Electronic Discovery Navigator

Guidance Software Unveils Top 10 eDiscovery Best Practices for Handling Metadata

Guidance Software Unveils Top 10 eDiscovery Best Practices for Handling Metadata

"Guidance Software Inc. (NASDAQ:GUID), the World Leader in Digital Investigations™, today announced the Top 10 eDiscovery Best Practices for Handling Metadata to help corporate counsel better understand the importance of metadata, how to preserve and maintain it, and the need to address it early on in litigation.

With the recent decisions such as Aguilar v. Immigration & Customs Enforcement Division of the U.S. Dept of Homeland Security and Bray & Gillespie Management LLC, v. Lexington Insurance Company, the proper handling of metadata is becoming increasingly important. The metadata best practices listed below were compiled from industry experience, recent relevant cases, and a review of suggestions from the Sedona Principles and the Sedona Guidelines."

Forensic Innovations' Detects TrueCrypt and Other Encrypted Files Intentionally Hidden From Computer Forensics Tools

Forensic Innovations' Detects TrueCrypt and Other Encrypted Files Intentionally Hidden From Computer Forensics Tools

"Raising the bar in the Electronic Discovery industry, Fishers based Forensic Innovations, Inc. is now able to detect TrueCrypt, and other encryption data hiding techniques. The newly released File Investigator version 2.23 continues in their plan of supporting more file types (currently supporting 3,312) than any other product in the industry. Along with the 141 added file types, the accuracy of 78 existing file types was improved. Add to that the ability to identify more encryption file formats (including the elusive TrueCrypt) , and this version is truly a leap forward in advancing the state of the art in the analysis and filtering of Electronically Stored Information (ESI). http://www.forensicinnovations.com.

TrueCrypt has earned a reputation for simplifying the process of encrypting your data, as well as hiding it. On their web site, www.TrueCrypt.org, they claim that "no TrueCrypt volume can be identified (volumes cannot be distinguished from random data)." That was true, until now."

Think you’re compliant? Corrupt metadata could land you in jail

Think you’re compliant? Corrupt metadata could land you in jail

"The amount of data that companies must store is growing at an enormous pace as regulations including Sarbanes-Oxley, HIPAA, SEC 17a-4, and the Federal Rules of Civil Procedure —to name just a few—place an increasing burden on enterprise storage, backup and recovery needs. Fail to protect information in a recoverable state, and company officers face fines, other penalties and even jail time.

Matters are made more complex when enterprise content management (ECM) systems are in use. The benefits of ECM - workflow, collaboration, and integrated management of information assets - bring an extra level of responsibility when it comes to protecting the content and metadata within them. That extra level of care required primarily relates to ECM metadata –audit trails, digital signatures, workflows, renditions and other “data about data,” which must be backed up with the content it supports in a synchronous manner to ensure full recoverability and compliance with regulatory mandates."

Metadata Grows in Legal Import

Metadata Grows in Legal Import

"A very small thing called "metadata" is getting bigger, at least in legal significance.

Attorneys said that lawsuits demanding the production of metadata -- the digital DNA of a document that can prove who created it, when and who may have altered it over time -- have increased in recent years. And courts are honoring many of those requests when they are made early on, and relevance is shown.

Most recently, a federal judge in New York ruled that companies need to be ready to produce metadata in litigation, holding that metadata associated with e-mails and electronic files must be preserved, maintained and produced in the course of legal discovery, particularly when sought early.

The case was a class action alleging unlawful searches and seizures of immigrants' homes, in which a discovery dispute arose regarding the production of metadata. Aguilar v. U.S. Immigration and Customs Enforcement Div., 2008 WL 5062700 (S.D.N.Y. Nov. 21, 2008). "

Rule 34: A Cause for Confusion

Rule 34: A Cause for Confusion

"The 2006 amendments to the Federal Rules of Civil Procedure provided some clarity with respect to electronically stored information. However, Rule 34 remains muddled. Courts and commentators have proffered differing interpretations, leaving litigators to struggle with two questions: 1) Does Rule 34 itself, without more, require the production of metadata? 2) Does a requesting party have to specifically request metadata before a responding party can be compelled to produce it?

In 2005, the District of Kansas in Williams v. Sprint/United Management Co. ("Williams I"), 230 F.R.D. 640, 646-57 (D. Kan. 2005) relied on the 2005 Sedona Principles to conclude that there was "a general presumption against the production of metadata," but was careful to note the exception that metadata should be produced when the producing party is aware -- or should be reasonably aware -- that it is relevant to the dispute."

