Top Three Reasons to Retain an Independent Digital Forensic Examiner During or in Advance of Discovery or Investigations

Digital forensics has emerged in response to the rising necessity of preserving, analyzing, and interpreting digital evidence. Digital evidence is one of the most pivotal points in the discovery phase of modern litigation, where effective management of relevant data can substantially reduce risk and influence the outcome of a case. 

The landscape around electronic data identification and the collection process can be complex and challenging. For those without a defensible and repeatable collection and preservation process, key evidence may be lost, resulting in adverse inferences, monetary sanctions, malpractice claims, and disciplinary actions. Leveraging an independent digital forensic expert during discovery in litigation, in tandem with technical and litigation support staff, will mitigate the overall risk and exposure. 

There are several complexities when it comes to finding an independent, objective, and responsive expert for your litigation needs, read on to learn three pain points that Capsicum can help you navigate during eDiscovery.

1.    We can help you to avoid the pitfalls of self-collection – “Why can't I just have my IT person turn over the emails?”

The term “self-collection” refers to clients desiring to collect their own data. Self-collection is perceived by some clients as a less costly and less intrusive alternative to engaging an independent third-party service provider. Self-collection must be carefully scrutinized, as it may open the door for inquiries as to the collection’s defensibility. 

For example, when an organization or a member of the organization’s IT staff self-collects data, the argument can be made it might have been done with a certain amount of prejudice. This opens the door for opposing counsel to allege that an integral piece of evidence might have been left out. With these concerns in mind, the general rule is that having a client collect its data should be avoided or at a minimum augmented by a neutral third party; particularly where the client does not have the appropriate people, process, and technology in place to defend and repeat the collection methodology. The solution is to outsource, moving the onus of the collection to an independent digital forensic examiner. 

The “appropriate people” does not simply mean the in-house IT staff or the employee most proficient with technology. Rather, the appropriate people should be those who are not only technologically savvy but also those who are familiar with the challenges and obligations that arise during the legal eDiscovery process. Is your team ready to be deposed or testify in court? Particularly considering the specialized knowledge required for grappling with the obligations of discovery orders or interrogatories the average client or custodian will likely not be the ideal (or trustworthy) candidate for the appropriate collection of electronically stored information (ESI) for litigation. As one court stated: “It is unreasonable to allow a party's interested employees to make the decision about the relevance of such documents, especially when those same employees have the ability to permanently delete unfavorable email from a party's system. … Furthermore, employees are often reluctant to reveal their mistakes or misdeeds.” Northington v. H&M Int. (N.D. Ill. Jan. 12, 2011)

Next, “appropriate technology” refers to advanced technology that can accomplish the needs of an digital forensic collection. For example, running a search using the built-in search feature in Outlook will likely be insufficient (and can often lead to disparate results). To locate all responsive e-mails, specialized tools should be used so that otherwise non-searchable data can be indexed and searched with advanced query languages and syntax.

Finally, an “appropriate process” should be both repeatable and defensible. This is the ideal outcome for data collection. This process should be unique to the client's IT infrastructure, should be documented, and should be able to be followed and reproduced. Often in self-collection, methods or transferring and saving data can cause some of the underlying metadata to change (copying and pasting documents onto a thumb drive is not the best idea). Particularly when metadata is critical to the claims or defenses of the underlying matter, the appropriate process is needed not only to ensure a complete collection but also to avoid allegations of spoliation. This leads to the next main reason to work with an independent digital forensic examiner…

2.    We preserve the integrity of the data and collection process – “Why would I pay when I can have my paralegal take a screenshot of this social media post?” 

Given the popularity of screen capturing tools on phones and computers, many practitioners may believe that they have the in-house capability to preserve digital evidence on their own. However, it is all too easy to forget the aforementioned pitfalls of “self-collecting” electronically stored information (ESI).  You might ask why it matters how data is collected: if the document, email, database, or folder can be read, then what is the worry? The worry is admissibility.

As described above, self-collection risks under-collection, spoliation, changes to metadata, chain-of-custody challenges, and questions of authenticity. Instead, you should select experts who can assure authenticity, traceability, repeatability, data integrity, and confidentiality, all of which ultimately lays a strong foundation for evidentiary reliability and admissibility.

Going one step further, certain types of data will likely only be obtained by a skilled digital forensic expert. For instance, in a recent matter, Capsicum recovered inculpatory ESI, which led to a prompt settlement of the case; however, the data was only located in “unallocated” areas of the hard drive (i.e., deleted files), and was recoverable only with the use of specialized tools. The process of recovering deleted data is as critical as interpreting what the data includes. Common items such as internet history, deleted text messages, phone apps, and social media all play a large part in a litigation case. 

Additionally, Rule 37 applies to a party’s failure to take “reasonable steps” to preserve electronically stored information in anticipation of or during litigation. Under Rule 37, the parameters for ESI preservation require corporations, individuals, and their attorneys to retain and produce the appropriate types of data. The decision to partner with an expert can avoid preventable pitfalls, such as missing important evidence, foregoing recoverable data, failing to establish a chain of custody, and altering of the ESI or metadata.

3.    We communicate and navigate the realities of the data – “We need to know if the data helps our case, but we especially need to know if the data hurts our case.”

The ability to present the data can make or break a case. Effective management of eDiscovery can have an equal, or in some circumstances, greater effect on the outcome of litigation than the actual merits of the case. No one gets to summary judgment, trial, or in most cases, a settlement, without first going through the discovery minefield. Accordingly, most litigants would have a distinct advantage with a trusted advisor helping to interpret and present the realities of the story being told by data. 

Take for instance the above example of recovering a “smoking gun” communication from the unallocated space of a computer’s hard drive. At first glance, this highly technical, jargon-ridden process could be off-putting or unpersuasive to a technological neophyte unfamiliar with the storage mechanism of a computer. Presenting recovered data in a clear way that explains complex terminology in an easy-to-understand way is crucial. 

Sometimes, the reality of a situation will require a digital forensic consultant to tell clients what they need to know, even when they do not want to hear it. Data can convey the indisputable reality that clients entrenched in a legal controversy will often renounce or deny. However, being able to address and take ownership of negative inferences drawn from data at an early stage can prevent fatal consequences from arising later in the litigation process.

Finally, the credibility of an expert witness is vital to the success of your case and the well-being of your client. The baseline requirement of a digital forensic expert is competence, as well as the ability to deliver an explanation and breakdown of complex terms and industry jargon. Data can tell an indisputable story; but with Capsicum’s 20 years of experience in eDiscovery, that story can be presented to courts and juries in a digestible and relatable fashion. You must also be able to trust in an expert’s ability to relay findings calmly and confidently while undergoing rigorous cross-examination. 

Partnering with a trusted digital forensic provider can lead to the successful handling of e-discovery challenges. Complex technological tasks can be completed more efficiently, on time, and within budget. By working together, our team can work with you throughout litigation to transform challenges into proactive management and head off many issues that may be lurking in your eDiscovery obligations.