eDiscovery early case assessment and analytics Blog

What exactly can early case assessment of your eDiscovery data do for you?

There is an old quote, funny and true all at the same time “In the land of the blind the one eyed man is king�.  In the realm of eDiscovery, the more you know about your data, the better the decisions are that you make.    When you look at ESI / eDiscovery that you have in a matter, there are 2 ways to proceed:  1) Guess or rely on minimal facts that are provided or outwardly visible or 2) Analyze the ESI and let it tell you what you need to know.   Some of the low hanging fruit so to speak in reducing the size and cost of eDiscovery follow,  as you ask yourself these questions also think about the impact on your case, plans, budget if you absolutely knew the answer at the beginning of a matter:

 

Are we looking at the right people (Custodians) ?

o   Are there custodians who don’t have much in the date range we are interested in?

o   Are there Custodians that communicate with people we haven’t looked at yet (additional custodians)?

o   Are there people (custodians) that can be eliminated based on communication patterns / dates

Are we specific enough on our date ranges?

o   Are there emails and documents that PRE-Date the date range that can be excluded?

o   Are there emails and documents that are AFTER the date range of interest and can be excluded?

o   Are Documents attached to emails with dates out of range excluded?

o   Are contents of Zip (containers) that are outside the date range excluded?

o   Are embedded objects excluded if the host document is excluded?

Are we looking at the right types of stuff?

o   Are there file types which are irrelevant to this matter?

o   Are these system files which can be excluded?

o   Are there Temporary files / folders which can be excluded?

o   Are there container types which can be excluded?

o   Are there irrelevant paths and locations based on content analysis which can be excluded?

Are we looking at the same stuff to many times?

o   Are there a large number of duplicate documents and emails in the data as a whole?

o   Does custodian level deduplication increase the number of emails and documents substantially?

o   Do certain drives, media or locations contain a higher percentage of duplicate content?

o   What is the source of the majority of the duplicates?

o   Can we de-duplicate across the entire collection to reduce the work and cost?

o   Can we de-duplicate attachments and loose files globally?

Are we able to communicate effectively what we have and how we should proceed?

o   Do we have working documents to use in making filtering & culling decisions?

o   Do we have reports, facts to back up our plan?

o   Do we have summaries and documents that we can use in the meet and confer which do not risk privilege?

o   Do we have reports and documentation that we can use to argue our case / motion for : Burden, inaccessible data, cost shifting, overly broad discovery demand…

 

These questions and many more are answered when you user earlyCASE to analyze your eDiscovery / ESI.   For more information on earlyCASE visit:   http://www.earlyCASE.com

 

Over 40 early case assessment reports from YOUR data

 

The following is a brief introduction to the reports available in earlyCASE.

 

1.       Assumptions – Outlines the assumptions about the data, the cost to process & review it.   The assumptions directly impact many of the reports.  If you are going to conduct what if scenarios with different sets of assumptions, make sure you print the assumptions report and attach it to the reports generated based on those assumptions.

2.       Matter – This report is the information you entered on the first screen when you created a new matter.   This information can be updated and does affect the other reports.    The amount of anticipated raw data (ESI) and how long you have to review it are pivotal to the other reports.

3.       File Type Summary – This report will show you all of the file types seen in this ESI (including email attachments), a description of the file type, how many there are, the aggregate size of all of the files of this type, and the date range (last modified) of these files.   The report is sorted by the count with the largest (highest #) first.   This report should also be used in conjunction with the office files report.

4.       De-Dup – File Type Summary - (Professional Run Required)  This report is very similar to the file type summary – BUT with shows the counts and sizes based on a global deduplication of the documents.   It will show you all of the file types seen in this ESI (including email attachments), a description of the file type, the DE Duplicated count of how many there are, the aggregate size of the DE Duplicated files of this type, and the date range (last modified) of these files.   The report is sorted by the count with the largest (highest #) first.   This report also includes totals at the report of the report – Count and Size.

5.       File Date Summary – This can be a very long report in that it shows by date and time the number of documents along with the aggregate size of the documents for that date time.   This report is useful when you are looking for a specific document based on a narrow date range.  

