Digging for e-data - Kroll Ontrack

Digging for e-data i
Kristin M. Nimsger ii
You won’t find ‘electronic evidence’ and ‘e-discovery’ in the latest edition of Black’s
Law Dictionary. Knowing what they are and how to use them may save your client’s
case, and your practice.
Plaintiff lawyers with busy trial practices often operate in a head-down, shoulder-to-thegrindstone
fashion. Managing a heavy caseload plus an office can take so much energy
and time that keeping up with litigation trends may seem impossible. If this sounds like
you, you probably haven’t examined both the promise and the peril that electronic
evidence can hold for your clients’ cases: You may be setting them up for a fall and
putting yourself at risk for a malpractice claim.
In 2001, businesses in North America sent an estimated 2.5 trillion e-mail messages,
expected to grow to 3.25 trillion in 2002. iii Ninety-three percent of all business
documents are created electronically, iv and most are never printed. v But that doesn’t mean
copies aren’t being made. Almost all businesses and many individuals have learned the
importance of backing up electronic data regularly—even daily. The result: copies upon
copies of electronic evidence that may be relevant in litigation.
Let’s say you suspect a defendant has electronic data that could help your client’s case.
How do you get access to it? If you don’t know, you may miss out on critical evidence.
Or let’s say your client receives a request to produce electronic data that is clearly
discoverable. vi How do you proceed? What if your client routinely deletes or writes over
data? How do you protect the client from committing spoliation by unwittingly erasing or
destroying electronic evidence relevant to pending litigation—and consequently risking
sanctions, including dismissal of the complaint or default judgment on a counterclaim?
Heads up: It’s time to learn what you need to know about electronic evidence to protect
your clients’ interests and avoid the potentially catastrophic results of ignorance and
inaction.
Getting the e-goods
E-discovery can produce a treasure trove of evidence. The discovery of just one e-mail
message can transform a contentious legal battle into settlement discussions. For
example, in Linnen v. A.H. Robins Co., the family of a woman who died after taking the
diet pill combination of the prescription drugs fenfluramine and phentermine (known as
fen-phen) sued the drugs’ makers. The plaintiffs claimed the drugs, taken in combination,
caused the woman to develop a deadly lung disorder. vii Computer forensic engineers hired
by the plaintiffs were able to recover an e-mail from one A.H. Robins employee to
another that read: “Do I have to look forward to spending my waning years writing
checks to fat people worried about a silly lung problem?” viii Shortly after this revelation,
the case settled.

Linnen is not an isolated case. E-mail and other types of electronic evidence are at the
center of many well-publicized lawsuits. For example, in the Bridgestone/Firestone
multidistrict litigation concerning allegedly defective tires on Ford Explorers, the court
has ordered specifically how electronic evidence will be handled. ix
So what do you do when you think e-evidence may be central to your case and it’s in the
hands of the defendant? First, look to the federal rule governing initial disclosures—
Federal Rule of Civil Procedure 26. Because jurisdictions may no longer “opt out” of the
disclosure requirement, attorneys must address the impact of this rule on electronic
evidence. x Even if a case is in state court, this rule and other relevant federal rules
discussed below may apply because state rules often mirror the federal rules. Some states
(for example, California and Texas) have special rules addressing electronic evidence.
Federal Rule 26(a)(1)(B) specifically requires the disclosure of “data compilations” (for
example, electronic files, databases, and e-mails) after a full investigation of the case.
This imposes a duty on attorneys to identify all sources and locations of electronic data in
their clients’ possession. xi
Data will commonly be located on desktop and laptop computers, network hard drives,
removable media (like floppy disks, tapes, and CD-ROMs), and, increasingly, personal
digital assistants like the PalmPilot. Data may also be in the possession of third parties,
including Internet service providers and other peripherally involved entities.
Determining how much e-mail and other electronic data is in a defendant’s control can be
difficult without the assistance of an experienced electronic discovery expert. However,
this information is essential for compliance with Rule 26(f), which requires all parties to
meet to discuss a discovery plan. To do this, attorneys will need to understand how their
client’s information systems create, store, and destroy electronic evidence. If the
defendant has not produced this information, you can ask the court to compel compliance
with the rule.
Under Rule 26(a)(2), the parties must also disclose the identities of their e-discovery or
forensic experts, or risk not being able to call them to testify at trial. Obviously, any
person who has performed a forensic analysis of the parties’ hard drives or other systems
falls within the scope of this rule. The more interesting issue is whether one must disclose
the identity of an expert who handles the collection and reproduction of electronic data
without conducting any sort of forensic analysis. These experts clearly possess the kind
of “scientific, technical, or other specialized knowledge” contemplated by Federal Rule
of Evidence 702.
After the Rule 26 disclosures, you can acquire more in-depth information through a
combination of traditional discovery tools: interrogatories, requests for production of
documents, and depositions. xii The Rule 30(b)(6) deposition is an excellent tool for
obtaining more information about the layout of the defendant’s computer system to guide
further discovery. If the defendant is a company, depose the person who would have the
most knowledge of:

