Showing 7 posts in Sources of ESI.

Spotlight on Exterro’s E-Discovery Case Law Library

Exterro’s E-Discovery Case Law Library is a worthwhile resource for all eDiscovery professionals and any attorneys interested in learning more about such issues as new data types, proportionality, and reasonableness.  It features a collection of simple and easy to understand analyses of the most significant eDiscovery case law throughout the country.  Our blog was recently highlighted in the library, where we provide our analysis on the GN Netcom, Inc. v. Plantronics, Inc. case.

Looking Back on 2015: The 6 Most Important eDiscovery Cases in Delaware

2015 saw continued interest by the Delaware courts in various aspects of eDiscovery.  The courts dealt with broad issues, such as spoliation and general discovery misconduct, while also focusing on narrower issues, such as document review and redactions.

This blog will be summarizing these 6 cases in more depth throughout the rest of 2016.  The 6 cases that will be summarized are below: More ›

[UPDATE] In Defense of Genger, Part II


I hate to say I told you so, but...wait, no I don't.

Yesterday, the Delaware Supreme Court issued its opinion in this matter affirming the Court of Chancery's spoliation finding. The Court held the spoliation finding proper, because Genger took affirmative steps to overwrite unallocated space, saying:

We do not read the Court of Chancery’s Spoliation Opinion to hold that as a matter of routine document-retention procedures, a computer hard drive’s unallocated free space must always be preserved. The trial court rested its spoliation and contempt findings on more specific and narrow factual grounds—that Genger, despite knowing he had a duty to preserve documents, intentionally took affirmative actions to destroy several relevant documents on his work computer. These actions prevented the Trump Group from recovering those deleted documents for use in the Section 225…

Compare with my statements below that

The [Court of Chancery] opinion in this case does not require preservation of all unallocated space in every case. Genger was sanctioned because he took affirmative steps to overwrite unallocated space, in violation of the Court's order... [T]here is nothing in this opinion that creates any requirement to preserve unallocated space. Rather, the opinion only says you shouldn't go out of your way to destroy it.

I feel quite vindicated in my defense, considering there were some persons and organizations of import in the eDiscovery community lined up on the other side. Obviously, reasonable minds can disagree, especially in interpreting court decisions. Ultimately, I am thankful that the Supreme Court's decision should allay any fears created by certain interpretations of the Court of Chancery's spoliation decision.

ORIGINAL POST (2011-03-11 13:20:45):

I had almost given up on writing this post considering how long it has been since I posted In Defense of Genger, Part I and (more importantly) how long it has been since the publication of the posts I am taking issue with.  However, the ongoing confusion about this case has prompted me to action.

If you have read Part I, you are familiar with the Court of Chancery's decision in TR Investors LLC v. Genger, C.A. 3994-VCS (December 9, 2009) and with the allegations made by Leonard Deutchman, General Counsel at LDiscovery LLC, in a two-part post hosted by <!--You also understand why there's a picture of Austin Powers.--> For those who are not familiar, Mr. Deutchman asserts that the Court got the decision wrong because it (1) does not understand the technology involved (Part 1) and (2) does not understand the law of eDiscovery (Part 2).

It's sufficient to say that I respectfully disagree with Mr. Deutchman on both charges. Rebutting his posts was a fun, interesting exercise for me, but it didn't seem terribly important. I saw it as an esoteric debate between eDiscovery geeks. That has changed, because, today, a prominent media outlet has published a post that elevates the confusion about this opinion and will cause unnecessary fear among corporate counsel.

The latest case of hand-wringing and confusion over this decision comes to us from none other than Forbes by way of Daniel Fisher's post "Delaware Ruling Would Require Massive Data Backups."  Mr. Fisher opens his post stating that:

A little-noticed decision by a Delaware court has the potential to impose huge costs on companies unless it is reversed, computer-security experts say...[e]xperts say retaining such data would be prohibitively expensive since the unallocated space is essentially a trash bin that is altered each time a key is tapped.

<!--Scary, huh?-->

Despite the fact that Mr. Fisher twice refers to "experts" (plural) as the source for these hyper-ventilations, his lone identified source for the post is Daniel Garrie, a lawyer and managing director at Focused Solution Recourse Delivery Group LLC , a computer consulting firm in Seattle. <!--Garrie and Deutchman are both lawyers with eDiscovery vendors. Is there anything to that?--> Mr. Fisher's post continues:

“It’s almost impossible for large companies with massive amounts of equipment to comply,” said Garrie... “I don’t even know if it’s possible,” said Garrie. “I mean, anything’s possible with enough money,” but companies would have to take bit-level images of their hard drives on a regular basis and store them somewhere, to be retrieved each time they are sued. That means all the time for most large companies. The costs would be “exponentially larger,” than current electronic discovery measures. “Several large global companies,” clients he declined to name, “have expressed concern.”