6.       File Author Summary – This report relies on the metadata in the documents and will summarize by document author how many documents they authored, the aggregate size and the date range.  For this report to be useful the applications installed / configured on the machine which generated the documents must have been set up with the users name and not some generic information.    If you use this report make sure you validate it, as many machines do not have this information configured and hence it is not in the document metadata.

7.       Duplicates (Custodian) – (Professional Run Required)  This report provides a summary by custodian of the number of duplicate emails and duplicate files.   If both MD5 and SHA1 were generated it will show the counts by hash type as well.   In addition this report will summarize across all of the custodians the total number of duplicate emails and duplicate files.   For more information on how we determine duplicate emails please refer to this document on our website:   https://www.earlycase.com/resources/earlyCASE%20Detecting%20Duplicate%20Emails.pdf

8.       Duplicates (Global) - (Professional Run Required)  This report provides a summary across all of the custodians of the number of duplicate emails and duplicate files.   If both MD5 and SHA1 were generated it will show the counts by hash type as well.   In addition this report lists the duplicate documents with there MD5 hash and the count of how many duplicates there are.   This section is sorted by the count descending (largest # first) and is useful to spot check the duplicates as well as see what documents were duplicated the most.   For more information on how we determine duplicate emails please refer to this document on our website:   https://www.earlycase.com/resources/earlyCASE%20Detecting%20Duplicate%20Emails.pdf

9.       Image Summary –This report shows the types of images (pictures, etc) along with the aggregate size and date range.   Depending on the matter pictures (images) may not be useful to process, OCR, and review.    This report identifies the types and counts to assist in the budget and planning process of dealing with them if needed.

10.   Warnings & Errors – Any warnings of errors encountered in the processing of the ESI by earlyCASE will be reported here.   It is a good idea to check this report.   Password protected files, corrupt files, unsupported file compression, all are reported here.

11.   Budgets & Timelines  - This report contains the summary of the amounts of data, applies the assumption to this data and calculates the budgets and time required to handle the sample analyzed, but also extrapolates what the larger population of data will look like based on the sample.   This report is an excellent report to use when changing assumptions and effect that those changed assumption have on the project budget.   This report should be used in conjunction with the sizes and counts expanded report.

12.   26(f) report – This report is a Rollup of 6 of the other reports in earlyCASE.   The intent of this report is to provide a snapshot of the data in a matter, the assumptions, etc.  – all without disclosing anything that would be privileged or confidential.  As such this report is careful to only include summary type information useful in communicating and negotiating with the other side in a matter about the ESI / eDiscovery.

13.   Email “To:� summary – This report shows you who the custodians have been sending email “TO�, the counts and the date ranges of those emails.   It can be useful in identifying additional custodians as well in being able to justify eliminating a custodian from what is processed and reviewed.  

14.   Email “From:� summary - This report shows you who the custodians have been receiving  email “FROM�, the counts and the date ranges of those emails.   It can be useful in identifying additional custodians as well in being able to justify eliminating a custodian from what is processed and reviewed.

15.   Email Dates summary – Summaries by Year and Month the number of emails and their aggregate size.   It is useful in determining date cutoffs based on the ESI you have against the request.    Allows you to quickly isolate blocks of emails by data that are clearly outside the date range at issue.

16.   Conversation Summary – This report summarizes the number of emails (including responses and forwards) in an email thread as well as the date range of the messages in that thread.    This report should generally NOT be provided to the other side in a matter as the subject lines may contain privileged or confidential information.

17.   Duplicate emails – (Professional Run Required)  This report can be fairly long in a large population of emails.   It shows the MD5 hash of the email message, the sent date, the subject and provides totals at the end of the report.   This report should generally NOT be provided to the other side in a matter as the subject lines may contain privileged or confidential information.   For more information on how we determine duplicate emails please refer to this document on our website:   https://www.earlycase.com/resources/earlyCASE%20Detecting%20Duplicate%20Emails.pdf

18.   PST  & NSF Analyzed  - (Professional Run Required for NSF)  This report will show you a summary of the types of email containers processed,  there aggregate size, how many emails where processed from those containers and the aggregate size of the messages.   This report also shows by custodian and container how many messages and the aggregate size of the messages.   Lotus Notes (NSF) processing requires that a Professional earlyCASE run was done.

