Electronic discovery becomes harder each time a great new smartphone hits the market or a cool messaging app sweeps up piles of users. New technology usually means new challenges for compliance, with legal obligations to monitor, search, and disclose ESI (electronically stored information) created using such new technology. Existing forensics and e-discovery tools may be at least temporarily inadequate to deal with new ESI-generating technologies, lagging behind until appropriately updated capabilities are developed and implemented. This does not mean we are free to ignore electronic evidence that isn’t easy to find by a few clicks of the mouse.
So how do we make sure we don’t miss important evidence when the current versions of our tools—even widely accepted “industry standards”—can’t recover content created using the latest and greatest app? Addressing such challenges directly requires an approach grounded in a thorough and forensically sound methodology, recognizes the inevitable lag between new technologies and the capability of existing forensics tools to handle them, and involves the application of expert knowledge about ESI and e-discovery rather than reliance solely on the use of a software tool as per the instruction manual.
Time and again we see a variant of the following situation. Lawyers come to us frustrated that they cannot find critical evidence on a mobile device. They are frustrated because: a) their witness is telling them there was a conversation using a certain messaging app, but b) their vendors are telling them the messages cannot be found.
The messages are there and are highly relevant. However, they cannot be found by simply following the instructions for the industry-standard tools. Retrieving the critical evidence instead requires thorough understanding of how the app and the device store data and where the data can be found, as well as how it can be intelligently analyzed. The rest is easy.
In a sense, this is a less “sophisticated” approach. Instead of using state-of-the-art technical tools to find the evidence, this approach requires experience and expertise. It also requires recognizing that even state-of-the-art in forensics is necessarily behind developments in smartphone or social media user functionality. Forensic tools are developed reactively, and reaction is never simultaneous or instantaneous, although it may not be far behind.
There are many reasons why it does not make sense to take the ostensibly easy way and give up when forensics tools do not discover what is expected to be discoverable. One reason is that ignoring evidence does not make it go away, especially when it is electronic. A failure to produce ESI may be revealed in an unflattering way when another party (or non-party) produces its own copy, and the question arises: what else have you failed to disclose?
Another reason is the trend towards transparency in the e-Discovery process. An example of this is provided in the recent decision in Burd v. Ford Motor Company. (2015 WL 413915 (S.D. W. Va. July 8, 2015).) When the plaintiff wanted more information about how the defendant conducted its searches for ESI, the defendant objected on the basis of attorney work-product protection and arguing that such “discovery about discovery” is not properly within the scope of allowable discovery under the Federal Rules of Civil Procedure.
The court ruled against the defendant in a manner that is generally consistent with a number of cases in which courts have forced parties to reveal details about how they searched for ESI. (See generally, Adam Cohen and David Lender, Electronic Discovery: Law and Practice, Chapter 2. In Burd, one of the problems with the defendant’s search was the degree of discretion they allowed custodians in searching their own data. While these kinds of tactics may appear to be cheaper on the surface or initially, courts have repeatedly frowned on “self-collections” in a number of circumstances. ) This means that in situations where you decide to stop digging when your tools do, you may be forced to expose this decision. If the ESI is then unearthed by other means, the import of what may have been only marginally harmful if disclosed voluntarily may be exaggerated by a suggestion that you were trying to hide it.
Collection is not a good time to skimp on the e-discovery process. But even well-intentioned and adequately funded investigative or litigation lawyers may be stymied when their “technical experts” tell them the evidence can’t be found. Red flags should go up when software tools don’t find content that a witness reports generating. At least in this arena, technology will never replace human understanding and creativity.
The views and opinions expressed in this article are those of the author and do not necessarily reflect the opinions, position, or policy of Berkeley Research Group, LLC or its other employees and affiliates.