Six Articles on Electronic - Craig Ball

Craig Ball © 2007
for entire operating systems and common applications like Microsoft Windows or Intuit’s
Quicken, culls huge chunks of patently irrelevant files from consideration without risk of
overlooking relevant information excluded based on location or file extension. Hashing thwarts
efforts to hide files by name change or relocation because hash-matching flushes out a file’s
true nature--so long, that is, as the contents of the file haven’t changed.
Bates Numbering
Hashing’s ability to uniquely identify e-documents makes it a candidate to replace traditional
Bates numbering in electronic production. Though hash values don’t fulfill the sequencing
function of Bates numbering, they’re excellent unique identifiers and enjoy an advantage over
Bates numbers because they eliminate the possibility that the same number might attach to
different documents. An electronic document’s hash value derives from its contents, so will
never conflict with that of another document unless the two are identical.
Authentication
I regularly use hashing to establish that a forensically sound duplicate of a hard drive faithfully
reflects every byte of the source and to prove that my work hasn’t altered the original evidence.
As e-discovery gravitates to native production, concern about intentional or inadvertent
alteration requires lawyers to have a fast, reliable method to authenticate electronic documents.
Hashing neatly fills this bill. In practice, a producing party simply calculates and records the
hash values for the items produced in native format. Once these hash values are established,
the slightest alteration of the data would be immediately apparent when hashed.
De-duplication
In e-discovery, vast volumes of identical data are burdensome and pose a significant risk of
conflicting relevance and privilege assessments. Hashing flags identical documents, permitting
one review of an item that might otherwise have cropped up hundreds of times. This is deduplication,
and it drastically cuts review costs.
But because even the slightest difference triggers different hash values, insignificant variations
between files (e.g., different Internet paths taken by otherwise identical e-mail) may frustrate deduplication
when hashing an entire e-document. An alternative is to hash relevant segments of
e-documents to assess their relative identicality, a practice called “near de-duplication.”
Here’s to You, Math Geeks
So this Thanksgiving, raise a glass to the brilliant mathematicians who dreamed up hash
algorithms. They’re making electronic discovery and computer forensics a whole lot easier and
less expensive.
112