19.   Other EMail Containers – This report identifies less common email container files that are not processed by earlyCASE and that may require additional work to extract and review the messages.   The objective of this report is make you aware that you have some uncommon / less common email mailboxes in the population of data.

20.   Summary of Container Files - (Professional Run Required)  This report summarizes by custodian the containers observer well as summarizing the container files (by type), provides a description of that container type along with the number of that type of container, the aggregate size of the container, and the date (last modified date) ranges of those containers.   Totals of all the containers are also on this report.

21.   Container File Details - (Professional Run Required)  This report summarizes by custodian the containers observer well as providing details on what was extracted from each container.

22.   Encase, DD, AFF Image Info - (Professional Run Required)  This report details the drive images seen in the data that was processed by earlyCASE, the size of the image, the date of the image and the number of files that the image contains.   It also provides the details about the image  - when it was created, by who, the machine information, and any notes entered by the examiner when the image was created.

23.   Data Collection Summary – This report is show the details on drive images that were created using the new earlyCASE “Collect� feature.   This includes the Hash values of the images, the machine information, who and when the image was created, etc.

24.   Sizes and Counts Expanded – This report provides a summary view of how the data expanded both in size and counts.  It breaks this down by run and by piece of media.    This report also identifies the number and percentage of what was on that media that was a duplicates of things already processed.   Included on this report is a summary of the containers, what was extracted from the containers and a anticipated size of what you would pay to process and review based on the actual data you analyzed.

25.    Top 25 File Types – Generally the most common file types seen in a population of documents make up the majority of the count as well as size.   This report identifies the most frequent file types, the count, the aggregate size along with totals for what the top 25 file type represent in count, size and percentage of the total document population.   It is not uncommon to see the top 25 file types represent over 85% of the total population and it a good starting place to understand both the loose files as well as the files types that were attached to emails.

26.   Top 25 File Dates – The top 25 file dates report summarizes the population of documents by year and month and order the list based on the year / month with the most documents.   This is useful in understanding the distribution of the documents by date.   It be useful in seeing how the data you have relates to the dates of interest in the matter.

27.   Office File Types – This report looks at just the “Common� office types of documents against the larger population of documents and provides counts,  and aggregate sizes by file type for the normal Office Document types.   This report should be used in conjunction with the Top 25 file types report to form a picture of what files are predominant and meaningful.

28.   Other Costs and Expenses – This report takes the cost assumptions and applies it to the data that was analyzed to estimate the costs in this area for both the analyzed sample as well as the larger (extrapolated) set of data.    These costs include items like data collection, litigation support, project management, hosting costs, etc.

29.   Backup Tape Costs – Backup tape related costs are reported here and are NOT rolled into the budget for a project as generally backup tape is treated as inaccessible information.   This report identifies these costs based on the assumptions provided.   If backup tapes are to be handled in a matter these costs need to be manually added into your budget.

30.   Extrapolated Costs – This report extrapolates the size and counts of the larger data set size based on the sample that was analyzed.   It applies the filter cull assumptions provided and extrapolates the anticipated costs pre and post filtering for the larger set of data anticipated.

31.   Attorney Review Cost –This report shows the costs anticipated on reviewing the extrapolated set of data.   This report uses the assumption provided to arrive at cost of attorney review as well as the number of full time attorneys that would be required to complete the review in the time frame specified.

32.   Generally Included File Types – This report compares the file types observed in the data analyzed against a database (Filetypes) to summarize what the sizes and counts of the generally reviewed file types would look like.   This differs from the top 25 file types and office file types in that you can customize the file types which show on this report

33.   Generally Excluded File Types - This report compares the file types observed in the data analyzed against a database (Filetypes) to summarize what the sizes and counts of file types which are generally NOT processed or reviewed.   This differs from the top 25 file types and office file types in that you can customize the file types which show on this report

34.   Unknown File Types – This report summarizes the file types, counts and sizes for any file type which is unknown / not defined in the FileTypes table.   This report should be checked to see if there are file types which the generally included  and generally excluded file types reports did not pickup.

