Table Of ContentPreserving Electronic
Evidence for Trial
Page left intentionally blank
Preserving Electronic
Evidence for Trial
A Team Approach to the Litigation
Hold, Data Collection, and
Evidence Preservation
Ann D. Zeigler
Ernesto F. Rojas
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Syngress is an imprint of Elsevier
Syngress is an imprint of Elsevier
50 Hampshire Street, 5th Floor, Cambridge, MA 02139, USA
Copyright © 2016 Elsevier Inc. All rights reserved.
Chapter 2 material from Moore’s Federal Practice, Reprinted from Matthew Bender with
permission. Copyright 2015 Matthew Bender & Company, Inc., a LexisNexis company. All
rights reserved.
Chapter 8 material from Exterro, Inc. blog, Reprinted from Exterro, Inc. blog, with permission from
Mike Hamilton, J.D., Senior Manager, E-Discovery Programs. http://www.exterro.com/blog/
No part of this publication may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying, recording, or any information storage
and retrieval system, without permission in writing from the publisher. Details on how to
seek permission, further information about the Publisher’s permissions policies and our ar-
rangements with organizations such as the Copyright Clearance Center and the Copyright
Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by
the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and expe-
rience broaden our understanding, changes in research methods, professional practices, or
technical procedures may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in
evaluating and using any information, methods, or techniques described herein. In using such
information or methods they should be mindful of their own safety and the safety of others,
including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or edi-
tors, assume any liability for any injury and/or damage to persons or property as a matter
of products liability, negligence or otherwise, or from any use or operation of any methods,
products, instructions, or ideas contained in the material herein.
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library
Library of Congress Cataloging-in-Publication Data
A catalog record for this book is available from the Library of Congress
ISBN: 978-0-12-809335-1
For information on all Syngress publications
visit our website at http://store.elsevier.com/Syngress
Typeset by Thomson Digital
Dedication
To Ernesto Francisco Rojas, my coauthor, who died unexpectedly in October
2014, two days after sending me the first draft of his half of this book, for his
friendship and for his encouragement in this adventure, and to our spouses,
Ann’s favorite photographer-poet Paul Zeigler, and Ernesto’s beloved Raisa.
Special thanks to Ernesto’s colleague, Ross A. Leo, FABCHS, CISSP, HCISPP,
CHS-IV, ABCP, Associate Director, Professional Training & Development, Uni-
versity of Houston-Clear Lake, CyberSecurity Institute (http://www.uhcl.edu/
CyberSecurityInstitute) for his generosity in providing a technical review of the
completed manuscript.
v
Page left intentionally blank
Contents
AUTHOR BIOGRAPHIES ..................................................................................xi
INTRODUCTION ............................................................................................xiii
CHAPTER 1 Your critical task: learn another language ............................1
A computer forensics expert looks at legalese ...............................1
The civil lawsuit—a pretrial tour, with vocabulary ..........................2
The real first step—the triggering event ..........................................5
ESI in the rules, or how to aggravate the judge ...............................5
Keeping it in proportion, round 1: training.......................................6
Keeping it in proportion, round 2: the price of compliance,
or not ................................................................................................8
CHAPTER 2 Preserving, not corrupting—hold it! ....................................11
How far does preservation stretch? information
versus evidence ...............................................................................11
A historical footnote ........................................................................12
In the present, spoliation versus integrity of evidence ...................12
Bad acts: examples from reported cases .......................................15
The other route—destruction with permission ...............................18
Curative action and sanctions .........................................................19
Each attorney’s independent preservation duty .............................22
The key to the hold notice: name the key players ASAP .................23
Zubulake, Pension Committee, Rimkus and more ............................25
The rules—contemplating amendment, again ...............................33
And, back in the courtroom—Sekisui American ..............................34
The rules amendment process, again—looking forward from
Dec., 2015 ........................................................................................35
CHAPTER 3 I ncident response while avoiding evidence disaster:
the team ...............................................................................37
The team: functional and procedural issues ..................................38
Who needs to act: whoever handles the problem is on the team ......43
Preparing the team .........................................................................50 vii
viii Contents
CHAPTER 4 Understanding information systems ...................................55
Introduction to the digital forensic world ........................................55
Computer systems ..........................................................................56
Stand-alone computers ...................................................................56
Networked computers .....................................................................60
Servers.............................................................................................63
Firewalls and security devices ........................................................65
CHAPTER 5 In addition to the system—other devices .............................69
Mobile devices .................................................................................69
BYOD—bring your own device issues ..............................................71
Without predicting ...........................................................................72
CHAPTER 6 Collecting data .....................................................................73
Understanding the systems in the organization: Information
governance ......................................................................................73
Why system structural information is necessary—the
data map ..........................................................................................74
The people who should know ..........................................................75
Identifying the forensic consultant and internal
forensic team ...................................................................................77
Data collection strategies, looking forward ....................................78
CHAPTER 7 Teamwork prep for data management ................................79
Gathering systems operating information for digital
forensic use .....................................................................................79
Data inventories management: what data and why........................83
Data destruction policies and hold management:
who decides and who acts ...............................................................85
How long do we hold this data?.......................................................86
Regulatory requirements and industry norms on
data destruction ..............................................................................87
Personally identifiable information (PII) restrictions .....................87
Data, ready for the team ..................................................................88
CHAPTER 8 Data policies and procedures—get the details ....................89
Understanding specific information for the ESI
preservation process .......................................................................89
Small, large, Fortune 500 and international—the economics
of structure and scale .....................................................................94
Delegation of authority for data destruction policies .....................95
Communicating with the rank-and-file employees ........................96
Business operations (policy versus reality)—who knows
what and who does what? ...............................................................97
Contents ix
Document the day-to-day flow and control of ESI ..........................99
Who has what kinds of devices, and who knows where
they are? ..........................................................................................99
Controlling electronic device information—three issues .............100
Dealing with data security and classification ...............................102
Data security in employee-related incidents ................................103
CHAPTER 9 The cloud and other complexities ......................................109
Cloud computing ...........................................................................109
Complex environments .................................................................113
It’s all happening right now ...........................................................114
CHAPTER 10 Putting it all together: when the first alarm sounds,
hold it! .................................................................................115
The critical moment to begin preservation ...................................115
A great question that has already been answered for you ...........118
Identifying the scope of the preservation hold by
communicating within the team ...................................................120
After the notice: executing the hold and preserving ESI
for analysis. ...................................................................................123
Storing ESI is cheap—stop routine storage/destruction
procedures ASAP ...........................................................................124
Communication between counsel–the team and effective
use of Rules 26 and 34 ..................................................................125
The “other” hold notice—when you intend to sue someone ........127
After the hold, the long view of ESI analysis .................................127
CHAPTER 11 The Rule 26 meet-and-confer—your best chance to
control the ESI exchange ...................................................129
Newly amended Rule 26 means what it says ................................129
Another brief tour through the amended rules ............................130
Stay focused on the e-discovery goals ..........................................131
The team’s pre-meeting strategy session ....................................133
The meet-and-confer: a strategic overview ..................................134
The operative word is “confer” ......................................................138
Preservation orders—be quick, be precise ...................................141
The final product of a good meet-and-confer ...............................142
CHAPTER 12 A glance at international issues—never assume! .............145
International issues in ESI preservation and
e-discovery—a very brief look .......................................................145
There is not here—a brief consideration of common
law and civil law traditions ............................................................145
