Upload
others
View
1
Download
0
Embed Size (px)
Citation preview
Daniel M. BraudePartner – New York, NY | White Plains, NY [email protected]
WEBINAR
Best Practices for Remote Electronic Forensic Collections & WFH Document Review
Thursday, March 25, 2021
Best Practices for
Remote Electronic Forensic Collections
& Work From Home Document Review
March 25, 2021
Presented with
Click to add subtitle
Forensic Collections ofElectronic Documents
Document Review Platforms
Document Review &Contract Attorneys
Click to add subtitle
Forensic Collections ofElectronic Documents
Document Review Platforms
Document Review &Contract Attorneys
Collection Approaches
Broad Collection by Forensic Expert• Greater defensibility
Targeted “Self-Collection”• Risk of having to re-collect
• Risk of preserving-in-place
• Risk of higher overall costs and spoliation claims
• Less defensibility and no metadata collection
Click to add subtitle
Production of Metadata – See FRCP 34(b)(2)(E)
Principle 12: The production of electronically stored information
(ESI) should be made in the form or forms in which it is ordinarily
maintained or that is reasonably usable given the nature of the ESI
and the proportional needs of the case.
Comment 12.a: Special characteristics of ESI (metadata and non-
apparent / undisplayed data) may be pertinent to the form in which
ESI should be preserved and produced.
The Sedona Principles, Third Edition: Best Practices, Recommendations & Principles for Addressing Electronic Document Production (2018)
Forms of Production
Native Format• Word Processing, Spreadsheets, Multimedia Files• Cannot bates stamp or redact*• Complete Metadata Produced (if forensically collected)
TIFF Files• Single Page Static Images• Document review platform typically required• Selected Metadata Fields in Corresponding Load Files
PDF Files• Searchable Text (potentially)• Often more useable than TIFFs as individual files• Limited Metadata
Common Metadata Fields for Production
• To
• From• CC• BCC• Date Sent• Time Sent• Date Received• Time Received• Subject• Attachments
• Custodian
• File Name• Source Device• Source Path• Production Path• Modified Date/Time• Doc ID / Identifier• Extracted Text• Bates Beg / Attach Beg• Bates End / Attach End
Remote vs. In-Person Collections
vs.
When Remote Collections Work• Remote access is available
• Functional device
• Security restrictions allow access
• End User or law firm is capable AND cooperative
When In-Person Collections are Required• Non-standard (GPS, wearables, some mobile devices, etc.)
• Device either doesn’t boot or can’t be connected to the internet
• Concerns for cooperation
Remote vs. In-Person Collections
Collection kit shipped to the end user in a hardened case
All components are fully encrypted
Remote Access is utilized to perform the tasks
The data is transferred and the kit is shipped back
Full Chain of Custody is preserved
Remote Collections
Collections of Cloud-Based Data
For Discussion• Public or Private Profile• Snapshot or Ongoing Monitoring• Mobile Phone in Scope
• Sources Available• Facebook • Twitter• Instagram• LinkedIn• Google+• YouTube• And many more….
Collections of Cloud-Based Data
Leveraging Mobile Devices • Social Application Used
• Cached Credentials
• Cached Sessions
Specific Attributes Available• Amazon Alexa…things you said to
Alexa or when Alexa was listening
• DJI GO 4…Drone footage
• Fitbit…User Activity
Not All Collections Are Created Equal
• Screenshot of a Text Message
• Logical Forensic Image
• File System Image
• Physical Image
Mobile Device Collections
Mobile Device Collections
Can’t I collect it from the Mobile Carrier?