35.   Compare Run 1 and Run 2 –This report compares the files and emails analyzed in the first and second run of a matter to summarize what the differences are in the 2 runs.   This is useful when you have 2 images of the same hard drive and you need to understand what (if anything) has changed.   It also is helpful to validate a drive image against the source drive to insure that the image has everything.

36.   Folders > 100 Files – This report shows the folders (and path) of any folder which has over 100 files in it.   This is useful in checking for temporary locations, system storage which may be in the collection of data but really does not need to be processed and reviewed.    This report should be used with the Folder Inventory ALL report to form a complete picture of where documents were stored and folders / paths that can be filtered out.

37.   Folder Inventory ALL - This report shows the counts by folders (and path) and is ordered by the folder with the most files to the folders with the least files.  This is useful in understanding where the bulk of the files came from and potentially identifying paths which really do not need to be processed and reviewed.    This report can be pretty long, and you may want to focus on just the first 3 or 4 pages of this report.

38.   File Inventory with MD5 – This report is useful when you intend to turn over a population of native files to another party and you want to provide a complete inventory of what you are giving them which includes the hash values of every document.    This report will be very long!

39.   Charts and Graphs – earlyCASE provides charts and graphs of the file types, containers and other key pieces of information displayed in chart and graph form.  

40.   File Type Pivot – Pivot tables allow you to select / deselect filetypes which are then charted or visible in table form.   This is useful in seeing the impact size and count of filtering file types from the population.    This is an advanced Microsoft Excel Function and is well worth learning more about.

41.   File Date Pivot - Pivot tables allow you to select / deselect date ranges which are then charted or visible in table form.   This is useful in seeing the impact size and count of filtering date ranges  from the population.    This is an advanced Microsoft Excel Function and is well worth learning more about.

42.   Export Email and File tables to CSV – Use this feature to export the data in the access database to standard CSV files.   The Email Details, File Details, and Folder Details are exported with this option.

43.   Microsoft Excel Export - Use this feature to export the data in the access database to standard Microsoft Excel Spreadsheets.   The Email Details, File Details, and Folder Details are exported with this option. Be aware that MS Excel has a limit if 64,000 rows, so larger matters will overflow the limits of Excel and you should use the Export to CSV report.

44.   XML Export of Data – Users who have installed a full copy of Microsoft Access 2007 have the option of exporting the data into XML (instead of CSV).   Because XML is very verbose you should only use this if the CSV option will not work for you.

 

 

 

 

Alphabetical List of the currently available reports:

 

 

 

 

In a day where there is and a seemingly endless amount of email, files, folders, databases, and on and on and on where do you start in separating the meaningful documents from the masses of what you have?

Let’s look at how to leverage the reports and analysis available in earlyCASE to make sense of the ESI in the context of defining filtering and culling rules.    As many matters needs vary, the approach outlined here will be generic, adapt the reports you use as needed.

The major areas that ESI can quickly be eliminated or reduced (generally subject to the parties’ agreement) are:

1.      Restricting the Custodians and locations of data to be reviewed.

2.      Eliminating Folders / Paths that are system or temporary file locations.

3.      Restricting The Types of Files that are to be “Included� or to be “Excluded�

4.      Restricting The Date Range of Emails and Documents.

5.      Removing Duplicate emails and Files – Selection of the de-duplication method.

Let’s look at the earlyCASE reports that help with these 5 areas:

1.      Looking at the custodians report will show you the number of emails, attachments and files by custodian along with the date ranges of that custodians information.   For instance a custodian that has little to no email or files within the date range being looked at, may likely be an irrelevant to process and review.   Likewise looking at the email to and from reports will identify potential custodians which may be useful to look at based on the To / From reports as well as the Conversation summary.  In addition the Expanded sizes and Counts report will assist you indentifying what media the custodians information is on.   You will see as more pieces of media (drives, etc) are processed that later media will have a much higher percentage of duplicates.   You may even find that certain pieces of media can be skipped entirely.

