Date post:11-Nov-2014
View:1,086 times
Download:0 times
Share this document with a friend
  • 1. EDRM Collection, Processing, Analysis Presented by: David Kearney www.linkedin.com/in/davidjkearney The Organization of Legal Professionals www.theolp.org February 2013
  • 2. The Phases of EDRMFour sessions 90 minutes each sessionI. Overview/CollectionII. Collection/ProcessingIII. ProcessingIV. Analysis OLP - eDiscovery Certificate Program
  • 3. EDRM - Overview http://www.edrm.net/ Stands for The Electronic Discovery Reference Model First launched in 2005 and released publically in 2006 Developed to provide a standardized approach to e- Discovery related activities Helps visually depict the movement of electronic discovery components from one phase to the next. Contains 9 phases/stages; Information Management Review Identification Analysis Preservation Production Collection Presentation Processing OLP - eDiscovery Certificate Program
  • 4. EDRM - Overview Stages standardize workflow Stages are not fixed sequentially Not meant as a literal, linear or waterfall model The EDRM is meant to be iterative in nature OLP - eDiscovery Certificate Program
  • 5. EDRM - Overview Stages Information Management Getting your electronic house in order to mitigate risk & expenses should e-discovery become an issue, from initial creation of electronically stored information through its final disposition. Identification Locating potential sources of ESI & determining its scope, breadth & depth. Preservation Ensuring that ESI is protected against inappropriate alteration or destruction. Collection Gathering ESI for further use in the e-discovery process (processing, review, etc.). Processing Reducing the volume of ESI and converting it, if necessary, to forms more suitable for review & analysis. Review Evaluating ESI for relevance & privilege. Analysis Evaluating ESI for content & context, including key patterns, topics, people & discussion. Production Delivering ESI to others in appropriate forms & using appropriate delivery mechanisms. Presentation Displaying ESI before audiences (at depositions, hearings, trials, etc.), especially in native & near-native forms, to elicit further information, validate existing facts or positions, or persuade an audience. OLP - eDiscovery Certificate Program
  • 6. EDRM - Overview Information Management Many issues can be better managed if this stage is taken seriously and implemented with consistent & sound practices. This is THE STARTING POINT for the entire process. Sound and comprehensive information management strategies aid organizations in the identification, preservation, and collection steps of the process and can lower the number of documents that need to be preserved, collected, reviewed and produced. This is where more organizations can GET IT RIGHT. Furthermore, risks and costs are reduced. OLP - eDiscovery Certificate Program
  • 7. EDRM - Overview Identification Locating potential sources of ESI & determining its scope, breadth & depth. OLP - eDiscovery Certificate Program
  • 8. EDRM - Overview Preservation Ensuring that ESI is protected against inappropriate alteration or destruction. OLP - eDiscovery Certificate Program
  • 9. EDRM - Overview OLP - eDiscovery Certificate Program
  • 10. EDRM - OverviewCommon TermsECA/EDA 2 definitions Legal End-to-End E-Discovery/Data - Analyze unstructured electronically stored informationProportionality Ways to Limit Burdens Court may look for ways to use proportionalityFRCP Federal Rules of Civil Procedure Governs all aspects of procedure for civil matters in United States District Courts Rules 26 to 37 - Discovery1/21/2013 OLP - eDiscovery Certification Course
  • 11. EDRM - Overview OLP - eDiscovery Certificate Program
  • 12. COLLECTION OLP - eDiscovery Certificate Program
  • 13. EDRM - CollectionGathering ESI for further use in the e-discovery process (processing,review, etc.). Once documents/files have been preserved (sometime one and the same), collection can begin Transfer/acquisition of data for review Includes; Servers, PCs, Macs, Linux, Windows, iOS, Android, handheld devices, flash/thumb drives tablets, MP3 players, phone systems, backup tapes, CD/DVD, databases (financial, CRM, ERP), structured/unstructured data, Cloud/Social Networking Sites Proper planning and careful implementation can reduce time & money spent Ensures integrity of evidence Proper collection can guard against future disputes (discovery about discovery causes unneeded rancor between parties) Process must be defensible, proportionate, efficient, auditable, and targeted. May impact and expand the scope of the discovery process Collection costs can be significant OLP - eDiscovery Certificate Program
  • 14. EDRM - CollectionYou Oughta KnowIn an Exchange/Outlook E-Mail environment, if auser deletes E-Mail from the deleted items folder(sometimes called double-deleting) the E-Mail isthen stored in the Dumpster on the Exchange Server.The administrator can set the Dumpster to retaindeleted E-Mail for a specified period or indefinitely.This should be a discussion point when looking tocollect data from an Exchange Server. OLP - eDiscovery Certificate Program
  • 15. EDRM - CollectionThe collection methodology for acquiring ESI in a legally defensible manner OLP - eDiscovery Certificate Program
  • 16. EDRM - CollectionA reasonable collection strategy must addresswhat ESI should be collected, when, and how What: The total corpus of potentially collectible ESI will usually have been defined during the process of formulating the internal preservation directive/litigation hold. Usually consists of four main categories of data locations: 1. Individual employee files 2. Department/group files 3. Enterprise databases 4. Backup Media OLP - eDiscovery Certificate Program
  • 17. EDRM - Collection When: Not all data identified for preservation needs to be collected right away. Some data may never need to be collected. Collecting all data that has been preserved may unnecessarily inflate costs and overwhelm the case team with irrelevant data How: Once the timing of collection from a data location has been decided, the team must assess what level of forensic defensibility should be employed for the collection OLP - eDiscovery Certificate Program
  • 18. EDRM - CollectionNormal collection processes generally involve straightforward copying, that maintains the integrity of themetadata, of the ESI as it exists on the systemA forensic protocol must ensure that the process iscarried out in a way that will produce reliableinformation consistently, so the individual conductingthe collection can testifyThe protocol must also provide for a means of verifyingthe integrity of the work that has been done bymaintaining an untouched mirror copy of the inspectedmaterials OLP - eDiscovery Certificate Program
  • 19. EDRM - CollectionMaintaining Integrity of MetadataThe single most important thing that can be done is to use a software or hardware write blocker. OLP - eDiscovery Certificate Program
  • 20. EDRM - CollectionMetadataSystem Metadata - Data about the architecture of the systemFile Metadata - Data about the data in a specific file that is recorded internal to that file OLP - eDiscovery Certificate Program
  • 21. EDRM - C
Popular Tags:

Click here to load reader

Reader Image
Embed Size (px)