Takes a Closer Look at AB 5

A recent article in highlights the differences between the new California Electronic Discovery Act and FRCP. The article states “The new California legislation, by contrast (to FRCP), assumes that all electronically stored information is accessible. Rather than requiring the requesting party to bring a motion to compel in the first instance, as under the federal rules, it instead provides that the responding party may bring a motion for a protective order”.

With the cost of ESI discovery dropping, and ease of access to previously inaccessible ESI (backup tapes) via new technology from Index Engines, it is no surprise that these regulations are entering the market.

Here is a link to the full article.

Preservation of Disaster Recovery Backup Tapes?

The court just ordered production of disaster recovery backup tapes, despite defendant’s argument that ESI on the tapes is not reasonably accessible. This is happening more and more as technology is making tape discovery less painful. Index Engines automated approach saves significant time and expense when dealing with ESI from tape. No longer does the burden argument hold. This article from summarizes the case:

Preservation of Disaster Recovery Backup Tapes?

Do you need to preserve disaster recovery backup tapes that contain relevant ESI? Guidance from commentators and case law is mixed. The Federal Rules of Civil Procedure are silent on whether disaster recovery backup tapes need to be preserved when implementing a litigation hold. What we know, however, is that all relevant ESI must be preserved. Relevant ESI can be contained on backup tapes that a party deems not reasonably accessible. See FRCP 26(b)(2)(B). Assuming backup tapes are preserved and identified as not reasonably accessible, will the tapes ever be subject to discovery? In short, yes as demonstrated by Kilpatrick v. Breg, Inc., 2009 WL 1764829 (S.D. Fla. June 22, 2009).

In Kilpatrick the court ordered production of disaster recovery backup tapes, despite defendant’s argument that ESI on the tapes is not reasonably accessible. While the case does not address the question of preservation directly, it stands as a warning. Defendant repeatedly represented that active ESI met its discovery burden. Defendant also advised that additional relevant ESI might be contained on backup tapes, designated as not reasonably accessible because they were maintained for disaster recovery purposes only. Plaintiff was not buying it and moved to compel production of the backup tapes. The court agreed that the ESI produced so far seemed to have some holes and compelled limited production from the backup tapes.

Full article here.

The Buzz About AB 5 (aka: Chapter 5, Statutes of 2009)

Index Engines exhibited at LegalTech West in Los Angeles last week. And the buzz on the show floor was largely about Assembly Bill 5 – better known as AB 5. AB 5 is a bill that is sitting on Governor Schwarzenegger’s desk awaiting signature, that takes a much firmer approach surrounding the access to historical data that must be made available to support legal proceedings.

FRCP started the ball rolling by requiring that electronic evidence be made discoverable, unless an undue burden could be claimed. AB 5 takes a much harder line, effectively overrulling Zubulake’s position that data contained by disaster recovery systems was simply inaccessible. AB5, when passed into law, will not let the responsible party object to data discovery simply based on it’s location. Disaster recovery data will now be presumed fair game for discovery. Back up tapes contain the large majority of data stored for disaster recovery. As such, the Index Engines booth at LegalTech was hopping.

Index Engines is the only technology commercially available that allows fast, cost-effective, forensically sound access to files and email stored on backup tapes. Enterprise legal teams and high profile law firms are well aware of the high cost of traditional tape restoration services. These prohibitive costs are what spurred the Zubulake ruling initially. AB 5 will force the issue, tapes will become part of routine eDiscovery, and Index Engines will be there to help. We’re already helping enterprise clients process through their legacy disaster recovery tapes. Our white paper, The Anatomy of Tape, outlines how large scale tape discovery and remediation projects can be made manageable.

Update July 1, 2009: AB 5 – now officially called Chapter 5, Statutes of 2009 – was signed last night. It is now official. See this post on e-Discovery Insights (Perry L. Segal, Esq.) blog. Perry has been closely tracking AB 5.

Are Mailboxes Enough?

Many eDiscovery projects are based only on the collection of individual custodian e-mailboxes. This raises some important preservation and process questions. Does ESI collection focused on user mailboxes preserve everything that is required? Will searching only those mailboxes find everything that the courts may eventually request?

If a user is acting covertly they might not leave critical evidence in their mailbox. They might be smart enough to remove it or even hide it. In that case collection that is narrow in focus will not be enough to ensure all appropriate ESI is preserved. There is an alternate approach to preserving and searching email that exists outside the limited scope of a user’s mailbox.

The most obvious location of objects that are no longer in the user’s mailbox is deleted email. When a user deletes an email it temporarily resides in the user’s deleted items folder. This folder is typically set to purge after a short period of time. After this period the email then moves to the Exchange dumpster. The dumpster is an independent component from the user’s mailbox. The email will live in the dumpster for a set number of days and is then purged. Therefore any email that a user deletes could be accessible in their deleted items folder for a short period of time. Then it would move outside their mailbox, and outside their control, to the dumpster and thus not included in the custodian’s mailbox. Therefore, ESI collection that is focused only on user mailboxes would not see any content residing in the dumpster.

