Written By Serena Lim, Bizibody Technology Pte Ltd and Litigation Edge Pte Ltd

First published on 17 December 2018

In this second part of the eDiscovery information, we further explore the practice of electronic evidence and discovery, within the framework of the Electronic Discovery Reference Model (EDRM).

Imagine this scenario:

You receive instructions from a new corporate client (the “Client”), who has discharged its previous lawyer and now wishes to appoint you in place. The dispute is a suit against the Client’s ex-employee, who has set up a competing business, for stealing confidential and proprietary information belonging to the Client.

At the client interview, although the Client’s representative provides incomplete information, she has provided you with a forensic image of the laptop used by the ex-employee, together with the emails and documents (“Electronically Stored Documents” or “ESD”), extracted by the forensic imaging service provider from the forensic image. The ESD comprises 20GB of emails (and estimated 60,000 attachments) in .pst format (“Personal Storage Table”). The attachments comprise of electronic documents in MS Word, Excel, PowerPoint, PDF, Photoshop, and other native formats.

As timelines are very compressed with Discovery due in two weeks, you have amended the pleadings and managed to extend the deadline to five weeks. Within these five weeks, you will need to review the ESD, identify and collate the relevant evidence, and prepare a chronological list of the relevant documents (“List of Documents”) for purposes of giving Discovery to the opposing counsel. In addition, you have to bear in mind that your client is very cost conscious and has requested that you keep the team small.

At this juncture, you will have to either:

1. adopt the traditional paper discovery approach of printing all the ESD, and undertaking a chronological review of each document; or
2. deploy evidence review and management tools, also known as an eDiscovery Platform, to review the ESD in native format.

The latter would be preferred, as this method provides not just the highest likelihood of meeting the 5-week timeline, but also the most effective and efficient way of undertaking a review of the large volume of electronic documents. Reviewing ESD in its native form yields huge cost and strategic dividends over traditional paper review and, with the increasing volume of electronic data being generated today, it would seem that the use of an eDiscovery Platform should be a baseline tool for all cases involving ESD.

The new reality faced by lawyers today is the colossal amount of evidence to be reviewed in litigation, due largely to the exponential growth in volume, velocity and variety (the “3Vs”) of ESD and electronic data. Of all the documents and data existing today, around 90% was generated in the last two years, with most of the data originated in electronic format (more than 90%). 

The hypothetical example provided above is not unusual. This has significantly increased legal costs, as much time is needed to manually review all this data. New skills are needed to manage this situation. Thus the ideal solution would be to use technology to solve a problem created by technology. It is essential to consider a completely new working approach — new tools, skills, processes, sensibilities and vocabulary.

WHAT IS “ESD”?

Before we proceed further, it is good to understand what an electronically stored document (“ESD”) is.

An electronically stored document is any document that resides in an electronic device. This includes documents, emails, or electronic files such as temporarily deleted files (for example, residing in the Recycle Bin or Trash folder) and even documents stored in unallocated file space or file slack on an electronic medium or recording device as deleted files or file fragments which may be recovered with the use of computer forensic tools or techniques.

Below are common examples of electronic evidence that lawyers come across in their daily work:

Emails	Word documents	Spreadsheets	Presentation Slides
SMS	Instant Messages	Websites	Images
Audio	Video	Recycle Bin	Deleted Data
Logs & Browser History	Metadata	Database	Hard Disk
Data on cloud	Data on social media platforms

Characteristics of ESDs

Electronically stored documents (“ESDs”) offer:

1. 3Vs
2. Document Metadata
3. Persistence
4. Fragility

1. The 3VS of electronic data
   
   The 3Vs were touched on earlier — an ever-increasing amount of data, in terms of volume, variety and velocity, makes the evidence review process quite overwhelming.
   
   The volume and speed at which they are being generated, are exploding: from emails to blogs to social media posts, humans have never been more prolific in generating data. Combined with the ease of copying and the low cost of storing electronic data, the proliferation of data is further compounded. Data growth rates are expected to rise exponentially, as data analytics and the internet of things become commonplace in the business world.
2. Document metadata
   
   Metadata is data about data. Document metadata is information attached to a text-based file that may not be visible on the face of the document. Metadata provides additional information about the document, which can make locating and managing instances of that document easier. Having the ability to filter through the metadata makes it much easier for someone to locate a specific document or other data asset in a variety of different ways.
   
