A A Email Print Share

E-Discovery - Guide

What is E-Discovery?

Electronic discovery, or e-discovery, is a type of cyber forensics (also referred to as computer or digital forensics) and describes the process where law enforcement can obtain, secure, search and process any electronic data for use as evidence in a legal proceeding or investigation. Electronic discovery may be limited to a single computer or a network-wide search. (webopedia.com)

What is computer forensics?

Computer forensics is the collection, preservation, analysis and presentation of electronic evidence.  Computer forensics uses tools and procedures to make sure that data recovered from a computer will comply with the rules of “best evidence” which can be admissible in criminal or civil proceedings. (TRACEVIDENCE FAQ sheet in PBI E-Discovery book, 2004)

What is the difference between computer forensics and electronic discovery?

Computer forensics is the recovery of computer-based information.  It is the science of examining and piecing back together the who, what, when, where, and how of computer-related conduct.  Computer forensics is more in-depth than electronic discovery, which involves only active computer-based information. (TRACEVIDENCE FAQ sheet in PBI E-Discovery book, 2004)

What is the Sedona Conference Working Group?

The Sedona Conference® Working Group Series is a series of think-tanks consisting of leading jurists, lawyers, experts and consultants brought together by a desire to address various "tipping point" issues in each area under consideration. We have Working Groups up and running in all three areas of our focus (antitrust law, complex litigation and intellectual property rights), and the output of our Working Groups is frequently submitted for peer review at our Regular Season Conferences, other legal education programs and otherwise.

What are the bright lines among the Sedona principles related to E-Discovery?

Principle 5:  reasonable and good faith preservation – not every conceivable
Principle 3:  early conference on preservation and production
Principle 6:  responding parties best situated to select preservation methods
Principle 9:  no duty to preserve or produce deleted data
Principle 12: no duty to preserve or produce metadata
Principle 8:  primary source active data
Principle 14: no sanctions absent intentional or reckless failure (Tom Allman, LegalTech, West, 2007)

What are the 2006 amendments to the Federal Rules of Civil Procedure (FRCP)?

The 2006 Amendments to the Federal Rules of Civil Procedure (the “Amendments”) place electronically stored information (“ESI”) on the same footing as “documents” for purposes of discovery and make a variety of targeted changes designed to provide uniform national treatment of ESI in discovery.  The Amendments, which impact Rules 16, 26, 33, 34, 37, 45 and Form 35, were developed by the Civil Rules Advisory Committee over a six-year period before being approved by the Supreme Court on April 12, 2006.  They became effective on December 1, 2006. (Thomas Y. Allman, The New Federal E-Discovery Rules: What’s Changed, What Hasn’t, and the Importance of Early Conferences Among Counsel, LegalTech West Coast, 2007)

What are some new general FRCP rules?

The following provides a rough outline of the keywords associated with the following rules:

Rule 16: Pretrial Conference; Scheduling; Management

Rule 26(b)(2): General Provisions Governing Discovery; Duty of Disclosure; Discovery Scope and Limits; Limits; Inaccessible Data

Rule 26(b)(5)(B): General Provisions Governing Discovery; Duty of Disclosure; Discovery Scope and Limits; Claims of Privilege or Protection of Trial Preparation Materials; Information Produced

Rule 26(f)(3) and (4): General Provisions Governing Discovery; Duty of Disclosure; Conference of Parties; Planning for Discovery

Rule 34(a) and (b): Data Archiving Requirements

Rule 26(f) and 26(b)(2)(B): Data Protection and Production

Rule 37(f): Data Resource Management (Karen A. Schuler, ONSITE, Best Practices Discovery Checklist, Legal Tech, West Coast, 2007)

What are some of the implications of the new FRCP rules?

  • Survey and assess all potential sources early
  • Disclose sources claimed to be inaccessible
  • Define and explain “burden of costs” of production
  • Attempt to secure agreements on sequencing
  • Seek cost shifting where appropriate (Tom Allman, Law Tech, West coast, 2007)

What needs to be disclosed?

The new FRCP requires an exhaustive search for all electronically stored information, including email, that is “in the possession, custody, or control of the party.”  It must be disclosed “without awaiting a discovery request” (Rule 26(a)(1)).  The only exception is for privileged information.

The search must be done at the beginning of a legal case and certainly no later than the first pre-trial discovery-related meeting, which is required to be within 99 days (Rule 16(b)).  As a result of the search, a “copy of, or a description by category and location” of all electronically stored information that “the disclosing party may use to support its claims or defenses” must be presented.  In the case of email, this disclosure likely includes every relevant piece of email that may be stored, including back-up tapes, employee PCs, or Blackberry devices (Rule 26(a)(1)).  Even if one party “identifies (information) as not reasonably accessible because of undue burden or cost,” its description, category, and location must be disclosed (Rule 26(b)(2)(B)).

What are the Zubulake decisions?

Laura Zubulake, an employee of UBS Warburg LLC, filed a sexual discrimination suit against the company in the United States District Court for the Southern District of New York.  The court instructed UBS to provide emails from all optical and servers and from select backup tapes.

The case citations are: 216 F.R.D. 280 (2003); 217 F.R.D. 309 (2003); 220 F.R.D. 212 (2003); 94 Fair Empl. Prac. Case. (BNA) (2004)

In April 2005 a New York jury awarded Zubulake $29 million.

What was the verdict in the Morgan Stanley case?

Morgan Stanley, a Wall Street giant, was slammed with a whopping judgment of $1.45 billion fraud verdict mainly because it repeatedly failed to produce e-documents in a timely fashion, primarily e-mails stored on backup tapes, in response to routine discovery requests.

What is ESI (electronically stored information)?

This is new term used by FRCP.  ESI (electronically stored information) can be in a multiple of formats, including, CDs, DVDs, servers, backup tapes, desktops, lalptops, PDAs, portable hard drives, USBs, home computers etc.

What are native files?

When you save a file using a certain program, the file is often saved in a proprietary format only that program can recognize. For example, if you save a Microsoft Word document, it is saved as a Word document (.doc), Excel (.xls) etc. These are native files to the Microsoft Word application and may not be recognized by other programs. In the production phase of the discovery process, the native files will be converted into TIFF or PDF etc.

What is spoliation?

Spoliation is the intentional or negligent loss or destruction of evidence.

All too often, a party's position in litigation is impaired by the destruction, alteration or loss of crucial evidence during -- and sometimes even before -- litigation has begun. This is commonly referred to as "spoliation" of evidence. When the spoliation occurs, sanctions include: the striking of pleadings, entering of a default on the issue of liability, imposition of a negative evidentiary presumption, and the dismissal of a claim. (Jeffrey Shapiro. Spoliation of Evidence Can Spoil Litigation)

What does chain of custody mean?

The purpose of a chain of custody log is to prove that the integrity of the evidence has been maintained from seizure through production in court.  Chain of custody logs document how the data was gathered, analyzed, and preserved for production.  This information is important, as electronic data can be easily altered if proper precautions are not taken.  A chain of custody log for electronic data must demonstrate the following:  the the data has been properly copied, transported, and stored; the information has not been altered in any way; and all media has been secured throughout the process (LexisNexis – Applied Discovery fact sheet)

What is legal hold?

Legal hold is a process by which an organization must preserve and prepare all forms of electronic communication when litigation is reasonably anticipated. Potential custodians need to be notified that they should not delete any relevant information. (Exterro)

What is the “good faith safe harbor” rule?

FRCP Rule 37(f) precludes federal courts from imposing discovery sanctions against a party for failing to produce electronically stored information that was lost as a result of the routine, good faith operation of an electronic information system.

What is the “seven factors test” in cost shifting?

Based on the modifications to Rowe Entertainment Inc. v. William Morris Agency, Inc. 205 F.R.D. 421 case. the court in Zubulake’s case set forth the following seven factors:

  1. The extent to which the discovery request is specifically tailored to discovery relevant information;
  2. The availability of that information from other sources;
  3. The total cost of production compared to the amount in controversy;
  4. The total cost of production compared to the party’s ability to bear that cost;
  5. The relative ability of and incentive to each party to control costs;
  6. The importance of the issues at stake; and,
  7. The relative benefits to the parties in obtaining the information.

What is LexisNexis FRCP watch?

LexisNexis Applied Discovery offers updated case law, news and information related to recent changes to the FRCP.  It includes case summaries, case analysis and provides links to relevant documents.

What is the checklist for the e-discovery process?

  1. Plan for conference early when considering your response to a discovery request.
  2. Understand your retention policy and your method for responding to discovery requests.
  3. Determine if you are able to locate and access necessary data.
  4. Stop document destruction and enforce a litigation hold.
  5. Evaluate your document/email review software.
  6. Identify a team of experts and advisors.
  7. Identify possible issues regarding potential destruction.
  8. Assign tasks to key technology professionals.
  9. Identify a team of computer forensic experts.
  10. Test your plan 
    (Karen A. Schuler, ONSITE, Best Practices Discovery Checklist, Legal Tech, West Coast, 2007)

Do states have e-discovery rules?

Several states have their own electronic discovery rules and some have adopted partially or in full the new FRCP amendments.

Mirror the Federal Rules:

Arizona; Indiana; Iowa; Maryland; New Jersey.

Selective adoption:

New Hampshire (adopted meet and confer); New Mexico (all but preservation safe harbor); Washington (all but mandatory meet and confer)


Prepared by: Dittakavi Rao