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
the number, types, and locations of computers currently in use and no longer in
use.
the operating systems and application software the company is using, including
the dates of use.
the company’s file-naming and location-saving conventions.
disk- or tape-labeling conventions.
backup and archival disk or tape inventories or schedules.
the most likely locations of electronic records relevant to the subject matter of the
case.
backup rotation schedules and archiving procedures, including any backup
programs in use at any relevant time.
electronic-records-management policies and procedures.
corporate policies regarding employee use of company computers and data.
the identities of all current and former employees who have or had access to
network administration, backup, archiving, or other system operations during the
relevant period.
Once you have this information, you can refine your discovery requests to obtain relevant
data from the locations and systems identified in the deposition. Under the amended
Federal Rules of Civil Procedure, requests for electronic data should be carefully crafted.
A request for “all electronic data” will likely result in an objection based on burden or
expense, and courts have been inconsistent on how deeply they will allow a discovering
party to dig. xiii Therefore, discovery requests must be specific and exhibit an
understanding of how electronic data are created, stored, and destroyed.
The particular type of electronic data in the defendant’s possession that you may want to
look at will vary depending on the issues in controversy. However, you should consider
the following categories of evidence when crafting your requests for production:
•
e-mail (sent, received, or drafted) and corresponding dates, times, recipients, and
file attachments
word-processing files
tables, charts, graphs, and database files
electronic calendars
proprietary software files
Internet browsing applications (bookmarks, cookies, history log).
After you have collected these data, e-evidence experts using the latest technology can
drill down through the layers of information to find the most salient tidbits relating to the
issues in your case. For example, the data can be mined to locate files created by a certain
user, having certain file extensions, created within specific dates, or containing relevant
keywords. Computer forensic tools can even restore deleted e-mails or files.
One of the most useful electronic-discovery management tools may be the pretrial
conference required by Federal Rule of Civil Procedure 16. As with the Rule 26(f)
meeting on discovery, both parties should be prepared to provide the court with expert

testimony regarding the nature, location, and volume of electronic data, as well as the
time and cost involved in producing it. Doing so will help limit the scope of discovery
required from your client while maximizing the disclosures that are required from the
defendant.
Topics for discussion at the Rule 16 conference may include preservation of evidence
(including whether backup, archival, and deleted files will be exchanged), preliminary
disclosures as to the parties’ computer systems (including numbers, types, and locations
of computers, operating systems in use, and backup schedules), document-processing and
production formats, testifying experts, cost allocation, and anticipated evidentiary
disputes. The conference can be used to your client’s advantage to gain an understanding
of the defendant’s electronic records management procedures or, at the very least, to
gauge the degree to which the defendant is prepared to address electronic evidence in
your case.
Avoiding pitfalls
Spoliation claims are usually leveled at a defendant, but many a plaintiff has lost a case
before it was filed by failing to preserve relevant evidence. Defendants are increasingly
pursuing e-evidence from plaintiffs—like personal e-mail saved on home computers,
information stored on personal digital assistants, and cell phone logs—so you must
caution your clients to beware the consequences of failing to adequately preserve
electronic data in their possession.
Unlike paper documents, which require an overt act like shredding to be destroyed,
electronic data can be and often are destroyed by routine computer use. Simply turning
on a personal computer can destroy “slack” and “temporary” files, cause data to be
overwritten, or alter metadata (for example, data showing when a file was created or
modified). Clicking on a file can change its “last-accessed” date, inviting a suggestion
that it has been altered. xiv
You can help your clients protect themselves against a potential spoliation accusation and
its consequences by telling them to immediately halt all electronic document-handling
policies that result in the recycling of potentially relevant tapes or other e-data
destruction. An e-discovery expert can help explain which policies or actions are
potentially harmful.
Consider suggesting that the data on the client’s hard drive be preserved using mirrorimaging
technology, available from most reputable e-discovery and computer forensics
experts. This freezes the data like a snapshot. This is especially helpful if the client is a
company that employs many computer users, because it avoids having to train each
employee in e-data preservation and allows work to continue on the company’s
computers even with a preservation order in place. xv Data preservation issues arise mostly
in business tort lawsuits; however, plaintiff lawyers should also be aware of proper
preservation protocols to ensure that their corporate opponents are using the best
practices when preserving key data.