   The types of document metadata that we encounter on a daily basis include:
   • Emails: sender, author, send date and time, subject matter, attachments, number of attachments
   • Documents: file name, author, date created, date modified, document type
   • Application metadata: formulas used in spreadsheets, track changes and comments in word documents.
   • Email metadata: requires special mention, being (probably) the single largest source of the huge increase in evidence being reviewed today. Email metadata (for example, recipient, sender, date, time) enables effective processing, review and analysis, and can also be strung together to programmatically produce an automated email listing, Hence, when collecting email evidence, it should be requested for in a .pst file, which can be fed into the eDiscovery Platform and reviewed with all metadata intact.

In short, metadata is evidence, and may have significant impact on the outcome of a case.

3. Persistence
   
   Deleted ESD remain on a computer system after a document has been deleted. Although Windows Explorer is unable to locate the deleted data, retrieval of such data is possible through the application of forensic software and expertise.
4. Fragility
   
   ESD metadata is fragile. For example, copying and moving documents from one folder or from one drive to another using Windows Explorer may result in an unintended change of the document metadata (for example, created/modified date).
    

Native Format

A native format is the format that was used to create the file. The following table lists some examples of native formats:

Ai	CDR	Doc	Docx
EPS	EXE	GIF	JPEG
MOV	MP3	PDF	PNG
PPT	PPTX	PSD	PUB
RAR	SIT	TIFF	WAV

It is always best to use documents in their native format, as this preserves all the metadata, rendering the evidence far easier to sort, organize and search. Contrast this to a PDF document which is usually created from an electronic document in its native format or from a printed document, does not retain the metadata from the original native document.

The diagram below, of the Electronic Discovery Reference Model (“EDRM”), provides a clearer understanding of the lawyer’s role in electronic evidence review.

By the time you, the lawyer, receives the electronic evidence, it will usually be at the processing, reviewing and analysing the evidence stages. Prior to this, the process of preservation and collection of electronic evidence is carried out.

Preservation and collection of ESD is usually undertaken by the Client’s IT Department or by forensic services providers. At the very least, the ESD should be preserved and collected in its native form, eg if the document is a word document, it should be preserved in its .doc format or .docx format. If it is in the form of an email, then the email should be preserved in .msg or .pst format.

As the metadata of the document can be critical to a case, it is crucial that the metadata of the ESD is preserved and that the ESD is collected in a forensically sound way, for example, when the date(s) and authorship(s) of a document(s) are in dispute or are critical. Where deleted data is likely to be critical to the case, it would be advisable to arrange for a forensic image to be undertaken, and for the deleted data to be preserved and collected.

Once the evidence is handed to you to process, review and analyse, it will be a race against time to complete the process.

You decide to use an eDiscovery Platform to process, review and produce the ESD. This is how it’s going to go:

1. The evidence is fed into an eDiscovery Platform for processing. There are several sub-processes here:
   
   a. All metadata will be extracted into separate fields so that documents may be organised chronologically or sorted in order of other selected metadata (Diagram 1).

b. The system creates an analytical view of the ESD, using the extracted metadata (Diagram 2).

c. All documents are made searchable via the application of OCR technology.

d. All text is indexed to enable search results to be produced instantaneously.

e. The eDiscovery tool is configured to automatically cull irrelevant ESD (for example, by date, document type and other metadata filters, and/or keywords).

f. The eDiscovery tool is configured to automatically cull duplicate ESD.

g. The processing of 60,000 documents (estimated at 2GB) will take less than one day.

2. The eDiscovery Platform facilitates the reviewer’s analysis and review of the ESD by:
   
   a. enabling the reviewer to apply keyword and metadata search filters to instantaneously cull irrelevant ESD, locate smoking guns or privileged ESD; and
   
   b. facilitating the creation of document notes, and the application of tags and redactions during the review process.
3. The eDiscovery Platform facilitates the production of documents and document lists, as it:
   
   a. converts all documents to PDF; and
   
   b. exports document lists with metadata fields.