2.      The locations (media, drives, and folders) should be reviewed to insure that temporary system location and file storage areas are not included in what is processed.    On most desktop computers Internet access as well as programs create thousands and at times tens of thousands of temporary files.   If your file type criteria include for instance HTML and Text files, you will likely be processing and reviewing a significant number of file fragments and temporary files which are in fact useless junk.   Looking at the Folders > 100 files report along with the Folder Inventory All report will assist you in isolating folders which can be skipped over (i.e. not processed and reviewed).    Also look at the Container Summary and Container File Details to see what containers you have as well as generally what is in them.     Identifying drives, network shares, media that is duplicative as well as irrelevant will save you a lot of time, money and effort.

3.      earlyCASE includes a number of reports to assist in understanding the types and counts of the loose files as well files attachments to email.   The File Type Summary will organize and show you all of the file types, counts and sizes.   Take a look at the Office File Types and the DeDup – File Type Summary to quickly identify the files types that should be “Included� or “Excluded� from processing and review.   Be careful to select EITHER an “Include� or “Exclude� strategy – Mixing methods is a bad idea.  Next look at the Generally Included File Types,  Generally Excluded file types and Unknown file types reports to make sure that your instructions on file types are clear. 

4.      Dates are generally pretty clear in terms of what should be in or out.   The File Date Summary and the Top 25 File Dates show the date ranges of the file in the collection.    The email to and from report show the date ranges of the emails and the container summary also assist in understanding the counts and sizes related to date ranges.

5.      Removing duplicates is done initially on a global basis or on a custodian basis.  The Duplicates (Custodian) and Duplicates (Global) reports will show you the overall duplicate email and file counts as well as the breakdown by custodian.   De-Duplicating globally will eliminate the most emails and files, but may meet with some resistance by those doing the document review.  These reports will let you see the difference in the counts and sizes from the two approaches.

 

Now that you have marked up reports, redlined dates and file types, figured out which media is relevant.   You has the basis of a clear set of filter cull rules as well as what should be outright skipped.   Having the earlyCASE reports as the basis of this process eliminates arbitrary and unfounded decisions which may be challenged later and could create problems later.

For more information on early case assessments and using earlyCASE visit:       www.earlyCASE.com 

Analyze and extract files from EnCase images in the early case assessment process without having EnCase installed on your computer

 

ATLANTA, GA (December 04, 2008) – Atlanta-based earlyCASE, a leader in advanced early case assessment for Electronically Stored Information (ESI) and eDiscovery, today released full native support for EnCase images and Encase Evidence Files (E01)  in its eDiscovery early case assessment software available as Software-as-a-Service  “SaaS�  from HUwww.earlycase.comUH.  earlyCASE is a SaaS web-based eDiscovery application which uses an on-demand deployment model (runs on your local PC) and analyzes the ESI that your computer can access in-place without the data ever leaving your computer or network.

 

earlyCASE allows you to quickly see and understand all of your data (including EnCase Images) before it is processed for discovery.  It supports multiple languages, extracts metadata, generates hash values, detects duplicates, email conversation threads and creates a local inventory database of documents and emails. earlyCASE allows users to make informed discovery decisions and easily cut down the size of data sets through filter and culling rules before going into the meet and confer, discovery processing  and document review.

 

In the past, looking at the contents and extracting files from an EnCase image required special software licenses and training.  With earlyCASE, handling EnCase images in the early case assessment process is as easy and seamless as zip files.   With the release today of the latest version of earlyCASE, you can extract files from EnCase images and analyze them along with the other ESI you have without any additional software or costs.

 

“We are excited to add native support for EnCase images to the list of content types that we can process in earlyCASE.  The low cost and flexibility that eDiscovery early case assessment as a software- as-a-service delivers is unparalled,� said Tom Strack, CEO of earlyCASE. “earlyCASE brings an immediate and real understanding to the eDiscovery process at the earliest moment, the lowest cost, and at an unprecedented speed, giving clients a more realistic view into what data they have at stake and the budgets associated with handling the ESI. With data storage continuing to increase in size, it is common to have terabytes of information to process and review. earlyCASE can rapidly analyze that data and decrease the data sets that need to be reviewed, reducing not only eDiscovery budgets, but managing their legal risk. earlyCASE can process the data in-place without it ever leaving where it is stored, using your own people and equipment and without any per gigabyte charges. “

