Category Archives: ECA

April 23, 2024 · 10:04 AM

Index-In-Place eDiscovery Tech is in High Demand, but Beware of False Vendor Claims

By John Patzakis

Proportionality-based eDiscovery is a goal that all in-house corporate legal teams want to attain. Under Federal Rule of Civil Procedure 26(b)(1), parties may discover any non-privileged material that is relevant to any party’s claim or defense and proportional to the needs of the case. However, most core eDiscovery costs (outside of attorney review) stem from over-collection of electronically stored information (ESI), and over-collection thwarts the ability to attain proportionality. Law firm Nelson Mullins notes that “over preservation tends to have its own costs relating to storage of large amounts of electronically stored information (ESI) and the resources needed to manage it; leads to increased downstream e-discovery costs associated with collection, processing, and review.”

This is why accurate pre-collection data insight is a game-changing capability that enables counsel to set reasonable discovery limits and ultimately process, host, review and produce much less ESI. Counsel can further use pre-collection proportionality analysis to gather key information, develop a litigation budget, and better manage litigation deadlines. Such insights can also foster cooperation by informing the parties early in the process about where relevant ESI is located, and what keywords and other search parameters can identify and pinpoint relevant ESI.

And the means to enable this capability is distributed index and search in-place technology. Indexing and search in-place in this context means that a software-based indexing technology is deployed directly onto fileservers, laptops, or in the cloud to address cloud-based data sources. This indexing occurs without a bulk transfer of the data to a central location. Once indexed, the searches are performed in a few seconds, with complex Boolean operators, metadata filters and regular expression searches. The searches can be iterated and repeated without limitation, which is critical for large data sets.

However, with this capability being highly valued, many vendors have parroted this messaging, but have offerings that do not qualify as true index-in-place. True distributed index-in-place means that the search indexes are forward-deployed, and are actually installed on the target laptop, Mac computer, fileserver or into the cloud near where the target cloud data sources exist. Transferring data in bulk to a central appliance or server farm via a collector agent or Robocopy function does not qualify. A true index-in-place capability uniquely enables scalability, targeted collection and also minimizes security and data governance risks in eDiscovery and information governance matters.

Conversely, a process requiring massive data copying, migration and centralization does not scale and creates significant data, governance and privacy issues by needlessly duplicating data. For instance, if a matter requires that 10 terabytes be scanned to determine if relevant ESI exists within that data corpus, and the eDiscovery collection platform being used has no index-in-place capability, then all 10 terabytes must be copied and transferred to the tool for indexing and analysis. These limitations stem from tool vendors simply utilizing open source indexing platforms like Lucene or Elastic Search that are not forward-deployable and must reside in centralized locations with a very large amount of computing resources to make them viable for the type of data and data volumes typically seen in discovery and information governance matters.

This is why X1 leverages proprietary and patented index and search technology that is readily forward deployable and thus can scale and allow true distributed indexing in-place. X1 Enterprise Collect significantly streamlines the eDiscovery workflow with integrated culling and deduplication, thereby eliminating the need for expensive and cumbersome ESI processing tools. That way, the ESI can be populated straight into Relativity from an X1 collection without multiple hand offs, extensive project management and inefficient data processing.

The ability to directly and transparently collect data from custodian laptops, desktops, Microsoft 365 and other cloud sources into a RelativityOne/Relativity workspace is a game-changer that enables attorneys to begin review in hours rather than weeks.

For a demonstration of the X1 Enterprise Collect Platform, contact us at sales@x1.com. For more details on this innovative solution, please visit www.x1.com/x1-enterprise-collect-platform.

Leave a comment

Filed under Best Practices, Cloud Data, Corporations, ECA, eDiscovery, Enterprise eDiscovery, ESI, law firm, Preservation & Collection, proportionality

Tagged as , , , , , , , , ,

February 27, 2024 · 11:38 AM

Modern, Targeted ESI Collection Can Cut eDiscovery Costs by Over 90 Percent

By John Patzakis and Chas Meier

eDiscovery can be an expensive and time-consuming process when traditional data collection methods are employed. With legacy processes, it can take weeks for electronically stored information (ESI) collections to finally end up in review. Time is money, and utilizing dated processes can dramatically increase costs as well as risk. One of the biggest drivers of excessive eDiscovery costs is over-collection of irrelevant or unnecessary information. This in turn leads to a larger amount of data entering the processing and initial review funnel.

