I am often asked the question, "What is the difference between electronic discovery and computer forensics?" There is often confusion between the disciplines of electronic discovery (eDiscovery) and computer forensics, but from a civil litigation perspective the same rules apply to both. While both provide value in litigation, the differences are distinct. For starters, the pricing model is typically different. eDiscovery is often billed by the volume of data involved and the computer forensics pricing model typically revolves around hourly rates. However, the most important difference between eDiscovery and computer forensics is who analyzes the information.

Simply defined, eDiscovery is the process of identifying, preserving, collecting, processing, reviewing, and analyzing electronically stored information (ESI) in litigation. The computer forensics process involves identifying, preserving, collecting, analyzing, and reporting on digital information. As you can see they are very similar until the crucial difference, the responsible party for analyzing the information. In an eDiscovery matter, the role of the expert is to provide the information to legal teams in a reviewable format for the analysis. However when leveraging computer forensics, the expert will perform the analysis of the information and report the findings to the legal teams. The party performing the analysis of the electronic information, in my opinion, is the primary differentiator between eDiscovery and computer forensics.

Since most of you are fluent in how to properly leverage eDiscovery, I will discuss additional information of interest that is provided by computer forensics:

•  Determining timelines of computer activity
•  Determining electronic communications outside of conventional email
•  Recovering deleted information
• Analyzing Internet usage
• Analyzing social network usage
• Applications installed and executed
• Analyzing pictures and movies
• Peripheral device usage (USB drives, printers, etc)

There are matters in which we find that the "hybrid approach" is most successful. In these instances, we work with legal teams to develop the strategy for the case and obtain as much information as possible. We then perform the forensic analysis of the computer activity and provide the electronic documents to legal teams for their review. In both instances, the context of the information is obviously very important. When working with computer forensic experts, the more information you provide us surrounding the litigation matter, the more value we will be to you. In computer forensic engagements, we typically ask for the complaint and any relevant depositions. Once we have completed our review of the applicable sections, we schedule a meeting with the client to determine the objectives, discuss strategy, and ask questions. The goal of computer forensic experts is to meet the objectives outlined with the digital information available. I assure you the time investment made with your expert on the front end will pay dividends as the case progresses.

In any eDiscovery matter, there is the opportunity that the need for computer forensics will arise. For example, you have received the document production and the volume is a small fraction of what is expected. Your client provides information indicating that electronic information has been destroyed intentionally; you will now likely need computer forensics to determine if, when, and how the destruction occurred. For this reason, I always suggest choosing litigation support companies with a strong competency in both disciplines to maintain the momentum in your case. In addition, "interview" the potential experts ensuring a good fit for the case and working with your legal team.

The terms "eDiscovery" and "computer forensics" are often used interchangeably, but there are clear differences. It is my opinion that the critical difference is the analysis of the information. In an eDiscovery engagement, the legal teams review and analyze the information. In computer forensics, the expert reviews the digital information and provides the findings in an expert report. Because experts can vary greatly in experience, capabilities, and communication skills, choose the right expert carefully.    

Confusion Carries the Day in E-Discovery

Party's Spoliation to be Treated as Criminal Contempt and Defendant Sentenced to Two Years of Imprisonment Unless He Pays Attorney's Fees and Costs

Multiven, Inc. v. Cisco Sys. Inc.

2010 WL 2813618 (N.D. Cal. July 9, 2010)

In this antitrust litigation, the court adopted the magistrate judge's recommendation directing the plaintiff and counter-defendant to retain a third party vendor for assistance with further data collection, search, review and production. Having earlier rejected the idea of using an outside vendor, the producing parties instead relied on approximately five attorneys to review a "giant mass of information" without using search terms. Concerned by the looming discovery deadline and anticipating "no end in sight" to the process, the court agreed that "something must be done." The court approved the order recommending that a vendor "assist with this increasingly perilous situation," with the defendant paying half of the costs as it so offered. Noting that "there are several more [discovery] problems on the horizon," the court additionally recommended granting full authority to a previously appointed special master to help the parties resolve any further discovery issues, such as choosing a third party vendor if the parties could not reach an agreement, crafting a search protocol and establishing deadlines.

Order Stipulates Acceptable Formats, Methods and Required Content of ESI Preservation

In re Toyota Motor Corp. Unintended Acceleration Mktg., Sales Practices, and Prods. Liab. Litig.,

2010 WL 2901798 (C.D. Cal. July 20, 2010)

In this products liability litigation, the court entered a preservation order based on the parties' submissions regarding preservation methods and categories of content to be preserved for production and use in the ongoing multidistrict litigation. Among the ESI preservation requirements, the parties were ordered to retain existing documents in their existing form or in a reasonably usable format that would not result in loss of content or usability, including the preservation of metadata and e-mail attachments. Additionally, all subsequently created ESI was required to be retained in original or native format, or copied to an alternative storage device or media. The order also provided instructions for the identification of custodians and specified data that was not required to be preserved, such as "system" data created by the normal operation of computer systems. Finally, the order identified the permissible modifications and alterations of documents generally resulting from the routine maintenance and operation of computer systems.

Court Affirms Dismissal with Prejudice for Intentional Wiping of Hard Drives

Peal v. Lee, 2010 WL 3001338 (Ill. App. 1 Dist. July 30, 2010)

In this defamation action, the plaintiff appealed the circuit court's dismissal with prejudice following his failure to comply with discovery requests and intentional destruction of evidence. On appeal, the court affirmed the circuit court's order based on review of testimony from the defendants' computer forensic expert that indicated the plaintiff obtained a new hard drive and "used seven different data 'wiping' programs to permanently delete data" from his personal computer just days prior to its surrender. Forensic investigation of the personal computer also indicated the plaintiff failed to produce as many as five external storage devices that may have contained discoverable information. In affirming the order's severity, the court berated the plaintiff for seeking "to cover up his electronic tracks by subterfuge" and making an argument of "pure pettifoggery" on appeal, characterizing his actions as "the personification of bad faith" and a "deliberate, contumacious and unwarranted disregard of the court's authority." Finally, the court denied the defendant's request for monetary sanctions finding dismissal an adequately severe sanction.

"Flagrant Defiance" of Court Orders and Discovery Obligations Results in Dismissal

Aliki Foods, LLC v. Otter Valley Foods, Inc.,

2010 WL 2982989 (D. Conn. July 7, 2010)

In this breach of contract and implied warranty litigation, the defendant sought dismissal, and the plaintiff moved to vacate prior orders to preserve and produce discovery-related electronic materials. Responding to allegations of stonewalling and spoliation of ESI, the plaintiff claimed that its principal's hard drive "failed" (suspiciously coinciding with the court's order to produce it). Moreover, months after the court ordered the drive to be forensically imaged, the plaintiff signed it over to a non-party - its principal's new employer - without ever attempting to comply with the order. Having "lost patience," the court found that the plaintiff's "flagrant defiance" of numerous court orders and warnings, intentional destruction of computers and hard drives, and blatant disregard of discovery obligations, failed every factor of the Second Circuit's test. This bad faith conduct resulted in a "tremendous waste of resources" and left dismissal as the only viable sanction.