 

earlyCASE is offered in three versions, a Basic (FREE) version,  a Professional version for a small flat rate charge, regardless of the amount of data you analyze, and an enterprise edition. The Basic version offers 28+ high-quality eDiscovery reports, one which estimates your processing and review budget while providing an immediate understanding of your data. With the Professional version, Lotus Notes & EnCase images are processed, a 26(f) report for meet and confer is available to help clients reduce legal risk exposure by offering a necessary view of the legal case information—custodians, context, third parties, and more. earlyCASE provides you the tools and results to best understand, define and memorialize the ESI going into the meet and confer. Duplicate document detection, container processing (zip, rar, arc), Lotus Notes NSF’s and EnCase images are the primary reasons most people use the Professional version of earlyCASE.

 

Pricing: earlyCASE basic is available for FREE, earlyCASE Professional is priced at $198 per run (unlimited data), and earlyCASE Enterprise licenses start at $8,000.

 

earlyCASE and the earlyCASE logo are trademarks of Level 9 Corporation

EnCase is a registered trademark of Guidance Software Inc.

Lotus Notes, IBM, Lotus Domino, Lotus Domino Express are trademarks of IBM Corporation.

All other trademarks are the property of their respective owners.

 

 

 

For more information, visit HUhttp://www.earlycase.comUH.

 

Press Contact:

 

Tom Strack

CEO

earlyCASE

PO Box 2474

Kennesaw, GA 30152

P: 404-819-6571

E: HUTom.Strack@earlycase.comUH

Traditional advertising no longer is the means to reaching people who have eDiscovery Data in their hands and are evaluating vendors and solutions.   Look at the reduced sizes of magazines as LTN, etc.   Advertisers and Vendors have to get smarter and have a better game plan to reach a more educated and empowered buying community than we had 2 years ago.  Advertising at the point of need is 15 times more effective than print advertising in reaching them and 25 times more effective than direct mail or email campaigns.

 

earlyCASE is the leading early case assessment and analytics software for eDiscovery, has over 1,200 licensed seats already, and is on the computer screens of people making ESI Collection, eDiscovery processing and document review buying decisions every day.

 

The way our sponsor program works is that sponsors are charged a flat fee to display their 30 second ad (image or multimedia) which is shown while a user is analyzing eDiscovery data.   Even if the ad shows 20 times in that users run the sponsor still only pay a flat amount.   Sponsors only pay if and when your ad is shown, and earlyCASE is only are accepting a total of 10 sponsors so the content cycles about every 10 minutes.   The ads are randomized so they don’t show in the same order and there is a like amount of non advertising content shown to make it more interesting to users.

 

At the end of the month sponsors will receive a report which identifies the domain of the accounts you ad was shown to during their runs of earlyCASE and the # of runs you advertisement was displayed on.

 

earlyCASE is the best way to get in front of buyers who have real cases and data right now!  If you have not created and tried earlyCASE I would encourage you to create a FREE account and see why so many users are jumping on board.   Give me a call or send me an email if I can be of assistance.  

 

If you are not the right person in your organization to take advantage of this win-win opportunity, I would appreciate it if you would forward this information to the right people.

 

 

Best regards

Tom Strack

Email:   Tom.Strack@earlyCASE.com

Phone:   404-819-6571

 

For more information visit us at:  http://www.earlyCASE.com

I had occasion today to attend a “Free” seminar being hosted by Google.  Well, whoever coined the infamous “No Such Thing as a Free Lunch”,  wasnt off by much.    The e-discovery angle (read Business Model) that Google has come up with is pretty compeling from the purely economic perspective.

It plays something like this….  You get rid of all your Email Servers in your Enterprise, or at least point your servers and mail exchange gateways at Google Mail Services (lovelingly known by Many as “Postini”).  Postini becomes your email archive, retention manager, litigation hold ability and now offers some really basic, fast and cheap full text indexing, searching and ability to export just what you believe is responsive.

The speakers they brought in to present the “Governance and eDiscovery in the Cloud” seminar did a good job of playing on the fears of the CIO’s / mail administrators in the room as to the brutal grilling they could expect in a 30(b)6 deposition or on the stand with there current policies and the way the effect litigation holds today.   

