across the entire document population and limiting the data set to the specified scope, the data set for review was ultimately reduced to about 650 GB, over a 10 times reduction, and the pile of mislabeled backup tapes was brought totally under control.

Michael Kraft – A 120 attorney firm with a fairly small litigation practice decided to research and implement a proper litigation support system and carefully picked a handful of small cases as trials. These were cases that could easily have been handled without the technology. They used them as training ground to test and learn how the technology and the various vendors worked. They did this knowing that if they had to, they could always do the work the old fashioned way. They also picked cases that were not time sensitive. This gave both, the paralegals and the IT staff time to train and to come up to speed on the selected tools and what they could do. Since the cases were small, the firm’s investment into the technology was very modest and it was considered an investment. Lo and behold ... about a year later, the "10 year storm" hit. A very big case came in the door. Since the firm had been through the whole cycle multiple times before, they knew precisely which vendor to send the job to , what tools they would use, what they would and what they would not rely on the existing technology to do for them. It was like seeing an insurance policy pay off when you most need it. Their investment had been returned in spades.

Art Smith – Favorite electronic discovery? Most of the stories are horror stories, too gruesome for children and readers of this article.

Mark Yacano – I would not dare call this my favorite electronic discovery story, but it is certainly the most interesting electronic discovery story I have encountered. For a large document review project involving an international client engaged in multi-district products liability litigation, the electronic discovery vendor harvested several million pages of electronic documents from the company’s European headquarters. The data was converted to TIFFs for review in a document management database. Approximately 25 contract attorneys reviewed and coded the e-discovery collection for responsiveness and privilege, as they previously had done for the multi-million page paper collection, which was also imaged for review. One day, I noticed that there was an unusually large amount of whispering, hushed laughter and “document consultation” among the reviewers. I quickly learned the source of my contract attorneys’ heightened focus: PORN! And lots of it. As it turns out, the e-discovery vendor filtered the harvested data by searching for certain product numbers, as requested. And, by coincidence, the product numbers matched the meta data for most jpeg images, i.e. porn, in the company’s e-mail system. As an aside, I never have had a team of contract attorneys so motivated and committed to their work. They arrived to work early, stayed late and never complained. Until, at last, even reviewing porn became monotonous.

Sharon Nelson / John Simek – This is our favorite "there's justice after all" story. We represented a wife accusing of e-mailing her ex-husband some absolutely horrendous messages, which caused her to lose custody of her son. She was adamant that she never sent those e-mails and, of course, the logical suspect was her ex-husband. Her attorney successfully argued that his personal computer should be turned over to us for forensic examination and the court ordered him to give us possession of his computer by 6 p.m. the same day. He duly appeared with a computer, but as it turned out, this very sleazy guy deliberately brought us the "wrong" computer, one which we quickly determined that he had ceased using some months back. Needless to say, none of the e-mails in question were on that machine. We were stymied, and furious at the abuse of judicial process.

On a hunch, and remembering that we ourselves had created a "test" message the first time we experimented with spoofing e-mail addresses, we looked for a "test" message. Through pure luck and our hunch, there it was, a nugget of electronic gold. He had created a test message using his ex-wife's e-mail address and sent it to himself to verify that it worked prior to sending all the other "hate" messages. The judge was incensed and the wife regained custody of her son. We like happy endings.

Virtual Roundtable Discussion Continued:
« Previous 1 2 3 4 5 6 Next »