Let me clear up the confusion: The opinion in this case does not require preservation of all unallocated space in every case. Genger was sanctioned because he took affirmative steps to overwrite unallocated space, in violation of the Court's order and without first telling anyone. The routine, passive overwriting of unallocated space was NOT the cause for any sanctions here, so there is nothing in this opinion that creates any requirement to preserve unallocated space. Rather, the opinion only says you shouldn't go out of your way to destroy it. Big, BIG difference. <!--If there are doubts about the Court of Chancery's understanding of eDiscovery, please see their recently released "Guidelines for Preservation of Electronically Stored Information" that clearly embraces the principles of cooperation, reasonableness, and proportionality.-->

To Mr. Garrie's credit, he is consistent—he is co-author of an article in the Northwestern Journal of Technology and Intellectual Property that makes the same mistaken arguments, and he filed a brief with the Delaware Supreme Court arguing for reversal of the Genger opinion. I obviously disagree with Mr. Garrie's opinions on this matter, but I am here to help, so I say:

Mr. Garrie, for the “[s]everal large global companies [that] have expressed concern,” please send them a link to this post and tell them not to worry.

I don't actually expect Mr. Garrie will do that, but perhaps some of his clients will stumble upon this post, in which case here is my advice to them:

If you act cooperatively and transparently, you will be fine. If you find yourself in a similar position to Mr. Genger's, share your concerns with opposing counsel and the court before you do anything. Don't take matters into your own hands and violate a court order by wiping a hard drive in the middle of the night—it's bad form and will only get you in trouble.

Stayed tuned for the decision of the Delaware Supreme Court—I may have a lot of words to eat...

<!--Thanks to flickr user cliff1066™ for the Austin Powers pic.-->

In Defense of Genger, Part I

I rise now to defend the Court of Chancery's decision in TR Investors LLC v. Genger, C.A. 3994-VCS (December 9, 2009) against the allegations made by Leonard Deutchman, General Counsel at LDiscovery LLC, in a two-part post hosted by  I promised at the end of April that a defense would be forth coming but wanted to give everyone time to read the two posts to which I respond.

Mr. Deutchman asserts that the Court got the decision wrong because it (1) doesn't understand the technology involved (Part 1) and (2) doesn't understand the law of eDiscovery (Part 2).  I have decided to respond in two parts to keep each of my posts digestible.

In Part 1, Mr. Deutchman aims to discredit the Court's technical competence, and his first criticism makes unsupported assertions about the Court's findings.

The court ruled that by wiping the unallocated space of the two drives, the defendant violated the standstill agreement and was thus in contempt of court. To reach its holding, the court had to make factual leaps and draw legal conclusions that are in my view questionable.

The court's first factual leap was that because temporary files could have resided intact in unallocated space, they were, in fact, intact prior to the wiping. More specifically, the longer leap is that because temporary files could have resided intact in unallocated space, temporary files important to plaintiffs were destroyed by the wiping.

In my reading, the Court did not assume or conclude that any particular files resided in unallocated space.  Read as a whole, the opinion finds that files existed in unallocated space, some of which may have been relevant, but no one will ever know because Genger destroyed them. The Court fines Genger for willful destruction of data in direct and clear violation of a Court order.

Mr. Deutchman's second criticism was that "that the files [the Court] believed continued to reside in unallocated space if the defendant had not wiped them would have been important to the matter." Here Mr. Deutchman's merely reiterates Genger's "No harm, no foul" defense—or, as Ralph Losey refers to it, the "pig-in-a-poke" defense—to which the Court replied:

For a party to intentionally violate an order not to destroy or tamper with information and then to claim that he did little harm because no one can prove how much information he eradicated takes immense chutzpah. For a court to accept such a defense would render the court unable to govern situations like this in the future, as parties would know that they could argue extenuation using the very uncertainty their own misconduct had created.

Finally, Mr. Deutchman's concludes his first post by suggesting the Court is technically incompetent by claiming the Court thinks of unallocated space as a back up system.

It is important to note that nowhere in typical computer usage or professional information technology practice is the unallocated space on a hard drive regarded as "back up" in the way that the court does here.

No IT professional or typical user would consider unallocated space to be a "backup" space, akin to an external drive or backup tape used to affirmatively back up files, simply because forensic searching could possibly locate therein lost files in their deleted or temporary states.

While the Court of Chancery is likely not full of techno geeks, they seem to more than adequately understand the technology involved. In any case, the Court does not liken unallocated space to a backup system. On this point, the Court said "the information on the unallocated space of the TRI system therefore acted somewhat as a back-stop reservoir of documents that had been deleted from the active files of TRI users," and that the unallocated space was "a data source that would have acted as a back-stop in case relevant evidence had been deleted in the months when the motivation to delete would have been at a zenith." (Emphasis added.) Frankly, Mr. Deutchman's attempt to impugn the Court with this allegation is bizarre considering the plain and clear language quoted above.

