• Join our Communities!

  • Twitter Updates

    Error: Twitter did not respond. Please wait a few minutes and refresh this page.

  • Disclaimer:

    The information in this weblog is provided "AS IS" with no warranties, and confers no rights. The opinions and interests expressed on this employee blog are the employees' own and don't necessarily represent EMC's positions, strategies or views. Inappropriate comments will be deleted at the authors discretion.

Forensic Imaging – eDiscovery Overkill?

This week I had the pleasure of working with Brian Babineau from  Enterprise Strategy Group on an EMC sponsored webinar on In-House eDiscovery ROI.  During the Q&A session, an attendee asked:

“We use in-house forensic imagining tools to preserve and collect data and send it out to our outside counsel to review.  Why should we move to an in-house eDiscovery solution when this system seems to work well for us?”

I want to explore that concept a little more here because I suspect many corporations are relying solely on these tools to do eDiscovery in order to avoid taking a more focused approach that may have more upfront costs.

If you have an eDiscovery process that in your opinion works, then you should continue with it as long as that opinion is an informed one.  However, keep in mind that just because no problems have popped up yet, does not always mean that you have a good process.  It’s worth spending some time on evaluation and perhaps getting an independent consultant to verify that your process is a defensible and efficient one.

Forensic imaging will always have a part in eDiscovery but to use it as your sole means of preservation and collection may be overkill for all but the smallest of companies.  One reason is that most civil cases do not require discovery of either deleted or slack space data which are part and parcel of a forensic image.  In fact, if you collect it, you may be forced to produce what was found there, for the immediate or future case.

Brian pointed out that forensic imaging of hard drives may not be sufficient to cover the preservation duty.  If a company is only using forensic imaging tools for eDiscovery, how can they respond to requests for data residing on file shares, SharePoint or other servers?  Although it is possible to do a forensic image of an entire server, it is very time consuming and to be defensible, the server usually has to be taken offline.  This can create severe business interruption consequences to a company.

These images must then be interpreted or read by people highly trained in the technology used to capture this image.  If there is any question regarding the data gathered with this method, it is up to these people to provide affidavits, depositions and/or court testimony.  This could add a human error factor into the case.

Additionally, there is no chance of conducting early case analysis with forensic imaging.  The entire hard drive or server is imaged irrespective to what was actually requested.  By the time that data makes it into a review tool, it could be weeks before an attorney can finally lay eyes on the data to determine if the case actually has merit and make other important strategy decisions.  Outside law firms that rely on billable hours for large reviews will rarely complain about a client’s over collection with forensic tools.  However, a law firm in a more trusted advisory role will point out the inefficiency and cost of such a process and work with its client to put together a more strategic plan for in-house preservation and collection.

View Webcast Recording | View Webcast Presentation PDF

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: