Logo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Forensic Discoveries Newsletter

December 2008
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Welcome to Knoxville's EDiscovery and Computer Forensics Newsletter. Keeping you and your practice informed of the ever-changing realm and value of Electronic Discovery and Computer Forensics is the purpose of this newsletter. If you have a colleague that may be interested in subscribing, follow the instructions at the bottom of this newsletter to be added to the distribution. If you choose not to continue receiving this newsletter, follow the directions at the bottom of this newsletter and accept our apologies for intruding.
in this issue
Company Press Release
Upcoming Speaking Engagements
Steps to Get EDD Right From the Start
A New Year's e-Resolution: Sending Safe e-Mail
EDiscovery Case Law
Previous Newsletters
 
We hope you enjoyed last month's article "26.02(5) The Clawback". Due to a steady increase in new subscribers, Forensics Discoveries will continue to list previous newsletters. As others have done, please let us know of a specific topic you would like to see covered.
 
Below is a review of our previous newsletters:
 

August 2007 - "What is Computer Forensics?"

September 2007 - "Preparing Your Clients for EDiscovery - Part 1"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Company Press Release

Happy Holidays to each of you from Forensic Discoveries. Last month's content on the "clawback" and metadata received a popular response from our readers. The metadata topic also prompted many questions about the details and examples of metadata. As requested, next month's newsletter will have a section specific to the topic of metadata.

Forensic Discoveries is pleased to announce an exciting acquisition. As of December 15th 2008, Forensic Discoveries is now a division of Sword and Shield Enterprise Security. Below is the press release from Knoxnews.com:

Sword & Shield Enterprise Security said today it has acquired Forensic Discoveries LLC, a fast-growing East Tennessee company specializing in computer forensics and electronic discovery.

Sword & Shield Enterprise Security is based in Knoxville with an office in Washington D.C. The company provides security for computer systems and company networks. Clients are in state and local government, retail corporations, education, health care, manufacturing, banking, energy, and utility companies. The company has a large contract with the FBI for security assessments and a $31 million NASA government procurement contract for information technology products.

Major government-based customers include the U.S. Justice Department, the U.S. Geological Survey, NASA, the U.S. Bureau of Land Management, the White House, the U.S. Defense Department and the U.S.D.A. The company has a large contract with the FBI for security assessments and a $31 million NASA Solutions for Enterprise-Wide Procurement (SEWP) Government-Wide Acquisition Contract (GWAC) contract for IT products.

"This acquisition demonstrates the commitment by Sword & Shield to become an industry leader in digital forensics and electronic discovery with the same dedication that has made them a nationally respected information security firm," said Bill Dean, founder of Forensic Discoveries and director of computer forensics at Sword & Shield.

"Forensic Discoveries will compliment the current professional service offerings of Sword & Shield by providing a division that is focused on the growing demand for both digital forensics and electronic discovery."

Sword & Shield said the market for computer and network forensic services continues to be strong as corporations are burdened with the increase of data theft, employee theft, employee compliance and policy violation, embezzlement, fraud, and other cyber crimes. Corporations are continuing to struggle with electronic discovery and complying with the amendments to the Federal Rules of Civil Procedure established in 2006. Research projects that ediscovery technology spending will increase to more than $4.8 billion by 2011, which has prompted Forensic Discoveries to expanded at a rapid rate.
 
The full press release can be read here

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Upcoming Speaking Engagements


Document Retention and Destruction in Tennessee
January 22, 2009
"E-Discovery 101 and the Laws that Govern"
More information and registration can be found here

Tennessee Private Investigators Association

March 13th, 2009
"Computer and Cell Phone Forensics"
More information can be found here


Forensic Discoveries is also planning to hold numerous "lunch and learn" events in 2009 covering the topics of EDiscovery, Computer Forensics, and the technical interpretations of the laws that govern electronic discovery. We are working with the CLE commission to obtain CLE credit for these events and will update as dates are determined. If you are interested in attending or would like to request specific content please email with subject line "Lunch and Learn".
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Steps to Get EDD Right From the Start - by Craig Ball


Craig Ball, a trial lawyer and computer forensics/EDD special master, recently published a great article for Law Technology News titled "Steps to Get EDD Right From the Start". This is a great article for both the attorney that has eDiscovery experience and those that have yet to embark on this journey.