I will address Mr. Deutchman's second assault on the Genger decision shortly.

UPDATE: Thanks to LexBlog CEO Kevin O'Keefe for recognizing this as a Best in Law Blogs post, the second time this blog has received that honor.

Knowledge Management Controls Your Destiny

Posted In Document Management, Sources of ESI

In case you misKMWorld 100 Companies That Matter in Knowledge Managementsed it, KMWorld recently announced its 100 Companies That Matter in Knowledge Management.  Many of those on the list are familiar names, with offerings familiar to the eDiscovery world, but many are unfamiliar names with unusual offerings.  Among the 100 are at least a handful of true pioneers that will pierce new dimensions at the intersection of knowledge and technology (or plant the seeds to do so), transforming the way we coexist with our technologies.  As the technological landscape transforms, data and information hunter-gatherers (we) should pay attention.

eDiscovery is fundamentally concerned with hunting down then gathering records and naturally overlaps with Records Management (RM).  Knowledge Management (KM), on the other hand, is concerned with putting the information in an organization's records to their best possible use.  An organization's KM efforts drive data structures and records management.  If you want a glimpse at how eDiscovery will be conducted tomorrow, keep an eye focused on the bleeding edge of KM.  Today's internal wikis, blogs, IM clients, enterprise search, and intranets will be replaced with new tools that use and store data in new, more complex ways.

We still haven't figured out how to simply and cost-effectively collect and review email and office documents.  Yet we are a on the edge of bold new frontiers.  Of tangled, organic data jungles, where algorithms are continuously applied to extract meaning from organizational information, data is mashed up and remixed in countless and novel ways to tease out meaning, and cloud storage structures make the whereabouts of specific data as easy to predict as the location of an electron.  All that may not even approach the complexity created when we finally develop quantum computing.

Bring it on.  w00t!

Seventh Sign of The Apocalypse: Movie About eDiscovery

Posted In Sources of ESI

It may not mean the apocalypse, but it surely means Hollywood is OUT of ideas. Who would watch a movie about eDiscovery? I did, and so should you. Veritable eDiscovery celebrities Search King Jason  Baron and Blog King Ralph Losey teamed up to create the short embedded video below titled "e-Discovery: Did You Know?" Maximize the video, turn down the lights, and turn up the speakers (music by Darude)—if you’re at the office, I’d suggest going to the headphones. I actually felt cool watching this, if only for a second. Enjoy!


A Casual Conversation on Search and Collection

Posted In Search Methodology, Sources of ESI

I'd like to thank Chris and Morris James for the opportunity to participate on this blog and share my thoughts.  Just the other day, Chris, as he is apt to do, sent me a provocative question: "Do you guys ever use keywords during collection?"  As a practitioner here in Wilmington, I enjoy this type of open ended question, because normally I can answer it and then riff on the topic like a jazz musician.  Here is the content of that improv we conducted via email:

VMC:  I wouldn't recommend keywords for standard collection from Email or other ESI repositories, but I would use searches for database applications to extract relevant info.  Also, there are some tools that, if you allow them the latitude, they can actually run searches in native stores such as server spaces.

CJS:  On one hand it makes sense to cull at collection to save loading costs, but you'd still have to pay to have it done, so maybe it's a wash?  It also seems easier to run searches on all the data at once after it's collected rather than multiple times on individual stores.

VMC:  I think if you have a relatively small universe (custodians in the 100's or one small business) using search tools to LOCATE rather than CULL is an interesting idea.  Provided all parties are cool with the terms, it would definitely cut down on review time and costs.  In theory, everything you collect would be responsive by the fact that it was hit by a search term.  Then your review can be very tactical in only looking for Privilege and concentrate on that.

CJS:  This is a bit semantic, but, if you otherwise would have collected everything then run keywords, isn't locating prior to collecting the functional equivalent of culling?  Also, while I agree it could cut down the review, wouldn't it still be difficult to implement?  I assume not all the employees are custodians, so we'd ID the custodians then run the searches on just their data?  Or would they be doing that?  Or would we be running the terms on all the employee data? Are we assuming all the data is in a single store?  Considering keywords aren't terribly accurate, would it be better to ask the custodians to collect their relevant docs?

VMC:  And so the questions continue along that line!  What I was suggesting is identification of data by using keyword searches by agreement.  This hypothetical search would take place across all data stores without the need to identify key custodians.  You are identifying records containing relevant terms.  Now, the adequacy of using terms to find relevant information has been debated.  So is there room for some sort of conceptual or analytical evaluation of the communication and not merely the terms used in the records? Culling occurs normally AFTER you have identified key custodians and key data locations.  By utilizing word searching, we are culling down the set of potentially relevant records to those containing the terms identified.  With the source search we are discussing, there would be no need for culling as you are doing that from the get-go.

We'd love to hear your thoughts on this.  Extend this conversation in the comments section.