In fact, old school manual collection efforts require employing multiple tools, data copies, and manual steps into your litigation workflow. The majority of ESI processing consists of data culling and filtering, deduplication, text extraction, metadata preservation, and then staging the data for upload into a review platform, often in the form of a load (DAT) file. Some ESI processing solutions require deployment of non-integrated on-premise hardware appliances that further increase costs and add time delays. Manual collections, multiple generations of data duplication, and disjointed handoffs exponentially increase costs and risk while significantly delaying documents being available for review.

If you are still using stand-alone processing tools, you are doing it wrong and subjecting your clients to extensive costs and time delays. Modern collection technologies combine targeted collection with in-place processing of data which is automatically collected, processed, and uploaded into a review platform such as Relativity in one fell swoop.

The graph below established that the cost for collection, processing and first month hosting under a traditional preservation process can be upwards of $12,000 per custodian:

Properly targeted preservation initiatives are favored by the courts for purposes of civil eDiscovery and enabled by next generation software to search data sources quickly and effectively in-place throughout the enterprise. The value of targeted and proportional preservation is recognized in the Committee Notes to the recent FRCP amendments, which urge the parties to reach agreement on the preservation of data, keywords, and other metadata to identify responsive materials. See also, In re Genetically Modified Rice Litigation, (“Preservation efforts can become unduly burdensome and unreasonably costly unless those efforts are targeted to those documents reasonably likely to be relevant or lead to the discovery of relevant evidence.”)

X1 Enterprise Collect significantly streamlines the eDiscovery workflow with integrated culling and deduplication, thereby eliminating the need for expensive and cumbersome ESI processing tools. That way, the ESI can be populated straight into Relativity from an X1 collection without multiple hand offs, extensive project management and inefficient data processing.

The ability to directly and transparently collect data from custodian laptops, desktops, Microsoft 365 and other cloud sources into a RelativityOne / Relativity workspace is a game-changer that enables Attorney’s to begin review in hours rather than weeks.

The second chart shows how this streamlined approach, based upon a detailed ROI analysis, reduces eDiscovery costs by over 90 percent:

So, in terms of the big picture, X1 Enterprise Collect provides a complete platform to implement a properly targeted preservation strategy in the enterprise enabling organizations to save a lot of time, save a lot of money, and be able to make faster and better decisions.

When you accelerate the speed to review and eliminate over-collection and inefficient processing, you gain much better early insight into your data and can increase efficiencies on many levels.

Finally, the calculations represented in the charts were generated from a customizable ROI cost calculator created by Chas Meier, based upon his more than 20 years’ experience in eDiscovery service provider roles. If you would like a copy of this ROI calculator, please contact Chas at CMeier@x1.com.

Leave a comment

Filed under Best Practices, Cloud Data, Corporations, ECA, eDiscovery, eDiscovery & Compliance, Enterprise eDiscovery, ESI, Information Management, Preservation & Collection

Tagged as , , , , , , ,

January 24, 2024 · 11:21 AM

Massive Data Centralization for MS 365 Does Not Work for Enterprise eDiscovery and Information Governance Workflows

By John Patzakis and Charles Meier

CIOs and legal and compliance executives often aspire to implement information governance programs like defensible deletion, data migration, and data audits to detect risks and remediate non-compliance. However, without an actual and scalable technology platform to effectuate these goals, those aspirations remain just that. Many CIOs attempt to address this daunting challenge by migrating disparate data from around the global enterprise into a central location. However, they quickly find that such attempts to “boil the ocean” are extremely expensive, highly disruptive, and unworkable due to massive scalability issues. The HP Autonomy vision was an example of this approach that seemed like a good idea, but never scaled and required significant manual effort and expensive outsourced services to execute.

And history is repeating itself with Microsoft’s Purview eDiscovery platform. MS Purview Premium is a very expensive add-on designed to mine data in Microsoft’s 365 platform for eDiscovery collection and export. However, MS 365 is a massive data ocean that was not purpose built for compliance and eDiscovery. Furthermore, a new “compliance index” must be created with data carved out of the MS 365 ocean to initiate an eDiscovery or compliance case in Purview eDiscovery to ensure proper and complete content indexing.

As a result of this disjointed two-step process, users are encountering significant problems with low throughput and defensibility. Many customers report to us that Microsoft Purview Premium’s documented inability to handle anything other than small matters due to their 2GB per hour throughput limit. A matter involving 100 custodians at 10GB of MS 365 data would take several weeks to complete with Microsoft Purview Premium.

X1 Enterprise Collect is not subject to these limitations due to our MS 365 data connector approach supported by the X1 proprietary search technology. X1 Enterprise Collect can complete the same sized matter within 24 hours (search, collection and export) better meeting the needs of eDiscovery and investigation matters and requiring only an E3 level M365 license.