Another potential pitfall for plaintiff attorneys whose clients have relevant electronic
documents is inadvertent production. A critical aspect of any digital discovery plan
addresses the potential for inadvertent waiver of privileged information. Plaintiffs can
take the lead on this issue by gaining an agreement or a court order in advance of
discovery stating that the inadvertent disclosure of a privileged document does not
constitute a waiver of privilege, that the privileged document should be returned, and that
any notes relating to the document or copies of it made by an opponent will be destroyed.
With 70 percent of all written data now stored in electronic form, xvi gone is the day when
an attorney is likely to find the “smoking gun” document in a box located in a remote
storage facility. Plaintiff lawyers who continue to ignore this reality risk defeat for their
clients and damage to their reputations. Those who take the time to learn what e-evidence
is, how to find it, and how to use it will increase their chances of uncovering the
information that wins the case.
i Reprinted with permission of TRIAL (January 2003). Copyright the Association of Trial Lawyers of America.
ii Kristin M. Nimsger is the electronic evidence project line manager at Kroll Ontrack, Inc., in Eden Prairie, Minnesota.
She can be reached at knimsger@ krollontrack.com.
iii Elizabeth Weinstein, Help! I’m Drowning in E- Mail, WALL ST. J., Jan. 10, 2002, at B1, available at
http://webreprints.djreprints.com (last visited Nov. 20, 2002).
iv KEVIN CRANE, DESIGNING A DOCUMENT STRATEGY (2000).
v Lori Enos, Digital Data Changing Legal Landscape, E-COMMERCE TIMES, May 16, 2000, at
www.ecommercetimes.com/perl/story/3339.html.
vi Simon Prop. Group v. mySimon, Inc., 194 F.R.D. 639 (S.D. Ind. 2000); Linnen v. A.H. Robins Co., No. 97-2307,
1999 WL 462015 (Mass. Super. Ct. June 16, 1999); Playboy Enters., Inc. v. Welles, 60 F. Supp. 2d 1050 (S.D. Cal.
1999); Anti-Monopoly, Inc. v. Hasbro, Inc., No. 94 Civ. 2120, 1995 WL 649934 (S.D.N.Y. Nov. 3, 1995); Crown Life
Ins. Co. v. Craig, 995 F.2d 1376 (7th Cir. 1993); Santiago v. Miles, 121 F.R.D. 636 (W.D.N.Y. 1988); Bills v.
Kennecott Corp., 108 F.R.D. 459 (C.D. Utah 1985).
vii Linnen, No. 97-2307, 1999 WL 462015.
viii ALICIA MUNDY, DISPENSING WITH THE TRUTH (2001).
ix See In re Bridgestone/Firestone, Inc., Tires Prods. Liab. Litig., No. MDL 1373 (S.D. Ind. Jan. 30, 2001), at
www.insd.uscourts.gov/firestone/bf_docs/93730480.pdf (last visited Nov. 20, 2002).
x Before the Federal Rules of Civil Procedure were amended in 2000, Rule 26 contained a clause allowing individual
districts to opt out of the initial disclosure requirement.
xi Kleiner v. Burns, No. 00-2160-JWL, 2000 WL 1909470 (D. Kan. Dec. 15, 2000).
xii Sample electronic-discovery interrogatories can be found at
http://www.krollontrack.com/practicaltools/interrogatory_mailer.pdf.interrogatory_mailer.doc.
xiii Playboy Enters., Inc., 60 F. Supp. 2d 1050; Van Westrienen v. Americontinental Collection Corp., 189 F.R.D. 440
(D. Or. 1999); Symantec Corp. v. McAfee Assoc., Inc., No. C-97-20367-JF (EAI), 1998 WL 740807 (N.D. Cal. Aug.
14, 1998); Fennell v. First Step Designs, Ltd., 83 F.3d 526 (1st Cir. 1996).
xiv In re Prudential Ins. Co. Sale Practices Litig., 169 F.R.D. 598 (D.N.J. 1997); Proctor & Gamble Co. v. Haugen, 179
F.R.D. 622 (D. Utah 1998).
xv Gates Rubber Co. v. Bando Chem. Ind., 167 F.R.D. 90 (D. Colo. 1996).
xvi See CRANE, supra note 2.