• Possible only call logs and determining a user’s location
• Generally no carrier retention of text message content
Verizon Wireless
• Subscriber Information: 7-10 years
• Call History: 7 years
• Tower Locations related to Call History: 12 Months
• SMS Content: 3-5 days (unofficially 7-10 days)
• Tower Dumps: 1 year
• Range to Tower (RTT) Data: 8 days
AT&T
• Subscriber Information: 7 Years
• Call History: 7 years
• Tower Locations related to Call History: 7 years
• SMS Content: Not Available
• Tower Dumps: 7 years
• Range to Tower (RTT) Data: 180 days
Click to add subtitle
Forensic Collections ofElectronic Documents
Document Review Platforms
Document Review &Contract Attorneys
Negotiate Scope Reduce the Volume
Search Terms
Limits on Custodians
Date Range Culling
File-Type Culling
Sampling & Phased Discovery
Deduplication & Email Threading
Predictive Coding (“TAR” / “AI”)
Text Message & Image Review
Text Message Review
Available Options
• Native in the Cellebrite Viewer
• PDF-Based Reports
• Excel Export
• Relativity Proprietary
• Vendor-Based Solution
Text Message Review
• Visualize and Interact with Mobile Data
• Completely Customizable Dashboards
• Identify Relevant Content with a few clicks
Text Message Review
Conversation Intelligence
• Logical Boundaries
• Grouping Parties
• Cross-Threading Technologies
Rendering Messages
• Near Native Feel
• Color Coded
• High Fidelity
Text Message Review
• Central location to track Parties (Correspondents)
• Filter and explore across devices and platforms
• Fully E.164 normalized Phone numbers
• Dynamic User assigned aliases
Image Review
Considerations for Images?• Image Thumbnails
• Eliminate Duplicates
• Categorize and Identify
• Conversations related to images
Click to add subtitle
Forensic Collections ofElectronic Documents
Document Review Platforms
Document Review &Contract Attorneys
Doc Review Workflow – Traditional Approach
Level 1• ~50 documents per hour
• Review by law firm associates
Level 2• Re-review of “responsive” documents
• Focus on privilege and confidentiality
Doc Review Workflow – Cost-Effective Approach
Level 1• ~50 documents per hour
• Review by law firm associates contract attorneys (10,000+ docs?)
• Possible use of TAR (25,000+ docs?)
Level 2• Re-review of “responsive” documents
• Focus on privilege and confidentiality
Remote vs. In-Person Review
Remote review will continue post-Covid:
• Access to a diverse workforce
• Eligibility for second tier markets
• Ability to improve productivity
• Security improvements to accommodate
• Improvements to Broadband Connectivity
• Elimination of travel time
But sometimes it’s not conducive:
• Trade Secrets where a clean room is required (no phones or devices)
• Review involving originals of hard copy records
How do you Manage a Remote Review Workforce?
• Mindfulness of the distance
• Virtual meetings and improved communication platforms
• Greater attention to face time
• AI-based monitoring solutions
• Productivity tracking
• Monitoring application use
• Set goals and keep score
Remote vs. In-Person Review
Remote vs. In-Person Review
How to Address Security Concerns?
• House sensitive Data in a fortified environment
• Ensure confidentiality is reiterated and agreed upon
• Locked down assets virtual or physical
• Secure Connectivity
• Multi-Factor Authentication
• Limit review site connectivity
• Set reasonable work hours
Click to add subtitle
Dan Braude, chair of Wilson Elser’s e-Discovery team and a
member of the firm’s Information Governance Leadership
Committee, concentrates his practice on complex litigation
involving product liability and commercial disputes. In addition, Dan counsels clients on
challenges associated with changing technology, cloud computing, and related data privacy
and information security issues. Dan is a Certified Information Privacy Professional
(CIPP/US) and he serves as an adjunct professor at the Elisabeth Haub School of Law at
Pace University where he teaches a course on e-Discovery.
Daniel M. BraudeWilson Elser Moskowitz Edelman & Dicker LLP
New York Metropolitan Offices:
150 East 42nd StreetNew York, NY 10017
Tel 212-490-3000
1133 Westchester AvenueWhite Plains, NY 10604
Tel: 914-323-7000
Click to add subtitle
Geoffrey Sherman is the Vice President of eDiscovery Solutions at
Xact Data Discovery. Geoffrey is responsible for providing Clients
with expert consulting and workflow solutions surrounding Xact
Data Discovery’s comprehensive suite of offerings, XDD-360sm. He ensures that the most
complex and demanding projects receive unparalleled support from inception to completion.
Geoffrey holds numerous certifications and credentials within the field of litigation support,
information technology and information security. He is in demand as a speaker at industry
conferences throughout the nation and has contributed works to notable publications.
