Conventional wisdom has it that a forensic collection of electronic data is necessary only where fraud is suspected or imminent destruction is feared. Equally unthinking, to my eye, is the opposite assumption, that a full disk image must be taken of every relevant PC, server and other device, just in case the data might be needed, regardless of the cost.
Prefacing this, as usual, with confirmation that I am well aware that many cases need no more than a few minutes with Windows Explorer and a DVD-writer to collect the data required for electronic disclosure, let’s have a brief canter over the ground which opens before a solicitor when he gets the first call from a client to say that litigation is in contemplation or has actually arrived.
Although litigation and analogous proceedings often give rise to frantic rushing about, the collection decisions are the one area of which one often gets no notice and for which there is sometimes only one opportunity to get it right. Most aspects of e-disclosure can be decided upon relatively at leisure – I don’t mean you have all the time in the world, but you do not generally have to make a decision NOW which affects the whole conduct of the case.
What set me thinking about this was a newspaper article about a book called The Unthinkable by Amanda Ripley, which analyses our response to physical disasters such as plane crashes. The central proposition is that the immediate hormonal responses which serve us well when the threat is purely physical (such as being attacked) are less helpful when any amount of complex thought is required. Fire-drills, the safety talk given by air-hostesses, and military training are designed to engender an automatic response which gets us over the immediate decision-making which we are otherwise ill-equipped to handle.
It is perhaps comforting to know that the mental paralysis with which most of us are familiar when important choices must be made quickly are a matter of hormones rather than personal failings. It is helpful also to think that the idea that “the training takes over” offers us at least a partial solution. Ripley says “The brain’s got to have options, an alternative script. Even a tiny amount of knowledge can make a big difference”. If the relative costs and other implications of a data collection seem trivial compared with being in a Boeing 737 sinking fast into the freezing Potomac (one of Ripley’s examples), that is little consolation when the call comes and you have no clue what to do, or what the implications are of one course rather than another.
Let’s assume that your clients have done little to prepare – no coherent document retention policy, no litigation readiness plan, no EnCase installation ready to trawl the network for responsive documents. What is the plan?
Let’s skip the lengthy explanations about analysing what sort of case this is, what the detailed implications are of full-disk imaging, copying empty space and slack space, forensic versus non-forensic collections and all the other factors which go into an informed decision about which sources might exist and might be significant. Let’s also reckon that at this stage you are not sure what the issues are, which players matter, and what the relevant time-frame is, and assume that, whilst you may be alert to the fact that all these elements matter, you are not equipped to make informed choices about them.
Let’s assume, in other words, that you are in the position of the aeroplane passenger who anticipates a crash. We all affect to be uninterested as the stewardess tells us about emergency doors, inflatable jackets and the rest, but the reality is that, luck apart, it is factors like this and the proximity to the nearest exit which decide our personal outcome as the icy waters of the Potomac rise to meet us.
It is not the detailed steps which count or, rather, the possible permutations of events are too many and various for us to anticipate them all. What matters is how we react to the immediate crisis at a time when our detailed thinking mechanism is frozen (as we are now told) by the operation of cortisol and adrenalin on our brains.
What matters, really, is not knowing in any depth what a forensic collection is and why you might need one, but knowing that a choice exists. All litigation solicitors keep a list of barristers on speed-dial, someone they can ring when their trained reflexes tell them that there is a choice to be made quickly whose implications may only be guessed at but which are nevertheless critical. The same applies to urgent data collections. You need someone to ring.
Bogging it up takes two extreme forms. One is to pass up the only chance to collect information whose presence or absence is critical to your client’s ability to bring or defend proceedings. The other is to spend a disproportionate amount of money collecting far more than is necessary, disrupting your client’s business whilst you are at it as every PC, laptop, server, BlackBerry and mobile phone is called in for forensic analysis and imaging.
The general perception is that the use of a forensic expert for data collections is always expensive and therefore rarely proportionate for civil litigation outside clear cases of fraud. I would challenge that. This view does not discriminate between the act of collection and what happens to the data thereafter – it is the processing and the review which costs money and not necessarily the bare act of collection. Not every efficient and professional collection has to involve full disk images of every piece of equipment, but the people who are geared up to do forensic collections are those best equipped to collect on any basis which is proportionate – and, indeed (if they are any good) to give input into the scope of the collection process.
The big proviso is the bit in parenthesis – “if they are any good”. Like everyone else in this business, forensic experts promote their strongest skills, just as every other provider advertises by reference to its biggest cases, and their value for routine cases gets lost in (often wholly justified) claims about larger and more specialist matters. They, no doubt, could refine their approach to the market. You, the lawyer who may find an urgent new case on your desk tomorrow, need to go out and identify the expert you would want on your side in that event, just as you know which barrister to call.
I will expand in another article on why this ties in with the courts’ increasing insistence on focusing first on the issues and document sources which matter most, and coming back if necessary to wider issues and sources later. It is fairly obvious really – if you captured documents economically at the outset, it is easier to decide to defer processing and review of wider sources. The key word is “economically” and you cannot decide what is economic if you have not discussed with a suitable expert (or preferably more than one) what the costs might be in principle, and if you do not have some idea what the mechanics are of collecting data of specific file types from defined custodians across a selected data range – this much you are going to have to do for any case if you are not to collect absolutely everything indiscriminately.
Nothing said here makes it necessary to commission external help for simple cases, nor does it apply to companies (and there are many of them) whose continuing requirements are such that they should have in-house tools, skills and processes against every foreseeable eventuality.
All I am suggesting here is that, like knowing the fire drill and noting the air crash escape routes, you should know what you would do, and who you would call, if the e-discovery equivalent of a fire or crash should cross your desk one morning.