Post Process

Everything to do with E-discovery & ESI

Archive for November 9th, 2007

E-Discovery Pitfalls: Court dictates collections and search protocols

Posted by rjbiii on November 9, 2007

The latest in our series on e-discovery pitfalls.

K&L Gates has posted an opinion in which U.S. Magistrate Howard R. Lloyd dictates the collection and search protocols of a set of data over which the parties have become somewhat contentious. Let us begin with His Honor’s description of the dispute:

According to defendants, there are two hard drives in question. In July 2007, they reportedly made bit-for-bit copies of those hard drives (including recovered deleted files and fragments) and produced documents responsive to plaintiff’s requests. Plaintiff is skeptical about the production.

Well, the requesting party is always skeptical, isn’t it? What circumstances give merit to plaintiff’s suspicions?

[Plaintiff/Requesting Party] says that, to date, defendant Romi Mayder has produced only one email pertaining to his work at Silicon Test Systems, Inc. whereas Bob Pochowski, a third-party witness, has produced a host of documents (emails, data sheets, and the like) from Mayder that apparently were created during Mayder’s employment at Verigy.

Oops. This illustrates the dangers of working with highly distributable and “copyable” documents, such as e-mail, and not producing a full set (for whatever reason). Even in the days of paper, you never knew where all the copies might have been hiding. In this digital age of ours, with the ease of replication and distribution, the dangers are exponentially higher. So let us remember two things: do a good job on formulating an appropriate search protocol; and, of course, never deliberately exclude relevant documents not subject to privilege from production. But the court isn’t finished with plaintiff’s suspicions.

Verigy also contends that other documents produced to date demonstrate Mayder’s willingness to manipulate evidence. Plaintiff also asserts that, when defendant Mayder left plaintiff’s employ, a system or software upgrade was performed which may have deleted files from defendants’ hard drives.

So now they walk beyond the line of suggesting the producing party could have accidentally failed to produce, but suggest defendant is indifferent with respect to its obligation to produce, or that it even purposefully manipulates data to protect itself. This serves to illustrate the importance of following a defensible, documented collection plan. The documentation may serve to refute allegations of impropriety or mismanagement. The importance of retaining a third party to execute the collection process is also on point, as such an expert tends to lend an objective voice to any dispute over procedure.

Now, this next bit is interesting, and potentially really bad for the defendant.

[Requesting Party] argues that it needs to conduct additional discovery of those hard drives, not only to determine whether any relevant documents have been withheld from defendants’ production, but also to examine what may have happened on the hard drives and why.

The requesting party wants to examine the drives to see if defendants failed in their responsibilities. The request is not made merely for the sake of satisfying their curiosity. The possibility that such intrusive measures might be allowed should be a warning shot over the bow for any party engaged in discovery. Make sure your processes are thorough, managed competently, well documented, and defensible.

[Producing Party does] not dispute that a system or software upgrade was performed which may have deleted files from their hard drives. However, they maintain that all deleted files have been recovered and preserved and that they have produced all information responsive to plaintiff’s requests.

All deleted files have been recovered? That’s far from certain, especially with respect to an operation as extensive as a software upgrade. The percentage of deleted files forensically recovered is based on many factors. Was “wiping” involved? If not, has the drive been defragmented? What is the “data turnover” (number of files deleted vs. number of new files written to the drive) of the drive at issue? Under only a very limited set of circumstances might one be able to say with any semblance of certainty that every single deleted file was recovered. As we see, the judge doesn’t appear convinced either. Upon considering the arguments, the court sets a two-tiered plan into place.

Defendants propose a two-tier protocol which (a) permits discovery in areas that defendants deem presumptively relevant; and (b) allows plaintiff to request that the expert conduct other searches, subject to an opportunity by defendant to review and object to the proposed search requests.

Defendants sought to protect themselves from abuse:

Defendants express concern that plaintiff will propound unduly burdensome or otherwise abusive searches beyond the scope of permissible discovery under Fed.R.Civ.P. 26. At the motion hearing, it was suggested, somewhat facetiously, that Verigy might attempt to request a search for all documents with the letter “A.” Indeed, documents submitted on supplemental briefing indicate that Verigy apparently has previously requested a search for all documents containing the letter “V” (see Pasquinelli Decl., Ex. C)–a request which strikes this court as being patently overbroad.

In an interesting note, the requesting party argued that disclosure of additional search terms it wanted to use might infringe attorney work product. The court, however, was not persuaded.
In concluding its opinion, the court felt the urge to remind counsel and the parties of their duties under the law:

Although it should go without saying, the parties are admonished to proceed in good faith and to refrain from conduct designed to unnecessarily encumber or retard discovery or to impose unnecessary expense or burden on the opposing parties or the court.

To reiterate the lessons of the case: engage in an honest, thorough, and well documented discovery plan; think about retaining a third party to serve as an objective, knowledgeable voice; and scrutinize the implementation of processes (such as software upgrades) that endanger the integrity of the litigation hold.

Posted in 9th Circuit, Case Summary, Computer Forensics, Discovery Requests, Motion to Compel, N.D. Cal., Search Protocols | Tagged: , | Leave a Comment »