Virtual servers, desktops and storage are reaching the point of ubiquity. If you haven’t already encountered your first electronic data discovery collection involving virtualization, it’s only a matter of time until you do.

When you engage in collection in a virtualized environment, much of your job as an attorney remains the same: assess the situation, determine what needs to be collected and processed, and talk with your client and EDD vendor about what needs to get done. But realize that the underlying targets for discovery are radically different. If you stick to your old habits, you could be blindsided by high costs, hidden data and preservation issues associated with virtual machines. This article presents the information you need to ensure an efficient, complete and virtually painless collection.

Virtualization can affect your case in three main ways:

1. Increase costs and collections: Virtualization means the end of the “one computer per box” generation. If you get a rough estimate of an electronically stored information collection by merely counting the physical computers or servers, virtualization can throw your estimates way off. It is now commonplace for multiple computers to run on the same hardware that used to be reserved for one.

2. Cause you to overlook evidence: If certain forms of virtualization have been implemented, and an examiner is not made aware of it, they might miss crucial evidence. When searching a user’s hard drive, for instance, certain files contained within encapsulated virtual machines may not respond to keyword searches. The virtual machine files may have to be “opened” prior to the search to ensure accurate results.

3. Increase the risk of collection issues and/or spoliation: Virtualization involves separating computers and data storage from its physical hardware. This new technology brings with it new features that may increase the possibility of losing or destroying ESI. Examples include the ability to:

  • “roll back” a computer to a previous “snapshot” and inadvertently lose newer data;
  • move computers and data from one piece of physical hardware to another and accidentally misplace or compromise data; and
  • delete entire machines with a single click and completely erase data.

Your ability to overcome these issues in any case involving virtualization relies on how well you do the following:

1. Understand what virtualization is and how it is used in corporate environments.

2. Ask the right virtualization questions when meeting with your client.

3. Effectively communicate what you need from your client and e-discovery vendor.

UNDERSTANDING VIRTUALIZATION

“It is not sufficient to notify all employees of a litigation hold and expect that the party will then retain and produce all relevant information. Counsel must take affirmative steps to monitor compliance so that all sources of discoverable information are identified and searched.” Zubulake v. UBS Warburg LLC, No. 02 Civ. 1243 (SAS), 2004 U.S. Dist. LEXIS 13574 (S.D.N.Y. July 20, 2004).

The Zubulake opinions hold attorneys accountable for understanding all the intricacies of ESI involved in legal holds and collections. Understanding how companies use new technologies, the hottest of which right now is virtualization, is the first step in ensuring proper compliance and collections.

Before I define virtualization and explain its different uses, note that there are many types of virtualization out there (including a few that are not covered here). Unfortunately, when people refer to virtualization technologies, they often use different terms to talk about the same thing. I will try to use the terms that most precisely describe the technology while still helping you learn the industry buzzwords. Although this technology may seem complicated, the ideas and uses behind it are very simple.

Virtualization, broadly, is the abstraction of computers from the hardware on which they run. In many cases, this means sliding a software layer between an operating system and its hardware. This layer (called a hypervisor or virtual machine monitor) acts as a middleman, managing access to hardware. Because this middleman has the ability to allocate hardware resources to the computers running on it (called virtual machines or VMs), new technological opportunities arise. Here are just a few examples of what virtualization can help accomplish:

  • move entire computers (virtual machines) from one physical piece of hardware to another;
  • reboot machines without actually shutting down the hardware;
  • share physical pieces of hardware with other computers. See Figure 1, below.