Another alternate source of valuable email information is the Exchange Server transaction logs. These can be quite convoluted because they often have internal references to the specific EDB for which transactions are logged. By carefully parsing a full EDB and the subsequent log files it is possible to recreate all the emails that came in or out of the Exchange Server. Simple collection and preservation of Mailboxes via a tool that parses just the EDB will always miss this important secondary source of emails. Most importantly, the user has no ability to influence the content of the Exchange server logs. Thus, in an environment where the user is somehow bypassing the dumpster, the logs will still contain many of the emails.

Other valuable content that would not be captured in user mailboxes are email communications with other users. For example, user A, who is under investigation, initiates an email string that is relevant to the case at hand. The email was sent to user B, who is not under investigation. User A then deletes the email, and purges it from their deleted folder, and also over time it will be deleted from the dumpster. So from the perspective of user A’s mailbox, the email no longer exists. However, the email could still reside in user B’s mailbox if they did not delete it. When user A’s mailbox is collected the “smoking gun” email will be left behind even though it exists in the mail server. This scenario is common in the world of Exchange and it exposes an additional major flaw in the use of custodian mailboxes for collection, preservation, and searching purposes.

Index Engines technology allows access to a fully indexed Exchange image for deeper discovery and a more cost effective approach. Not only are full user mailboxes searchable, but also complete conversations that may reside in other user’s mailboxes and not with the custodian in question can be uncovered. Additionally the entire dumpster can be accessed and searched, making email available that was thought to be long gone. What’s more is that Index Engines technology gives access to this full set of Exchange data at a rate up to ten times faster than traditional email discovery approaches.

Exchange Data Discovery

Late last week DFI News published an article co-authored by Index Engines and Norcross Group, outlining a new approach to eDiscovery of Exchange data. The article, entitled Forensically Sound Preservation and Processing of Exchange Data, takes the reader through the challenges of accessing a live Exchange database; it’s large, active and complex. The authors also examine a popular tool used for capturing data from a live Exchange environment. This tool, ExMerge, is a MAPI or Microsoft’s messaging API for Exchange, that was never intended for intensive data discovery.

The alternate approach for Exchange discovery outlined in this article, is a Forensic Scanning process. Norcross Group has elected to use Index Engines technology to implement this approach. By creating a snapshot of the Exchange database and scanning this image with Index Engines technology, Norcross is able to provide more thorough, cost-effective and forensically sound discovery services to their clients. The article provides a real-world case study of how this Forensic Scanning approach has been implemented and what the actual results have been.

Finding What to Keep

Yesterday PC World featured an article by IDC’s Stephen Lawson entitled Why IT Should Start Throwing Data Away. Lawson discusses the pitfalls of keeping data dating back decades. Even though storage containers are cheap, the rate that data is accumulating will make these inconsequential costs add up fast. And then he points out that enterprises must also be concerned with the intangible risks of having to plow through all the legacy data for eDiscovery.

The challenge of overcoming the data stockpile is two-fold. Defining what needs to be saved, and then finding the valuable stuff among the junk. The first step, building a retention policy, is up to the organization. Each enterprise has different types, amounts and uses for their data. Although expert consultants can help, an internal records management group will need to own the definition and implementation of how their company’s data is sorted and then saved or disposed of. And as Lawson’s article points out, technology can help a RIM team understand how much and what types of data they have, but it can’t interpret what this means to the company and determine how to best to save (or not) the data.

Once the policy is written, the next hurtle is to collect the relevant information from the vast stores of old data. Where data resides can be broken down into three storage types; backup data, network data, and desktop data. Backup data, including tape and disk, contains tons of duplicate and useless data. Stores of network data are often tremendously large and ever changing. Desktop data is fragmented and difficult to trace. Index Engines offers a collection platform, that not only handles the specific challenges of accessing each type of data container, but also allows for a unified view and deduplication effort. By unlocking backup formats, Index Engines makes quick work of indexing and searching data on tape or disk. Using NDMP to index network data, Index Engines can keep pace with the ever changing volume of enterprise production data. User data can also be harnessed, indexed and searched with Index Engines platform. This technology links the indexes built from the various data stores and allows the search for unique content to be performed against them all – simultaneously. Then the true subset of valuable data can be extracted and archived. And the rest, as Lawson suggests, can be thrown away.

Combatting Data Rot

In a recent NY Times article, Should You Worry About Data Rot?, David Pogue talks with Dag Spicer, the curator of the Computer History Museum in Silicon Valley. This article examines just how fast the newest data storage technology becomes obsolete. Mr. Spicer points out that computer companies make their money by selling newer, faster, better technology – not by keeping the old stuff going forever. Pogue and Spicer converse about how the museum bakes 8-track cartridges in order to retrieve information off of them after they have become damp and sticky. Mr Spicer emphatically states that the only way to keep your data; photos, music, files, accessible is by migrating them on a regular basis to the newest platform.