Like alot of 3 or 4 hour pitches they did a good job of making everyone take at least a half step back and wonder what role cloud computing could play in litigation holds.    Once implemented the fact that the repository is not under the control of the company being sued,  very strong policy and procedure, audit trails and reliability in the Google Archive Cloud make alot of sense initially.     This approach may well be the best of all worlds for a small to medium business.  Cost to implement is almost Zero, less staff, no hardware and a known cost per year per user… I am sure the bean counters will cheer.  The GC may also weigh in on the side of taking the litigation hold management out of IT’s hands.

So, where are the holes?   A couple have come to mind already - and if I were rested I could probably post a bunch more.   Here are some initial concerns:

How would you load years of OLD emails / edocs to get them into the Archive and under the new fancy records management / retention polices?    Who is going to validate the loading of historical emails, etc. so that you can destroy the old backup tapes?     What happens when your search identifies 1Million plus “Records” that need to now be exported from Google archive so you can send them to a discovery vendor or to a document review application?   I havent heard any validation that 100% of the metadata is proven to be intact when Google Exports it - Who wants to be the first to role the dice?    

On the surface their direction makes sense,  it will be interesting to sit on the sideline and see who feels up putting their neck on the line to trust google as their records manager.   Heck,  maybe Big Brother is Google and this is a plot to read all of our mail.    How scary is that?

What we do know is that today we have real cases and real discoverable ESI that does not give us time or the ability to absorb the risk of Googles long term vision.   When a case starts and the team starts collecting data, the last thing I would imagine that comes to mind is “Lets Upload this Terabyte to Google”.  

After the initial shock and the attorneys pressing the team the reality of “We have got to get a quick and accurate idea of what all this stuff is” sets in and this is where industry leading tools like earlyCASE (which is available as Software as a Service “SaaS”) www.earlycase.com lets you analyze the data without sending it anyahere.  Anytime and Anywhere they need this visibilty.   All this without having to take any risk.

You have to applaud Google for thinking outside the box,   the entire e-discovery industry could use more innovators and common sense approaches.   If you would like to discuss more about the cloud and ediscovery post a note here or email me at   tom.strack@earlycase.com

For more information about Google Retention / eDiscovery solution set check out:  http://www.google.com/a/help/intl/en/security/archive.html

One thing is for sure, cloud computing is the lowest cost storage and cpu cycles available today - finding ways to help your company using the SaaS / Cloud solutions that make sense for you is a good thing.

For many people early case assessment is a buzz term, for some vendors its a means to try and get clients to send them their data so they can have a look at it and tell them what they have (and how much they will charge them to process, and host it for review). Having come from the eDiscovery vendor side, the basic rule is ALLWAYS GET THE DATA. Once you have it in your hands its alot harder for them to not use you.

Have a look at the Ferris Reserch notes on earlyCASE ( www.earlyCASE.com ) at: http://www.ferris.com/2008/11/13/earlycase-releases-saas-based-early-case-assessment/

earlyCASE lets YOU analyze your eDiscovery data WITHOUT sending the data anywhere. You run it when and where you are. Even more importantly, is that earlyCASE is focused solely on early case assessment and not on getting your project. Because earlyCASE are experts in eDiscovery and early case assessment it gives you information and tools an eDiscovery vendor probably does not want you to have.

Between now and the end of the year, earlyCASE has a GREAT offer for new users - Let them demo the product to you and at least 1 of your co-workers - and everyone who is in on the DEMO gets FREE unlimited use of earlyCASE for 30 days. How Sweet is that!

Have a look, I am sure you will be impressed. http://www.earlycase.com

I think you will find the early case assessment checklist (parts 1 and 2) that John DeGroote authored pretty helpful.   They are high level, but layout a simple roadmap of items that need to be take into account.

Check his article out (click here)

To get your arms around the eDiscovery part of your case during early case assessment,  check out  www.earlycase.com

Interesting Article on Reducing the size of data ESI in the EDRM Model.  (Click Here for the Article)

 

I saw an interesting Post earlier today asking the Question - Is anyone finding a real world application of EDRM XML?    Well, I waited in the wings to see what was posted against this blog entry… and no posts.   This lack of energy made me curios as to where people are seeing the value added by the EDRM model. 