Geoffrey ShermanXact Data Discovery
XDD Corporate HQ5800 Foxridge Dr., Suite 406Mission, KS 66202Tel: 913-362-8662
XDD NY Regional Office622 Third Avenue, 6th FloorNew York, NY 10017
White Plains, NY New York, NY
Services
Admissions
Memberships & A�liations
Daniel M.BraudePartner
Contact
p. 914.872.7210f. [email protected]
Aviation & Aerospace
Commercial Contracts &Agreements
Commercial Litigation
Cybersecurity & Data Privacy
e-Discovery
Germany
Information Governance
Transportation
Product Liability, Prevention &Government Compliance
Professional Liability & Services
Railroad
Canada
BarsNew York
CourtsU.S. Court of Appeals, Second Circuit
U.S. District Court, Southern District ofNew York
U.S. District Court, Eastern District ofNew York
U.S. District Court, Western District ofNew York
U.S. District Court, Northern District ofNew York
The Sedona Conference, Working Group 1on Electronic Document Retention &
Dan Braude, chair of Wilson Elser’s e-Discovery team and a member of the �rm'sInformation Governance Leadership Committee, concentrates his practice oncomplex litigation involving product liability and commercial disputes. Danfrequently represents transportation manufacturers and providers, plus pipelineoperators, in National Transportation Safety Board investigations. In addition, Dancounsels clients in the areas of electronic discovery and information governanceincluding challenges associated with changing technology, cloud computing, andrelated data privacy and information security issues. Dan is a Certi�ed InformationPrivacy Professional (CIPP/US) and he serves as an adjunct professor at theElisabeth Haub School of Law at Pace University where he teaches a course on e-Discovery.
Areas of FocusProduct Liability In the product liability �eld, Dan represents a wide range of manufacturers, including those inthe transportation and recreational products industries, in federal and state courts. Hisnotable experience includes case management and coordination of defense e�orts in patternlitigation and appearing as coordinating counsel at depositions around the country. Dan’spractice frequently involves conferring and consulting with engineers on technical issuesrelated to product design, development and manufacturing.
Commercial Litigation & Counseling Dan is experienced in both defending and prosecuting commercial litigation disputes, often inmatters involving subcontractors and component suppliers. He has demonstrated an abilityto meet client objectives not only in the courtroom but also through arbitration andmediation proceedings. In addition, Dan frequently counsels contractors in the publicprocurement arena with regard to responding to requests for proposals and relatedprocurement issues.
NTSB Investigations Dan is a member of the �rm’s nationally recognized team of attorneys representingtransportation providers and manufacturers, in addition to pipeline operators, in NationalTransportation Safety Board investigations. His work during the on-scene investigation phaseincludes providing guidance to party coordinators, representing witnesses in interviews andmanaging document collection e�orts. During subsequent investigation phases, Dansupports clients by analyzing and revising factual reports and drafting party statements.
e-Discovery As chair of the �rm’s e-Discovery practice, Dan serves as a resource within the �rm and forclients on all topics relating to electronically stored information (ESI). In his e-Discovery work,
Awards & Distinctions
Education
Certi�cations/Licenses
Production
New York State Bar Association,Commercial & Federal Litigation Section,Committee on Electronic Discovery
DRI: The Voice of the Defense Bar
International Association of PrivacyProfessionals
National Association of Railroad TrialCounsel
The Elisabeth Haub School of Law at PaceUniversity, Adjunct Professor
“40 Under 40” Rising Star, BusinessCouncil of Westchester, 2016
Seton Hall University School of Law,J.D., 2006, cum laude
Lehigh University, B.S., 1999
Certi�ed Information Privacy Professional
(CIPP/US)
Dan manages electronic document review e�orts, evaluates and utilizes methods oftechnology-assisted review, and supervises teams of contract attorneys on large-scale reviewprojects. Additionally, Dan counsels clients on electronic document retention issues anddesigns legal hold procedures to assist clients with defensible and cost-e�ective ESIpreservation. He routinely serves as discovery counsel in all types of disputes, frequently onbehalf of manufacturers engaged in pattern litigation, and represents Wilson Elser as itsdesignated e-Discovery liaison for large �rm clients.
Information Governance Dan counsels organizations to manage and organize their information assets to contain costsand minimize related organizational risks. He audits, assesses and investigates currentinformation governance practices and employee adherence to existing policies and he draftsdocument retention plans, social media guidelines, cloud computing policies, permissible usepolicies and “bring your own device” policies. At the same time, he counsels clients on relateddata security issues and litigation readiness concerns, including the evaluation of legacy dataretention and disposal. Dan routinely engages with clients’ IT employees, records managersand additional key stakeholders to train employees and monitor compliance with informationgovernance policies.