The same advice should be followed by corporations storing mountains of backup tapes, containing potentially valuable information, in dark, dank warehouses. Every day these tapes are ignored, the harder it becomes to get the data off them. The drives needed to read old tapes become more difficult to locate. The backup software used the write them, and needed to read them, becomes older and more scarce. And the integrity of the tape itself become more fragile. Index Engines Tape Engine is the solution to getting data off tape and into today’s data archive. The Tape Engine catalogs and indexes backup tapes regardless of format or backup software. With this solution you can select what information has value and is worth transferring into a corporate records management platform. The rest of the useless data (system files, duplicate information) can be discarded along with the tapes. So unless your IT team is made up of forensic Betty Crockers, avoid a great tape bakeoff and index your tapes before it is too late.

New eDiscovery Rules – comment for eDiscovery Navigator

Electronic Discovery Navigator recently wrote about the requirement for new rules to address the cost and burden of eDiscovery.

Index Engines thoughts on this issue are as follows: Technology has been very pocketed in solving the problem here. Solutions exist for hard drives and USB drives. Other solutions target email and online files. Specialized forensic tools look for deleted email. And highly skilled service providers can restore tape content so that it can be processed. This is not a unified solution, simply pieces of technology tethered together that end up causing very expensive review and processing fees.

Index Engines unified approach towards collection, deduping and then handing over responsive data to litigation review platforms such as Case Central is what is needed here. We can connect to offline tape, hard drives and forensic images, online file systems, even email databases including dumpsters containing what a user has deleted but still resides in Exchange. Unifying collection, and dedupe across all these environments allows for a more comprehensive search and discovery. Once the unique files are culled, a single instance can be fed to the review platform. This eliminates the clutter of duplicate files and irrelevant content which are what make the review costs bloated.

eDiscovery Industry Holding Pattern

Recently Fulbright & Jaworski published their Fifth Annual Litigation Trends Survey. This poll uncovered a few interesting eDsicovery trends:

– Over the past three years, eDiscovery disputes have reduced significantly
* We think this is due to the acceptance of producing the data, no matter how “burdensome”

– Respondents feel that full pre-trial disclosure should be reconsidered
* We often hear how difficult and expensive it is to find data that may end up being irrelevant

– Reliance on, and confidence in, Records Management for eDiscovery has greatly increased
* We think that ARMA will become the next Litigation Support resource.’s article commenting on Deloitte Financial Advisory Services poll of in-house lawyers and executives finds that 30% of companies have no policy around electronic evidence preservation.

If the findings of the Deloitte poll are analyzed alongside those of the Fulbright & Jaworski survey, it becomes clear that the Legal Technology industry is in somewhat of a holding pattern. Litigators know that the courts will require them to produce the digital evidence. They hope that this requirement comes under review because it is time consuming and expensive. If retention policies do exist, the ownership is being passed from Legal to Records Management. And for the large percentage of companies who still have not developed or implemented information management procedures, they are most likely waiting for a better solution.

Right now corporations are saving everything and then having to discover it later. They are digging through vast amounts of duplicate files, system files, and spam email to find the small percent of useful information that actually supports impending litigation. Index Engines eDiscovery experience tells us this percent of relevant data is less than 5% of all stored information. There are a few approaches that can streamline both retention of information and the discovery of it afterwards.

Ideally, electronic information should be culled and deduped prior to saving it. With the right technology this can be done during the backup process. Once the subset of useful information is backed up, indexing and searching it using automated, tape indexing or high speed, network indexing technology makes this process fast, accurate and affordable.

Going forward, records management will discover the right way to retain data. Policies will be implemented and technology employed. The eDiscovery requirements will not be overturned, but the process to comply with the disclosure will become less painful.

AIIM Expo Session: Cost Effective Method for Tape Discovery

Index Engines, provider of the fastest enterprise discovery technology on the market, invites you to attend our technology session at AIIM Expo in Philadelphia, PA on April 1st. This session will be co-presented by Tim Williams, CEO of Index Engines and Christy Campos, IT Litigation Support Specialist at Dominion Resources Services. Together they will outline a methodology for streamlined management of ESI on backup tape.

The conference and session details are:
AIIM International Expo & Conference 2009
Pennsylvania Convention Center
SEA08: Tackling the Data Glut: Methodology for Streamlined Information Management
Date: Wednesday, April 1, 2009
Time: 2:45 PM – 3:35 PM
Speakers: Tim Williams, CEO Index Engines
Christy Campos, IT Litigation Support, Dominion Resources Services

In this presentation Index Engines will explore the challenges enterprise organizations are facing with regards to legacy data stored within mountains of backup tapes. The session will outline why and how this information can be accessed in an efficient and cost effective manner. Details on the implementation and results of this methodology will be summarized by Dominion Resources Services.

Visit Index Engines at AIIM Expo, Mar 31st – April 2nd, 2009 in Booth 1241 to see a live demo of Index Engines automated solution for tape discovery. A free pass to the AIIM Expo exhibition and conference is available via Index Engines website.

Contact Index Engines to schedule a briefing prior to the methodology presentation or for a demonstration of the Index Engines technology.