Turning Obscure Bits Of Data Into Hard Evidence: A Proposal For The Unorthodox Use Of A Document Request To Capture System Metadata

Turning Obscure Bits Of Data Into Hard Evidence: A Proposal For The Unorthodox Use Of A Document Request To Capture System Metadata

"A weakness in the discovery process is that it is difficult to determine when a party has not met its obligation to voluntarily produce harmful documents. When it is available, system metadata can solve this problem by providing a different view of electronic evidence that is not readily susceptible to manipulation or concealment.

The term "metadata" is typically used to describe information automatically included in substantive electronic files by application programs such as Microsoft Word or Outlook. Of course, this information is of no help if the file in which the metadata is embedded is not produced. It is often overlooked that applications, operating systems, and file systems also generate numerous "system" metadata artifacts, located in dedicated files separate from the substantive files to which the metadata may relate, which, despite any concealment efforts, can reveal the existence of a file that has not been produced, or even that file's contents. Significantly, system metadata is particularly valuable in discovery as many of these metafiles almost always exist and are not easily manipulated or erased without special tools. Even when these tools are used, they typically leave detectable marks flagging the destruction. See Brian Carrier, File System Forensic Analysis 198 (Pearson Education 2007). Should this be discovered, the target is potentially in trouble regardless of whether the actual metadata or underlying substantive files can ever be recovered. "

E-Discovery Is All in the Asking

E-Discovery Is All in the Asking

"The most recent federal decision[FOOTNOTE 1] weighing in on the hot-button issue of discovery of metadata[FOOTNOTE 2] and documents in their "native format," i.e., "the way it is stored and used in the normal course of business,"[FOOTNOTE 3] offers some simple, common-sense advice on how to best achieve that discovery objective: Ask for it. Up front.

Otherwise, if you ask too late or have already received the documents in another format, you may be out of luck.

In Autotech Technologies LP v. Automationdirect.com Inc., No. 05 C 5488, 2008 WL 902957 (N.D. Ill. April 2, 2008), defendant ADC filed a motion to compel Autotech to produce an electronic copy of a document it had already produced in PDF and paper format. ADC claimed that Autotech's production of this document in non-native format was insufficient, because the formats in which Autotech produced the document lacked the accompanying, underlying metadata, including when the document was: (1) created; (2) modified; and (3) designated confidential."

Electronic Discovery: The Great Metadata Debate

Electronic Discovery: The Great Metadata Debate

"Several courts have tackled the question of whether ESI must be produced with metadata intact. In  In Re Payment Card Interchange Fee and Merchant Discount Antitrust Litig. , 2007 WL 121426 (E.D.N.Y. Jan. 12, 2007), plaintiffs stripped their text-searchable electronic documents of metadata. Defendants moved to compel plaintiffs to reproduce the documents with metadata. The court granted defendants' motion prospectively only. The court reasoned that in stripping the metadata, plaintiffs had run afoul of the Advisory Committee's note to Federal Rule 34(b) that data ordinarily kept in electronically searchable form "should not be produced in a form that removes or significantly degrades this feature."  Id  . at *4. The court held that requiring the plaintiffs to include metadata in future productions would not impose an undue burden. A retrospective ruling, however, would impose an undue burden on plaintiffs, who had produced documents without metadata for several months without receiving any objection from defendants."

Palmer & Ralls: Duty to notify

Palmer & Ralls: Duty to notify

"Dealing with metadata is a reality of practicing law in today’s legal environment. Attorneys continually create and receive electronic documents. Each of these documents may contain hidden “metadata.”  Metadata, when accessed, can reveal information that was never intended to be disclosed by the author of the document. For example, metadata could identify the date an electronic document was created, authored, as well as disclose previous versions and edits to the electronic document. Notably, metadata may be found in virtually any type of electronic file including pictures, video clips, documents or other types of digital files. The effective use of metadata can give one side a distinct advantage."

United States: Mining Buried Electronic Data: Increasing Criminal And Civil Case Concerns

United States: Mining Buried Electronic Data: Increasing Criminal And Civil Case Concerns

"With the rapid progression of computer technology, the production of documents in response to a government subpoena or civil discovery request has unearthed new and unexplored issues. Increasingly, prosecutors and regulators are requiring, and opposing counsel in civil cases are requesting1 that documents be produced in electronic format. Yet, unlike their hard copy counterparts, electronic documents—specifically those in native format—contain hidden information in the form of "metadata." Simply stated, metadata is "data about data,"2 which is buried beneath the information visible on a computer screen and which readily can be extracted. Metadata reveals the "who," the "what," and the "when" behind a document’s creation and modification.

The issue of metadata poses at least three questions: (1) Must your client preserve metadata? (2) Under what circumstances must the client produce metadata? And, (3) if metadata is produced, may prosecutors, regulatory agencies, and civil litigants "mine" that metadata for hidden information?"