Six Articles on Electronic - Craig Ball

Craig Ball © 2007
Do-It-Yourself Digital Discovery
By Craig Ball
[Originally published in Law Technology News, May 2006]
Recently, a West Texas firm received a dozen Microsoft Outlook PST files from a client. Like
the dog that caught the car, they weren’t sure what to do next. Even out on the prairie, they’d
heard of online hosting and e-mail analytics, but worried about the cost. They wondered: Did
they really need an e-discovery vendor? Couldn’t they just do it themselves?
As a computer forensic examiner, I blanch at the thought of lawyers harvesting data and
processing e-mail in native formats. “Guard the chain of custody,” I want to warn. “Don’t mess
up the metadata! Leave this stuff to the experts!” But the trial lawyer in me wonders how a
solo/small firm practitioner in a run-of-the-mill case is supposed to tell a client, “Sorry, the courts
are closed to you because you can’t afford e-discovery experts.”
Most evidence today is electronic, so curtailing discovery of electronic evidence isn’t an option,
and trying to stick with paper is a dead end. We’ve got to deal with electronic evidence in small
cases, too. Sometimes, that means doing it yourself.
The West Texas lawyers sought a way to access and search the Outlook e-mail and
attachments in the PSTs. It had to be quick and easy. It had to protect the integrity of the
evidence. And it had to be cheap. They wanted what many lawyers will come to see they need:
the tools and techniques to stay in touch with the evidence in smaller cases without working
through vendors and experts.
What’s a PST?
Microsoft Outlook is the most popular business e-mail and calendaring client, but don’t confuse
Outlook with Outlook Express, a simpler application bundled with Windows. Outlook Express
stores messages in plain text, by folder name, in files with the extension .DBX. Outlook stores
local message data, attachments, folder structure and other information in an encrypted, oftenmassive
database file with the extension .PST. Because the PST file structure is complex,
proprietary and poorly documented, some programs have trouble interpreting PSTs.
What about Outlook?
Couldn’t they just load the files in Outlook and search? Many do just that, but there are
compelling reasons why Outlook is the wrong choice for an electronic discovery search and
review tool, foremost among them being that it doesn’t protect the integrity of the evidence.
Outlook changes PST files. Further, Outlook searches are slow, don’t include attachments and
can’t be run across multiple mail accounts. I considered Google Desktop--the free, fast and
powerful keyword search tool that makes short work of searching files, e-mail and attachments--
but it has limited Boolean search capabilities and doesn’t limit searches to specific PSTs.
Non-Starters
I also considered several extraction and search tools, trying to keep the cost under $200.00.
One, a gem called Paraben E-Mail Examiner ($199.00), sometimes gets indigestion from PST
files and won’t search attachments. Another favorite, Aid4Mail Professional from Fookes
Software ($49.95), quickly extracts e-mail and attachments and outputs them to several
95