Tag Archives: Craig Ball

21 Key Takeaways of Electronic Storage

Posted on by
1

When it comes to eDiscovery, the guru is Craig Ball.

Craig recently posted about the upcoming 2019 Georgetown eDiscovery Training Academy, a week-long, immersive boot camp in electronically stored information (ESI).

The technology of e-discovery is its centerpiece, and I’ve lately added a 21-point synopsis of the storage concepts, technical takeaways and vocabulary covered.

Here is Craig’s synopsis verbatim:

  1. Common law imposes a duty to preserve potentially-relevant information in anticipation of litigation
  2. Most information is electronically-stored information (ESI)
  3. Understanding ESI entails knowledge of information storage media, encodings and formats
  4. There are many types of e-storage media of differing capacities, form factors and formats:a) analog (phonograph record) or digital (hard drive, thumb drive, optical media)b) mechanical (electromagnetic hard drive, tape, etc.) or solid-state (thumb drive, SIM card, etc.)
  5. Computers don’t store “text,” “documents,” “pictures,” “sounds.” They only store bits (ones or zeroes)a) ASCII or Unicode for alphanumeric characters;b) JPG for photos, DOCX for Word files, MP3 for sound files, etc.
  6. Digital information is encoded as numbers by applying various encoding schemes:
  7. We express these numbers in a base or radix (base 2 binary, 10 decimal, 16 hexadecimal, 60 sexagesimal). E-mail messages encode attachments in base 64.
  8. The bigger the base, the smaller the space required to notate and convey the information
  9. Digitally encoded information is stored (written):a) physically as bytes (8-bit blocks) in sectors and partitionsb) logically as clusters, files, folders and volumes
  10. Files use binary header signatures to identify file formats (type and structure) of data
  11. Operating systems use file systems to group information as files and manage filenames and metadata
  12. File systems employ filename extensions (e.g., .txt, .jpg, .exe) to flag formats
  13. All ESI includes a component of metadata (data about data) even if no more than needed to locate it
  14. A file’s metadata may be greater in volume or utility than the contents of the file it describes
  15. File tables hold system metadata about the file (e.g., name, locations on disk, MAC dates): it’s CONTEXT
  16. Files hold application metadata (e.g., EXIF geolocation data in photos, comments in docs): it’s CONTENT
  17. File systems allocate clusters for file storage; deleting files releases cluster allocations for reuse
  18. If unallocated clusters aren’t reused, deleted files may be recovered (“carved”) via computer forensics
  19. Forensic (“bitstream”) imaging is a method to preserve both allocated and unallocated clusters
  20. Because data are numbers, data can be digitally “fingerprinted” using one-way hash algorithms (MD5, SHA1)
  21. Hashing facilitates identification, deduplication and de-NISTing of ESI in e-discovery

If you don’t follow Ball in Your Court, you should.

All Rights Reserved 2019 – Beverly Michaelis

See the Data Apple Has Collected on You — Via Ball in your Court

Posted on by
1

Two-and-a-half years ago, I concluded a post with this bluster: “Listen, Amazon, Apple, Microsoft and all the other companies collecting vast volumes of our data through intelligent agents, apps and social networking sites, you must afford us a ready means to see and repatriate our data. It’s not enough to let us grab snatches via an unwieldy […]

via Cloud Takeouts: Can I Get That to Go? — Ball in your Court

Preserving Mobile Data in Anticipation of Litigation

Posted on by
4

In a recent post, eDiscovery expert Craig Ball makes the case for routine preservation of data contained on mobile devices. I concur.

The tendency is to dismiss or ignore the degree to which we lean on our smartphones and tablets. We either assume the data is preserved elsewhere or we convince ourselves that mobile devices couldn’t possibly contain anything relevant or unique. Both beliefs are false. Craig’s post is a wakeup call for both law firms and their clients. Consider his key points:

  • Texting has overtaken email as a means of direct and candid communication. No competent business person would never send a letter or email without retaining a copy. The same standard should apply to text messages.
  • Mobile data is accessible and easy to backup using iTunes. (Yes, I know the interface deserves a Rotten Tomatoes score of 0%, but it does work.)
  • Preserving data does not mean it must be produced.

There is much more to this topic, and I encourage you to read the full post.

A Lesson for Lawyers

There is a takeaway for lawyers too. In Oregon, the “client file” includes text messages if they bear on the merits of a client’s position in the matter. This begs the question: are you preserving client texts? If not, look into Zipwhip, which I’ve discussed before. It has many advantages, not the least of which is the ability to save texts as PDFs to the client file.

All Rights Reserved 2017 Beverly Michaelis

The Dangers of Metadata

Posted on by
2

On March 24, 2010 I wrote a guest post for Practical Paralegalism, one of my favorite legal blogs, written by one of my favorite legal bloggers, Lynne DeVenny.  The subject:  metadata. 

If you or your staff are looking for a primer on what metadata is and what you should do about it (from a “best practices” perspective), check out my post: Metadata 101: What You Don’t Know Can Hurt You.

Only a handful of jurisdictions have weighed in on the ethical considerations of metadata, with varying results.  There is no brightline on the ethics of data mining or the duty to notify the recipient if the sender discovers metadata.  There is consensus  that attorneys should use reasonable care to “avoid providing electronic documents that inadvertently contain accessible information that is either confidential or privileged, and to employ reasonable means to remove such metadata before sending the document.”   The American Bar Association takes the same position.  Presumably, if Oregon were to issue an ethics opinion about metadata, they would come to the same result.  Where we would fall with regard to data mining or notification is anyone’s guess.

What Should I Do?

If your firm practices in a jurisdiction that has issued a metadata opinion, follow the requirements of your jurisdiction. A detailed chart is available from the American Bar Association Legal Technology Resource Center.

All firms should establish a metadata scrubbing policy. Even if not required, best practices dictate that metadata be removed from documents prior to transmission. This is the best way to protect sensitive, confidential, or privileged information.  Metadata removal tools in Word, WordPerfect, and Acrobat are described here.

As I  mention in my Practical Paralegalism post,  these tools aren’t foolproof, so it might behoove you to look into more thorough metadata scrubbers.  My favorite is PayneGroup’s Metadata Assistant.  While there, don’t forget to check out all the other great products and resources.  If you read this blog, you know I don’t offer or receive paid endorsements, and this is no different.  Donna Payne and PayneGroup’s reputation is exceptional – you can read about it for yourself.

Copyright 2010 Beverly Michaelis