Six Articles on Electronic - Craig Ball

Craig Ball © 2007
The Path to Production: Harvest and Population
(Part III of IV)
By Craig Ball
[Originally published in Law Technology News, December 2005]
On the path to production, we’ve explored e-mail’s back alleys and trod the mean streets of the
data preservation warehouse district. Now, let’s head to the heartland for harvest time. It’s data
harvest time.
After attorney review, data harvest is byte-for-byte the costliest phase of electronic data
discovery. Scouring servers, local hard drives and portable media to gather files and metadata
is an undertaking no company wants to repeat because of poor planning.
The Harvest
Harvesting data demands a threshold decision: Do you collect all potentially relevant files, then
sift for responsive material, or do you separate the wheat from the chaff in the field, collecting
only what reviewers deem responsive? When a corporate defendant asks employees to
segregate responsive e-mail, (or a paralegal goes from machine-to-machine or account-toaccount
selecting messages), the result’s are “field filtered.”
Field filtering holds down cost by reducing the volume for attorney review, but it increases the
risk of repeating the collection effort, loss or corruption of evidence and inconsistent selections.
If keyword or concept searches alone are used to field filter data, the risk of under-inclusive
production skyrockets.
Initially more expensive, comprehensive harvesting (unfiltered but defined by business unit,
locale, custodian, system or medium), saves money when new requests and issues arise. A
comprehensive collection can be searched repeatedly at little incremental expense, and broad
preservation serves as a hedge against spoliation sanctions. Companies embroiled in serial
litigation or compliance production benefit most from comprehensive collection strategies.
A trained reviewer “picks up the lingo” as review proceeds, but a requesting party can’t frame
effective keyword searches without knowing the argot of the opposition. Strategically, a
producing party requires an opponent to furnish a list of search terms for field filtering and seeks
to impose a “one list, one search” restriction. The party seeking discovery must either accept
inadequate production or force the producing party back to the well, possibly at the requesting
party’s cost.
Chain of Custody
Any harvest method must protect evidentiary integrity. A competent chain of custody tracks the
origins of e-evidence by, e.g., system, custodian, folder, file and dates. There’s more to e-mail
than what you see on screen, so it’s wise to preempt attacks on authenticity by preserving
complete headers and encoded attachments.
Be prepared to demonstrate that no one tampered with the data between the time of harvest
and its use in court. Custodial testimony concerning handling and storage may suffice, but
better approaches employ cryptographic hashing of data — “digital fingerprinting” — to prove
nothing has changed.
85