Six Articles on Electronic - Craig Ball

Craig Ball © 2007
• E-mail in forensically accessible areas of local hard drives
Deleted e-mail
Internet cache
Unallocated clusters
The issues in the case, key players, relevant times, agreements between the parties and orders
of the court determine the extent to which locations must be examined; however, the failure to
identify all relevant e-mail carries such peril that caution should be the watchword. Isn’t it wiser
to invest more to know exactly what the client has than concede at the sanctions hearing the
client failed to preserve and produce evidence it didn’t know it had because no one bothered to
look for it?
What’s more, thorough identification of both accessible and inaccessible electronically stored
information isn’t just sound practice; it’s a tenet of federal procedure. Effective December 1,
2006, the Federal Rules of Civil Procedure require a party to provide, without a discovery
request, “a copy of, or a description by category and location of, all documents, electronically
stored information, and tangible things that are in the possession, custody, or control of the
party and that the disclosing party may use to support its claims or defenses, unless solely for
impeachment.” FRCP Amended Rule 26(a)(1)(B) [emphasis added]. Amended Rule
26(b)(2)(B) requires a party to identify electronically stored information [ESI] it deems “not
reasonably accessible because of undue burden or cost.” The commentary to the new Rules
makes clear that the duty to identify attaches to every item of potentially responsive ESI:
“The responding party must also identify, by category or type, the sources
containing potentially responsive information that it is neither searching nor
producing. The identification should, to the extent possible, provide enough detail
to enable the requesting party to evaluate the burdens and costs of providing the
discovery and the likelihood of finding responsive information on the identified
sources.”
FRCP, Comments to Amended Rule 26, subdivision (b)(2).
Preservation
The duty to preserve potentially relevant evidence is generally triggered by the anticipation of a
claim. Fulfilling a preservation duty with respect to e-mail is made harder by the control reposed
in individual users, who establish quirky folder structures, commingle personal and business
communications and—most dangerous of all—control deletion and retention of their messages.
Individual users who may hold responsive ESI must be directed to retain all potentially relevant
messages and be furnished sufficient information at appropriate intervals to assess relevance
consistently. You’ve got to guard against human frailty in your preservation strategy, so don’t
leave the fox guarding the henhouse. Act promptly to protect data from spoliation at the hands
of users most inclined to sweep it under the rug.
Consider the following as parts of an effective e-mail preservation effort:
• Litigation hold notices to users, including clear, practical and specific retention
directives
Notices should remind users of relevant places where their email may reside
Be sure to provide for notification to new hires and collection from departing
employees
• Suspension of “retention” policies that call for purging email
11