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A New Year's e-Resolution: Sending Safe e-Mail

Below is a very good article on email mishaps. We have all done it or at least witnessed someone else that experienced the regret.

"Sender's remorse. You've experienced it. You type an e-mail, probably too quickly, perhaps while simultaneously talking on the telephone or otherwise multi-tasking, and, no sooner do you hit the "Send" button than you realize that you sent the e-mail to the wrong addressee, or you hit "Reply To All" when you intended to hit simply "Reply," or you made some other error that you caught only after you had moved that mouse up and to the left, stopped the arrow on the "Send" button, and clicked."

 Read the rest of the article with tips here
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
EDiscovery Case Law


Court Orders Expedited Discovery, Citing Preservation Concerns
   
Allcare Dental Mgmt., LLC v. Zrinyi, DDS, 2008 WL 4649131 (D.Idaho Oct. 20, 2008).

In this libel case, the plaintiff sought limited expedited discovery prior to the Fed.R.Civ.P. 26(f) conference. The plaintiff sought permission to serve a subpoena duces tecum on the third-party internet service provider, requiring it to produce identifying information for the "Doe" defendants and also sought to image the named defendants' hard drives. The plaintiff argued the expedition was necessary to ascertain the "Doe" defendants' names and to preserve relevant ESI. Granting the plaintiff's motion, the court noted that service providers typically retain user activity logs for a limited period of time and that the information was necessary for the litigation.  Additionally, the court ordered the defendants to make any computer, portable, or detachable hard drive available to the plaintiff's computer forensic expert for imaging, citing the defendants' previous behavior of service evasion, which gave rise to the assumption that it had little respect for the legal process or the requirement to preserve electronic data.  In order to prevent prejudice to the defendants, the forensic expert was ordered to keep the images confidential and file them under seal. 

~~~~~~


Court Allows Party to Designate Entire Documents as "Confidential" to Avoid Burden of More Extensive Review During Discovery
 
Containment Technologies Group v. Am. Soc'y of Health Sys. Pharmacists, 2008 WL 4545310 (S.D.Ind. Oct. 10, 2008).

In this defamation case, the defendants moved to compel production of documents containing trade secrets, and the plaintiff moved for a protective order. The parties began negotiating a proposed protective order, but could not agree to specific terms. The defendants argued that a protective order was unnecessary and that the "confidential" designation should only apply to those portions or pages that are confidential, while the plaintiff wanted to designate the entire document as confidential. Requiring higher scrutiny for a confidential designation for documents filed under seal as opposed to those produced during discovery, the court allowed the plaintiff to designate entire documents as confidential if done so in good faith.

~~~~~~


Court Orders Party to Craft Search Protocol for Computer Inspection
 
Hoover v. Fla. Hydro, Inc., 2008 WL 4467661 (E.D.La. Oct. 1, 2008).

In this contract dispute, the plaintiff moved to quash the defendant's subpoenas duces tecum issued to two third-party individuals demanding computer equipment for inspection. The plaintiff argued the subpoenas were unwarranted, unduly burdensome and were a "fishing expedition." The defendant disagreed with the plaintiff, arguing the subpoenas were issued with good cause. Finding the first individual sufficiently responded to a previous subpoena, the court granted the motion to quash. Regarding the second individual, the court denied the motion to quash determining there was relevant information on the requested computer. The court ordered the defendant to prepare a search protocol for inspection of the individual's computer that excluded privileged communications.


~~~~~~


Court Creates Protocol to Govern Parties' E-Discovery

D'Onofrio v. Sfx Sports Group, Inc., 2008 WL 4737202 (D.D.C. Oct. 29, 2008).

In this employment discrimination litigation, the defendants filed several motions, including a motion for leave to designate an expert to design a search protocol. Previously, the court stated the lawyers should rely on IT professionals to create a protocol that was easily understood. After the defendants proposed a highly technical search protocol, the court decided to create one of its own that included: search parameters and locations, time limits and a requirement that the defendants must restore newly discovered ESI.


~~~~~~


Court Denies Additional Production Following a Search Process Miscommunication

Ross v. Abercrombie & Fitch, Co., 2008 WL 4758678 (S.D.Ohio Oct. 27, 2008).

