Unexpected eDiscovery: Boldly Exploring the Outermost Frontiers of ESI

21
Dec
2010

Christy Burke

Space…it was the final frontier for one James T. Kirk of the Starship Enterprise.  But where is the final frontier for eDiscovery?  Well, there isn’t one.  Not yet anyhow.  For the pioneers on the cutting edge of eDiscovery, new and surprising sources of ESI are continually being discovered, tapped, and secured.

Any eDiscovery expert or computer forensics professional can find electronically stored information (ESI) in ordinary places such as document repositories and e-mail systems.  However, the most creative, intrepid and thorough electronic investigators go farther-- much farther -- to find crucial information in the most unexpected and unusual of places.  They find obscure cards, chips, disks, proprietary systems and remote outposts where relevant data lives, preserve it, and bring it into the fold.  In short, they boldly go where no one has gone before.

Unexpected eDiscovery

I spoke with several eDiscovery gurus to find out what unusual and unexpected ESI sources they had come across in the umpteen cases they’ve worked on over the years.  I spoke with Alon Israely, Adam Feinberg and Brian Schrader, three e-forensics experts from the Data Collection and Forensics Team at BIA (www.biaprotect.com) who are among the most well-regarded and resourceful providers of data collection and preservation in the industry.  Also, I spoke with eDiscoveryJournal.com co-founder Greg Buckles, Jim McGann of Index Engines, and Brett Burney of Burney Consultants.

Oil Rig Extractions
Say you need to access multiple digital resources on an oil rig that are implicated in the case’s discovery order.  Now, put that oil rig in the middle of the ocean.  If that’s not complicated enough yet, make that ocean off the coast of Africa.  Now make those collections effectively and defensively with a tight deadline to extract germane data for your case. Go.

BIA’s Feinberg actually accomplished this very feat, engineering a remote data collection from an oil rig off the African coast.  His law firm client for the matter had a very tight collection and preservation deadline that was seemingly impossible at first.  Finding a trusted local resource in Nigeria or nearby countries to preserve the data in time was not feasible, so Feinberg employed BIA’s DiscoveryBOT™ remote collection technology to harvest the data remotely with little more than a satellite internet uplink for connectivity.

The preservation of data from oil rigs as an additional source of ESI has been in the spotlight lately due to the mass litigation filed against BP as a result of the oil spill earlier this year, so it’s important to know that data preservation and collections efforts from far-reaching places, in the middle of the ocean no less, can be accomplished by having the right technology and expertise on hand.

Broker Chat Yields More than Idle Chatter
Alon Israely cited a multi-billion dollar investigation he worked on where critical communications were extracted from a broker chat system for a financial institution.  Since the chat system did not have any export functionality, Israely implemented BIA’s DiscoveryBOT™ remote collection technology as an initial base and custom-built a special extraction tool to retrieve the data out of the chat system in a defensible way.

Dusty Basement Finds
Does anyone remember the Vydek computer?  Well, me neither, but BIA’s Brian Schrader became well-acquainted with one—and one rather dusty basement--for a case he worked on.

In the early 1970s, Vydek was an engineering department for Eastman Kodak, and its computer system in 1974 utilized large, LP-sized floppy disks.  Schrader explains that the only way he could read the disks was by obtaining an actual, working Vydek system, which had not been manufactured in 25 years.

Fortunately, BIA’s team found two existing Vydek systems intact, both of which had been stored in a dusty basement for many years--and one was actually in working order.  The data retrieved from the Vydek system was critical to the case and would not have been retrievable otherwise.  Schrader says the moral to the story is:  “Never throw away those old computers!”

Backup Tapes Save the Day
Backup tapes can be a lifesaver when it comes to eDiscovery, and that is proven more and more as tape discovery has taken more center-stage, dispelling the argument that tape contents are inaccessible.  Schrader recalls one IP case where the ESI came from an obscure legacy backup tape system from the 1980s, and he needed to obtain the original hardware and software to restore the data.

Fortunately, one of BIA’s technicians miraculously found an unopened box containing the original backup hardware in a computer store’s discount bin and secured the necessary software as well.  The data on the backup tape was crucial to establishing when certain software IP was actually created.

In a final twist to the story, a BIA technician met the original inventor of the tape software who claimed to be the second coming of the son of God.  However, that particular claim was never substantiated…

Tape discovery has become more streamlined, affordable and efficient because of new technology that has been invented in recent years.  Index Engines (www.indexengines.com) has patented technology that obviates the need for tape restoration.  They won Law Technology News LTN Award for best new product of the year at LegalTech NY 2010 for their Unified Discovery Platform, an appliance which reads and indexes tape content so it is searchable without requiring simulation of the original tape environment.  Jim McGann, Index Engines’ VP of Information Discovery, notes that old backup tapes can be the shining white knight that unexpectedly shows up to save the day.

McGann notes one such example where eDiscovery vendor Integreon used Index Engines’ appliance: Karen Zilkha v. David Zilkha, a messy divorce case in which the wife knew about a smoking gun e-mail from her husband that was on her home PC.

Ms. Zilkha found the message and delivered it to the SEC, who had closed the case because they could not find the silver bullet e-mail.  As a result, the SEC reopened the case and proceeded to search old backup tapes from the husband’s financial institution employer to find that same e-mail backed up on the corporate servers.  Find it they did, and they reopened the case.  The husband’s firm was shut down as a result of that single e-mail message.

Memory Cards – Tiny yet Mighty
eDiscovery expert Brett Burney of Burney Consultants (www.burneyconsultants.com) recalls a case where there were several millions of dollars at stake, and a Sony digital dictation machine’s memory card turned out to be the pivotal source of ESI.

One of the custodians in the case, a corporate executive, regularly used a Sony digital dictation machine to dictate letters, e-mails and thoughts.  Since he traveled a lot, he would copy the audio files to his laptop and then attach them to e-mails he sent to his assistant for transcription.  Both executive and assistant deleted the files from their computers, but the executive had kept the memory cards he had used in the dictation machine.

The card formats were proprietary to Sony, which posed some challenges for collection, but Burney was able to access the data by obtaining a Sony dictation machine and accompanying software.

In addition to digital dictation sources, he adds that iPhone and Blackberry memory cards also contain ESI gold that can be mined because people either forget or do not even know what information is stored on those tiny cards.

Xbox Marks the Spot
Greg Buckles of eDiscoveryJournal.com recently helped a corporate client amend its general IT access policy and training to cover new internet-enabled sources such as gaming consoles (i.e. Microsoft’s Xbox). The trend toward SaaS-based communications and flex time has complicated responses to interrogatories and discovery requests. Apparently, executives may have accessed or written e-mails using Outlook Web Access (OWA) from their children’s internet-enabled Xboxes, not realizing that a trail of information is left behind when they do.

Buckles explains that anything that can access the internet, including a gaming system, can become an unintentional ESI repository.  He has read several depositions where employees have logged in from their kids’ computers, at hotel or airport internet kiosks, etc., and all of these leave digital breadcrumbs scattered behind that can be collected and used as evidence in a case.

When it comes to ESI, documents and e-mails are definitely going to make up the lion’s share of the material collected.  However, as you can see by the myriad examples mentioned above, sometimes it is necessary to have an explorer’s mentality and to boldly tap into new –or antique—sources of electronic evidence, many of which can yield useful data that is relevant to the case.  To be sure, there will be many as-yet-revealed frontiers for intrepid eDiscovery pioneers.  The clear message to hidden data in these far and unexpected reaches of the universe?  You can try to hide, but you will be discovered!