Clients frequently ask what is the difference between a forensic collection and e-disclosure. In truth, the concepts of e-Disclosure / e-Discovery and forensic services have become muddied in recent years. This is often because eDisclosure firms add forensic technology capabilities or because forensic technology / investigations firms add eDisclosure services.
Unfortunately, it is often the case that neither side of the equation truly understand the requirements of the other and frequently there are times when companies like Millnet have been required to step in and replace forensic technology firms part way through an engagement.
This does not mean, of course, that there are not occasions when Millnet refers its law firm clients to forensic technology specialists. Examples of when such a referral to a suitable expert is essential might be where the requirement for investigation is solely related to mobile phone(s), where the primary focus of a matter is investigation of fraud / wrong doing or where the requirement is to manipulate or process data that is in an unusual format such as very old back-up tapes, microfiche or requires documents to be extracted from a document management system without the assistance of the end client’s IT resources.
Broadly, however, a forensic collection is not required for most commercial litigation matters where there are no allegations of wrongdoing or fraud and / or where the parties have explicitly agreed the approach to collection of data and this does not include a forensic imaging process.
For typical commercial litigation matters, forensic imaging of laptops, desktops and servers may only normally be required if:
- It is known that custodian(s) have saved potentially relevant documents in multiple and not easily identifiable locations on the hard drive of a PC or laptop and / or may have deleted key documents (that are not likely to be available elsewhere in a more accessible form).
- Allegations of tampering with documentary evidence or other wrong doing may arise and it is proportionate to preserve electronic documents in the form of forensic image files (or it is assessed that in the absence of agreement as to approach between the parties it is prudent to take forensic images to preserve potentially key sources of electronic documents)
- Where the client’s IT set up is such that they do not have an effective means of preserving electronic documents (such as back-up software) and continued use of their computer(s) is likely to result in deletion or changes to potentially key documents.
- There is no structured back up process in place and / or back-up tapes are not in a readily accessible format.
- The client doesn’t have internal IT support to collect potentially relevant documents from individual laptops and desktops or to extract files from central email / file server(s).
In the above circumstances, forensic imaging of laptops, desktops and servers (or extractions as opposed to an entire image) as well as back-up tape indexing/searching and restoration / processing can be provided as required.
Further instances when specialist expertise / experience is required include:
- A criminal investigation requiring a ‘raid’ or otherwise covert forensic activities.
- Where the primary focus of an investigation is to analyse and retrieve deleted or otherwise corrupted data.
- Where the IT environment / sources of data are especially complex and / or archaic so as to need specialist skills.
- For most mobile phone, PDA, Blackberry etc preservation of data and subsequent analysis and investigations.
The reasons why forensic services specialists are less capable when it comes to ‘downstream’ edisclosure services include:
- No direct capability to provide hard copy (copy, print, scan, code) services. Some are reasonably adept at sub-contracting these services to firms such as Millnet (especially the large firms).
- Limited experience / capacity to perform the steps required to extract electronic documents and present them in a user friendly way within an LSP.
- No or limited hosted LSP capabilities.
- Little or no experience of guiding lawyers in relation to the application of the CPR and best practice in relation to collection, processing, review, disclosure and presentation of documents.
- No or limited production capabilities for disclosure and bundles.
- No programming resources in-house for manipulating data received that has errors or needs to be transformed in some way from one format to another (e.g. single to multi page tiffs / pdfs).
- Little or no experience in designing and managing the workflow aspects associated with the review of documents within the LSP.
- Lack of familiarity with the latest ‘add on’ legal review technology options such as email threads, near-duplicates, conceptual search, clustering, relevance etc.
The distinction between these service areas will continue to blur as both sides learn more about each other’s areas of expertise and the underlying software technologies seek to incorporate ’end-to-end’ feature sets. The recent merger of Access Data Corporation (one of the leading forensic software developers) with CT Summation (litigation support service provider and software developer) is evidence of this convergence.