Absolutely Clarity,  but here is the angle you must hold EDRM at to see the real value it has brought to the market - both on the consumer side as we well as the provider side.   The business of creating a set of standards and moving a rapidly changing market and product offerings takes a while,  ultimatley when END USERS (the people with money and buying eDiscovery goods and services) will have to demand EDRM interchangble products & services before vendors who are better served by locking in clients with proprietary storage and interchange formats will lead with EDRM interchangeble offerings.

Why is interchageble formats and offerings good for the industry and the market in whole… This is where either people blood will boil or we hear the choir crank up.    Being able to use your vendor of choice for certain services and change on a dime to a best of breed or Niche provider because the ALL are compliant with how they store and interpret data.   Ultimately this will bring better point (niche) products as viable options for a specific requirement or step, because nothing is lost in changing horses.

As vendors strive to retain as much revenue as possible, knowing that a client can move there business very easily will drive better products and services across the board.  Will it drive eDiscovery prices down,  perhaps in the short term as vendors with lessor products and services lower their price as the only way they can retain or get business.  In the long run, market forces will reward better products with premium prices, and worse products with,   you guessed it… less money (or NO Business).

For instance,  If you collect/preserve data using a “Engine”, ”Spider”, Forensic tool that stores the data in a form that you have to use that vendors product to extract files, filter cull, or process the data for eDiscovery - you are absolutly stuck with that offering.  Even if it isnt the best product, or the best price, or you hate the way it works or what it produces.   Now,   lets put our Standards hat on - You use a tools that store the collected data in EDRM XML,  or uses the rising (open source) AFF (Advanced Forensic Format) that is an open architecture storage format that anyone can use, build application to read, etc.   Data in AFF, gives you lots of options - including using tools like EnCase or FTK to access.   Now ask yourself why in EnCase reading AFF, but does not give others access to the API to be able to read their formats.   Well,  a reasonable person would immediatly see the value to EnCase (and NOT the end user) of locking them into using EnCase products.

Examples like this are abundant across the board throughout the eDiscovery and Litigation Support industry.    This is where consumers voice has to ring loud and clear demanding interchangebility and standards based software and solutions…. Enter EDRM:    The EDRM model defines in very simple terms the building blocks and the methods of interchange between these elements.   How things work under the hood within a single step is where smart vendors will work there magic,  the connectors and interchanges are the common highway which smart vendors will adopt and seek out to make EDRM better for the common good.

Is EDRM self serving for vendors,  perhaps from a marketing perspective.  But when there are independent means of validating that a solution is in fact 100% compliant and interchangeable then the EDRM logo will mean more than you wrote a check or attended a meeting.   So does a vendors display of the EDRM logo mean much today,  well you will have to decide that.   Knowing alot of the players in the eDiscovery space and seeing them brandishing the EDRM logo, lets me know there is no real meaning today.  In the long run,  I certainly hope it evolves to something closer to where the ISO 9XXX programs took quality in this country.

Well back to where we started,  EDRM is the right start - But we need more, and that will not come until people demand it with their checkbook.   Well,  George Socha I hope i didnt offend your stoic reasonablness or the vision you have brought to a half full glass of cloudy eDiscovery water.    Stick with it,  the market will get there and when they do vendors will finally step up with real interchangebility between the EDRM blocks.

Where does EDRM fit into the eDiscovery early case assessment - quite simply as collected data, litigation holds, archives, repositories store there data in a standard form and offer EDRM XML interchangebility places data within easy and rapid reach to be analyzed.   Today, connectors, middleware and some odd gyrations are required.   Leading products like earlyCASE analyzes large amounts of data very quickly in giving a clear and meaningful visibility,  as EDRM becomes a reality earlyCASE will get even better, faster, and be able to get to more and more data at a low cost.    If you like the concept of EDRM get involved, speak up, make it part of your requirements.

For more information about early case assessment for eDisocvery visit:  http://www.earlyCASE.com

for more information on EDRM visit:   http://www.EDRM.net

to send George Socha a Note of thanks for being the EDRM conductor:  George@sochaconsulting.com