The huge time and cost savings, in both evidence review and production, are derived from the following:

1. Evidence Review
   
   a. Reduction of review time by between 30-50%, with greater accuracy, because:
   
   i. you are reviewing better, with a wide range of digital tools - such as data analytics (for quick insights), tags (to classify), search (to retrieve) — at your disposal;
   
   ii. you are eliminating the review of unnecessary documents, for example, duplicates and irrelevant documents, by using the de-duplication and/or bulk culling functions;
   
   iii. the automated OCR and document indexing ensures that each email and attachment, including scanned image PDFs is instantaneously fully text searchable;
   
   iv. you are augmenting your lawyering capabilities, finding your smoking guns using keyword and metadata searches, and categorising them using electronic tags (for example, tagging documents according to relevancy, privilege, legal or factual issue, inclusion in affidavits, LOD or Trial Bundles);
   
   v. team members can work collaboratively, to review the evidence and to share comments and categorization with other members in the review team, in real time (this ability for the ESD to be reviewed, tagged and annotated by multiple users concurrently is a big plus point); and
   
   vi. you have more time to analyse the evidence and devise your case theory and strategy.  
   
   b. The time saving in the review process varies from case to case, but the analytics, keyword search and use of different metadata parameters to slice and dice the information allows rich variety of techniques to review the evidence versus the traditional linear review. See sample screenshots below of an eDiscovery platform’s review and analytics screens.
   
   c. Compare this to manual review, where only 1 person can review the evidence at a time, using hardcopy printouts or Microsoft Outlook. Microsoft Outlook enables the reviewer to read the emails and the attachments, but does not provide the processing and production features, and comprehensive search, tagging and annotation functions that are a baseline feature found in all eDiscovery Platforms.
   
   d. You are likely to start enjoying your work a whole lot more, especially since you can work from anywhere, anytime, without having to lug any documents or laptops, or compromising security.
   
   DIAGRAM 1: eDiscovery Platform Review Screen
   
   
   DIAGRAM 2: eDiscovery Platform Analytics Screen
2. Production
   
   a.The traditional manual method of producing an enumerated listing of 60,000 emails is both laborious and time consuming. 
   
   b. The traditional manual work entails junior lawyers or paralegals to:
   
   i. manually creating an itemised chronological listing of each email in Microsoft Word; and
   
   ii. converting each of the 60,000 emails and attachments into PDF, by painstakingly opening each email and attachment in Outlook, and using a PDF converter (such as Adobe Acrobat or Nuance PDF converter) to convert the email/attachment to PDF. Assuming that each conversion and listing takes an average of 5 minutes, we are looking at 200 working hours, ie 25 working days or 5 weeks.       
   
   c. Using an eDiscovery platform to produce the LOD entails using the eDiscovery platform to:
   
   i. auto extract and merge the corresponding ESD’s metadata into an LOD listing; and
   
   ii. auto convert the 60000 ESDs from its native format to PDF. 
   
   Assuming that the eDiscovery platform or provider provides such LOD auto generation and PDF auto conversion functions, the use of the eDiscovery platform shortens the human effort from 25 working days (traditional manual production) to 3 working days (production using an eDiscovery platform). 
   
   d. Furthermore, last minute changes can be easily catered for with LOD regeneration.
   
   e. Meeting the 5 weeks discovery timeline is not a challenge if you review the 60,000 documents in ESD, using an eDiscovery platform.  
   
   The benefits of managing evidence electronically, then, can be summarised as follows:
   
   
   
   Reviewing evidence electronically, using the right tools, saves lawyers significant time, minimising “grunt”, and reduces the risk of missing out key information for the case at hand. It enables lawyers to provide high quality work within a relatively short time and reduces the risk of missing out key pieces of evidence.  At the same time, lawyers get to focus on lawyering and reduce risk of burnout. Most importantly, it makes justice affordable in scenarios involving large document sets. 
   
   There are various eDiscovery Platforms available, each with slightly different features and functionalities, for example, CaseRoom and Relativity, Therefore, it is important to review the various tools and identify the one best suited for your needs, in terms of user-friendliness, features, and cost.
   
   About the Author: Serena Lim, a lawyer turned legal technologist, is the co-founder of Bizibody Technology Pte Ltd (legal technology consultants and solutions provider) and Litigation Edge Pte Ltd (litigation support provider). 
   
   Profile of Author(s):
   
   www.linkedin.com/in/serenalim