Purview Premium faces other key limitations such as not searching files and attachments over 150 MB, not addressing hidden mail folders, and not accessing files and emails without “compliance copies” and overall challenges with search syntax and search reliability and accuracy. In response to these challenges, Microsoft Purview customers are being forced to spend significant sums on outsourced service providers who, just like in the Autonomy days, are engaging in substantial efforts to make the process work. We have spoken to several eDiscovery service providers who are giddy over all the work they are getting to compensate for Purview’s limitations with outsourced services. However, in-house legal teams are not happy with the situation.

In response to these challenges, X1 launched MS 365 data connectors to our X1 Enterprise Collect platform to provide a previously unmet critical need for enterprises to conduct cost-efficient yet highly scalable eDiscovery search and collections of MS 365 data. The response has been tremendous, with X1 seeing record demand.

X1 Enterprise Collect provides users the unique ability to search and collect MS 365 data in-place, in a targeted and iterative manner, at speeds and throughput far exceeding other tools, including Microsoft Purview Premium. X1 achieves such scalability through a targeted, custodian-based approach that minimizes 365 API calls, and does not rely on the MS Search Index, which has been demonstrated to be untrustworthy and with limited throughput. X1’s approach enables a very scalable, defensible, and robust data collection now at speeds 10x that of other approaches.

The X1 Enterprise Collect Platform is available now from X1 and its global channel network in the cloud, on-premise, and with our services available on-demand. For a demonstration of the X1 Enterprise Collect Platform, contact us at sales@x1.com. For more details on this innovative solution, please visit www.x1.com/x1-enterprise-collect-platform.

Leave a comment

Filed under Corporations, ECA, eDiscovery, eDiscovery & Compliance, Enterprise eDiscovery, Information Governance

Tagged as ,

August 30, 2023 · 12:52 PM

Best Evidence Rule Requires Post-Level Collection for Social Media Evidence

By John Patzakis

The Best Evidence Rule, as codified in Federal Rule of Evidence 1002, provides that an original writing, recording, or photograph is required to prove the contents of the document. This rule was formulated in a paper document dominated era, and aimed to prevent fraud and inaccuracies that could arise from secondary or duplicate evidence. However, the prevalence of electronically stored information (“ESI”) prompted exceptions to this rule when it comes to computer-generated evidence. Specifically, FRE 1001(d) was drafted to provide clarification for how ESI was to be treated under the Best Evidence Rule: “For electronically stored information, ‘original’ means any printout — or other output readable by sight — if it accurately reflects the information.”

FRE 1001(d) means that for most forms of ESI, including electronic documents, emails, digital photos, and video files, an exact copy of those items will suffice under the Best Evidence Rule. And because it is very easy to create an exact copy of electronic evidence (as any eDiscovery practitioner who has ever “de-duped” ESI can attest to), the Best Evidence Rule has been almost forgotten in the ESI era. However, it is very different when it comes to screen shots of social media posts. Because screen shots are truncated images of the full native social media posts, they are not exact copies of the original as defined under FRE 1001(d). In fact, given the unfortunately extensive but erroneous reliance on screenshots of social media evidence, The Best Evidence Rule could be cited far more frequently by opposing counsel seeking to contest the admission of such evidence.

A case out of the federal courts in Texas addressed this issue head on. Edwards v. Junior State of America Foundation, is a civil litigation matter involving the intentional destruction (spoliation) of social media evidence. The plaintiff had deleted his Facebook account resulting in lost evidence critical to the case. The court cited an affidavit submitted by an eDiscovery expert witness who noted that when X1 Social Discovery was used to collect from the Plaintiff’s Facebook account, key evidence that existed prior to the litigation was missing because it had been deleted by the Plaintiff prior to the X1 Social Discovery collection.

As a result of the spoliation established in large part by the X1 Social Discovery examination, the Court imposed severe evidentiary sanctions on the plaintiff, including the exclusion of evidence and claims related to the destroyed Facebook data, and adverse jury instructions.

The plaintiffs’ had sought to offer screenshots as evidence of the Facebook communications instead of the deleted native files. The court ruled that the metadata and full context of the native files were essential to satisfy the Best Evidence Rule. The court held that screenshots were not an output that accurately reflected the substance and context of the native file, since they could not show that the messages were authentic, nor could they “be used to prove that Harper sent the Facebook Messages contained in the screenshots.” Failure to produce the native files prejudiced the Defendants, in part, because it deprived them “of the ability to substantiate or refute the authenticity of the alleged messages.” In a key passage the court states:

“Here, the screenshots will not suffice as an ‘original’ because the screenshots are not an ‘output’ that accurately reflects the information. Only native files can ensure authenticity. Additionally, although the Best Evidence Rule allows for an original ‘photograph’ to prove the contents of the photograph, this does not mean that the screenshot here can be used to prove that Harper sent the Facebook Messages contained in the screenshots.”

