Day 3 of Lavacon 2011
Document Retention, eDiscovery, and You
Disclaimer: Do not rely on this session summary for legal advice.
Although this session appeared somewhat different than the typical conference topics, the subject is perhaps surprisingly relevant for technical communicators.
Computer forensics does not involve blacklights or DNA, but it does involve some very sophisticated technical methods, and the recovered contents of a hard drive can easily be the decisive factor in a legal case.
The speaker, Dr. Johnette Haskell has had a distinguished career in academia, with a background in mathematics, computer science, and engineering. She founded Electronic Evidence Retrieval, L.L.C., and now focuses her attention on matters related to electronic evidence and obtaining this evidence, even when the possessors of this evidence have gone to great lengths to destroy it. Note: Jack Molisani helps out with cases periodically, working as a forensic engineer.
I found two key components to this presentation:
- With the use of sophisticated forensic techniques that take advantage of the technology used in hardware and software, it is possible to uncover more electronic evidence than you would ever think possible.
- With a set of good policies and procedures, you can mitigate the potential harm and disruption that an eDiscovery request might do to your business. A subpoena to search all of your company and personal computers can be unbelievably disruptive, and many parties settle a case rather than have to deal with this outcome.
Forensic techniques
Although Dr. Hassell provided a great deal of technical explanation for the first point, the important thing to remember is that, as a rule of thumb, computers do not destroy data for the most part. When you delete a file, it is not actually deleted, but just given a special marker indicating the space is potentially free for reuse. Neither is the data deleted when you format a drive.
Similarly, typical word-processing programs keep track of much more history than you realize, even if you do not select “Track Changes.”
The forensic process requires a great deal of care to ensure the original evidence, typically a hard drive or USB drive, is left untouched by the examination process. The forensic expert has special software to prevent any information being written to the drive in question.
Policies and procedures
Dr. Hassell cautioned several times that she is not an attorney, and thus cannot provide legal advice. She emphasized that companies should rely on their own legal counsel, or outside legal counsel, to approve policies and procedures for data retention and destruction.
That said, here are some general tips.
- If you use your personal computer for any work-related activity, and the need for eDiscovery arises, your personal computer may well be the subject of an eDiscovery request. Conduct yourself accordingly.
- Don’t involve unrelated parties in the litigation. Dr. Hassell told of a case where one partner of a firm wrote an email to the other partner’s wife about his worries related to the dispute. Although the other partner’s wife did not have any other involvement, her computer was discoverable as a result.
- Fill out document properties forms, and ensure your employees do the same. For example, architectural and mechanical drawings typically have a form where the user can enter his or her name, title of the drawing, and so forth. At least one case has been won because the computer used as evidence indicated that the disputed drawings must have been purloined by the defendant, given that the names of the employees who created the forms were found in the document properties.
- Develop a policy, in advance, for destruction of data. It is reasonable to delete files from time to time, to replace equipment in your business, and so forth. As a general rule, if you have a plan that is developed in good faith, then you are not responsible for inadvertent information loss. If you do not have such a policy, and some useful data is missing, the court is permitted to make a worst-case assumption about that data.
General tip for anyone who writes documents
If you send a Microsoft Word document, or a WordPerfect document (or no doubt some other formats), to a recipient, that document may reveal more than you ever thought possible. To see this effect in action with Microsoft Word:
- Select File > Open.
- In the drop-down list at the right which displays file types, select Recover Text from Any File.
- Select the file for which you want to recover this text.
More sophisticated tools may well show more. You can get around this problem by delivering PDFs only.
Slideshare: Not available
Company: http://www.electronicevidenceretrieval.com
