Active-File eDiscovery Comes First

by James Berriman, Esq.

In most commercial litigation, the primary focus of eDiscovery should be active user files rather than forensic analysis.

Active files are simply the normal undeleted files stored on a hard drive or other digital storage device. They are the files you see listed in a file system directory like Windows Explorer.

Active-file eDiscovery involves collecting, culling, and reviewing files of the type relevant to the dispute. In most commercial cases, these are ordinary user-created files like emails, Word documents, Excel spreadsheets, PowerPoint presentations, PDFs, and perhaps some specialized filetypes specific to the industry at issue (design files, source code, advertising graphics, etc.).

Such files are the electronic equivalent of hardcopy business records. They comprise the correspondence, memos, reports, invoices, and other records of a company. Reviewing these files is the province of the attorneys on the case, because attorneys know how to assess substantive relevance, responsiveness, importance, and privilege.

Forensic analysis, on the other hand, involves looking deeper than the face of the active user files. It involves looking at things like fragments of partially-deleted records, system caches that contain copies of old data, system databases (like the Windows Registry) that provide evidence of user activity (like whether a user attached a memory key to a computer the day before leaving the company), and other types of "under the hood" analysis. It involves ferreting out technical clues that an attorney would not see on the face of the active user files. Reviewing this information is the province of the forensics expert who knows how to assess the cryptic data involved in forensic analysis.

If we were to make a rough analogy to traditional paper discovery, active-file eDiscovery is like looking in a company's file cabinets, manila folders, and corporate books to find its ordinary business records. It is simply the modern equivalent of the traditional review process that attorneys know so well, albeit with the added advantages that arise from working with electronic rather than paper documents (the ability to deduplicate, to use keyword filters, to search, to copy, etc.). Forensic analysis, on the other hand, is more like looking through a company's shred bins and wastebaskets to piece together what has been lost or hidden.

Accordingly, active-file eDiscovery should be the primary focus of most commercial litigation. Forensic analysis is typically reserved for special cases involving allegations or issues of spoliation, fabrication, or other specific misconduct.

It is therefore important to remember that in almost every commercial litigation, you should first have a plan to address traditional active-file eDiscovery. That is where most of your evidence will be found, and that is where the attorneys will spend most of their time assembling the evidence to support their client's case. The tail of forensics should not wag the dog of active-file eDiscovery (unless the very subject matter of the case is predominantly forensic).

© 2009 James Berriman. Please note that this blog post does not constitute legal advice.