In this securities litigation, the plaintiff requested the court to order the defendant to produce an additional 95,000 documents "hit" by a revised keyword search. The plaintiff argued these documents would most likely have been produced had the defendant understood the list of "Search Term Revisions" supplied by the plaintiff to be supplemental rather than replacing the plaintiff's previous list of search terms. The defendant argued it should not have to spend the time and resources to review and produce the additional documents under the revised search terms since the requested documents would likely be irrelevant and because it previously produced over one million pages of documents. Determining the plaintiff failed to meet its burden and show that the documents' likely relevance outweighed the review and production costs, the court denied the plaintiff's motion.



~~~~~~


Court Stresses Importance of Rule 26 and Encourages Cooperation Among Parties in Discovery

Mancia v. Mayflower Textile Servs. Co., 2008 WL 4595175 (D.Md. Oct. 15, 2008).

In this collective employment action, the plaintiffs raised issues regarding numerous discovery and supplemental interrogatory requests. The defendants objected to these requests with, "boilerplate, non-particularized objections." Frustrated with the party's inability to approach discovery responsibly, Chief Magistrate Judge Paul W. Grimm scheduled an in-court hearing to discuss the discovery violations and issued this opinion to explain concerns and instruct counsel on how to reach resolution.  Judge Grimm stated that the failure to abide by Rule 26(g), requiring particularized facts for a discovery objection, was one reason for the excessive costs of discovery. He also stated that, "discovery must be initiated and responded to responsibly, in accordance with the letter and spirit of the discovery rules, to achieve a proper purpose, and be proportional to what is at issue in the litigation, and if it is not, the judge is expected to impose appropriate sanctions to punish and deter."  Due to the lack of record establishing an estimated amount in controversy, the court ordered the parties to meet and confer in good faith to: estimate a likely range of provable damages to quantify a "discovery budge" that is proportional to what is at stake in the case, discuss the additional discovery sought by the plaintiffs and attempt to reach an agreement, and provide the court with a status report indentifying any unresolved issues.   


~~~~~~


Court Declines to Require Perfection in Production

S. Capitol Enterprises, Inc. v. Conseco Services, LLC, 2008 WL 4724427 (M.D.La. Oct. 24, 2008).

 In this ongoing electronic discovery dispute, the plaintiffs sought sanctions and/or additional discovery orders claiming the defendants failed to comply with a previous discovery ruling. The plaintiff claimed the defendant failed to produce 1,000 relevant documents, however the court stated that the likely benefit in having more documents produced was outweighed by the burden and expense associated with retrieving the evidence.  The court noted that "perfection in document production is not required," and held that experts were allowed to estimate based on the data already produced.

~~~~~~


Court Denies Motion to Compel After Party's Assertion Under Oath Regarding Production

Oldenkamp v. United Am. Ins. Co., 2008 WL 4682226 (N.D.Okla. Oct. 21, 2008).

In this case involving the payment of health insurance benefits, the plaintiffs filed a motion to compel discovery responses or an adverse inference for spoliation. The plaintiffs claimed responsive documents were not produced, and that the defendants either destroyed or failed to preserve these documents after notice of litigation. The plaintiffs sought recordings of telephone conversations, e-mails and internal company communication reports. Arguing a litigation hold was in place, the defendant claimed all e-mails were produced and no records were destroyed. Noting a party cannot be ordered to produce documents which do not exist, combined with the defendant's assertion under oath that all responsive documents were produced, the court denied the motion to compel. The court also denied sanctions finding the plaintiffs failed to produce evidence of intentional destruction.



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Forensic Discoveries is available to provide onsite presentations or Q&A sessions on topics such as Electronic Discovery, Technical Implications of the updated Federal Rules of Civil Procedure, or Computer Forensics. Forensic Discoveries is also available to you, obligation free, to answer any specific questions pertaining to these topics. Simply give us a call and we will be glad to answer any questions pertaining to Electronic Discovery and Computer Forensics.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contact Information
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Phone:    (865)-809-7590

Address: 1431 Centerpoint Boulevard, Suite 150

              Knoxville, TN 37932

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

If you have a topic that you would like addressed in the newsletter, please let us know. Either visit http://www.forensicdiscoveries.com/newsletter.html and submit your suggestion there or reply to this e-mail with your suggestion. 

For previous versions of Forensic Discoveries EDiscovery newsletters, visit http://www.forensicdiscoveries.com/pastnewsletters.html  

 

This document does not provide legal or other professional advice and should not be relied upon as anything other than a starting point for research and information on the subject of electronic evidence and computer forensics.

Quick Links...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~