Edwards demonstrates that the collection and preservation of full native social media posts is vital to both that evidence’s authentication and obtaining the full context and substance of the posts under the Best Evidence Rule. The court found that screenshots, which truncate social media posts and omit key metadata, do not suffice. As a result, attorneys should be aware that courts are unlikely to find that screenshots alone are sufficient to authenticate a social media post and will likely insist on the native files. To ensure this data is collected defensibly, attorneys should work with best practices software and methods to preserve and collect social media evidence and underlying metadata so that they can be properly authenticated and admitted in court.

Leave a comment

Filed under Best Practices, Case Law, Corporations, ECA, eDiscovery, ESI, law firm, Preservation & Collection, Social Media Investigations, Social Media Metadata

Tagged as , , , ,

July 25, 2023 · 11:21 AM

Court Decision in Lubrizol vs. IBM Provides Important Guidance on MS Teams Discovery

By John Patzakis

Recently, a federal district court in Ohio issued a ruling concerning an eDiscovery dispute involving both Teams and Slack, Lubrizol Corp. v. IBM Corp., No. 1:21-CV-00870-DAR (N.D. Ohio May 15, 2023). This decision is important as it provides and serves as a template and guidepost on how to collect and produce messages from MS Teams, a challenge which many litigants are struggling with today.

This case involves a breach of contract claim where plaintiff Lubrizol corporation, a major chemical manufacturer, purchased an SAP ERP system, and then hired IBM to implement the enterprise software. The project eventually went off the rails and now the parties are in litigation fighting over eDiscovery.

As you might imagine on an IT project like this, there’s a lot of evidence in Teams and also in Slack. Plaintiff Lubrizol wanted IBM to produce the entire channel of their messages if there was even a single relevant message within the channel. However, in its written opinion, the court determined that the production of an entire Slack or Teams channel, with only a few relevant messages within, would be overbroad per the rules of proportionality. IBM conversely took a counter position that was equally extreme, claiming that they only needed to produce the actual message that the keyword hit on without any context of the broader conversation around it. The court rejected this approach.

Eventually the plaintiff came back to the court with a proposed compromise, which the court agreed with and adopted as its final order as follows:

“IBM to produce: (1) the entirety of any Slack conversation containing 20 or fewer total messages that has at least one responsive message; and (2) the 10 messages preceding or following any responsive Slack message in a Slack channel containing more than 20 total messages. Within 28 days, Lubrizol shall do the same with respect to its Microsoft Teams messages.”

While this ruling is very instructive, many parties struggle with executing such a targeted collection and production effort. The problem with Teams discovery, as outlined in a previous post, is that most eDiscovery tools require parties to collect and export entire Teams channels, with the production format being very problematic due to no efficient ability to provide automated and targeted productions as the court outlines above.

The exception is X1. X1 Enterprise Collect provides, in our opinion, the industry’s best eDiscovery support for MS 365. And many independent eDiscovery, experts, agree. X1’s support for MS Teams is one example. Among the reasons why our MS Teams support stands out, is the ability to produce a specific number of preceding and subsequent messages for automated input into a review platform, all in context. See the screenshot below.

Winston & Strawn eDiscovery partner Bobby Malhotra notes the importance of this capability: “With the vast number of users and unyielding amount of data in collaboration applications such as Teams, having the ability to target and triage data by specific custodians and threads allows organizations to handle discovery in an efficient and pragmatic manner. X1 provides the unique ability to seamlessly collect and search across numerous web, collaboration, and social, data sources.”

X1 recently hosted a webinar demonstrating how to collect from MS Teams in an effective, defensible and proportional manner. You can watch it here on demand.

The X1 Enterprise Collect Platform is available now from X1 and its global channel network in the cloud, on-premise, and with our services available on-demand. For a demonstration of the X1 Enterprise Collect Platform, contact us at sales@x1.com. For more details on this innovative solution, please visit www.x1.com/x1-enterprise-collect-platform.

1 Comment

Filed under Best Practices, Case Law, Cloud Data, ECA, eDiscovery, eDiscovery & Compliance, Enterprise eDiscovery, law firm, MS Teams, Preservation & Collection

Tagged as , ,