Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
forgery, the author and addressee are there in black-and-white. But, digital is different.
Computer-generated documents all have metadata associated with them. That is, data about
data, information outside the body of the document that conveys such things as when the
document was created or modified, its author, electronic format, file size and more.
Moreover, the creation of an electronic record often engenders the creation of a host of other
records, some, like back up files or prior versions, the users knows about and some, like log,
spool and swap files, the user may never imagine exist. Computers have also facilitated the
recording of communications that not long ago would never have been reduced to writing. E-
mail now stands in for conversations that would have been phone calls or water cooler
chitchat a few years ago. The end result is that discoverable information exists in new
planes, not only a broader swath of data, but a deeper level as well.
An exponential increase in discoverable volume is not the only challenge, nor is it the most
difficult to resolve. A greater hurdle stems from the manner in which computers retain and
dispose of information. Can you imagine a business that managed all its records and
transactions—personal, professional, intimate, recreational, confidential and privileged--by
dumping one and all into a big bin? How about a lawyer dumping every scrap of paper in her
life--wills, bills, stills, frills and thrills--in a giant folder labeled “Stuff?” It’s hard to image that
level of incompetence, but we’d certainly expect that such malfeasance--commingling client
materials with personal and third party stuff--would hobble claims of privilege or
confidentiality. Yet, that’s what a computer routinely does in its management of swap files, e-
mail folders and the web surfing cache, to name just a few problem areas.
If that’s not bad enough, the computer is a trash can without a bottom! You try to tidy up by
deleting files and the computer just hides them (or pieces of them) from you, squirreling data
away like acorns, willy-nilly, across a vast expanse of hard drive! Is it any wonder that trying
to makes sense of this mess is expensive?
Lawyers frequently approach e-discovery as they’ve always done with paper records. But
we’ve had thousands, of years to master the management of paper records, and the innate
physicality of a writing means it’s easier to track, isolate and, ultimately, destroy. Digital is
different, and, while the rules of procedure and evidence may prove sufficiently flexible to
adapt to a virtual world, some in the bench and bar loathe straying far from their familiar,
paper-based systems. Inflexibility boosts the cost of electronic discovery, through, inter alia,
the use of tortured definitions of “document” in discovery requests, impossibly overbroad
production demands, compulsory “blow back” of native digital data to paper printouts (with
the attendant loss of the metadata layer). More costly still is the practice of reducing data to
a page-like format to facilitate privilege review. When even a modestly-sized hard drive can
easily generate a million “pages” of documents and a server, tens- or hundreds of millions of
pages, there are simply not enough eyeballs that can be placed in front of enough desks to
complete the job in the customary fashion. Because digital is different, we must change as
well.
Page 43