Menu
Menu
Loss of electronic memory is no longer a reliable strategy

Loss of electronic memory is no longer a reliable strategy

Almost any information can now be retrieved from almost any electronic device.

Software that can sort through voicemails and recorded conversations, even allowing for regional accents, has joined the growing array of IT equipment being used in legal forensic work and even in electronic document discovery. One result of searches with this new software is the occasional shocked witness confronted with emails dispatched as much as five years previously, contradicting the bland denials they have just given.

In future, business executives will really have no excuse for stunned looks when their past activities resurface electronically in court.

A proliferating array of specialist IT firms, big four accounting teams and inhouse electronic discovery departments in major law firms are deploying software to sift through memory sticks, Blackberries, executive PDAs, notebooks and laptop computers, mobile phone logs, back-up tapes, server hard drives, internet records, instant messages, webmail, multimedia messages and anything else in the electronic computing and internet world to nail down hard facts.

"This year it's concept searching. That's a follow-on from keyword searching," says Adrian Briscoe, general manager of data recovery and litigation database specialist at Kroll OnTrack.

"It's basically a way of trying to examine corporate data, using words that could be associated with the key word. We have some new technology that has algorithms in it. There's an awful lot of electronic data out there, and what we're finding is that key words generate too many hits.

"You end up with a huge amount of hits every time you do electronic discovery."

Refining the software to focus on general concepts makes it more analogous to the way a human would search a pile of files, looking for relevant material, associations and timelines, rather than just recording every appearance of a corporate name or routine transaction.

Both the NSW and Victorian Supreme Courts now have detailed prescriptions on how electronic discovery is to be conducted. Australian lawyers are also keeping an eye on the progress of relatively recent electronic additions to the US Federal Rules of Civil Procedure.

"The Supreme Court of NSW introduced a practice note in July this year," says Susan Bennett, the partner heading commercial litigation at law firm Sparke Helmore. "It has some similarities to the new US rules.

"It now requires the parties to discuss electronic discovery before the first court return date. The thing that interests litigation lawyers is the new software that searches on concepts.

"That's fascinating litigation lawyers. You can send these search programs through an email collection, rather than just getting every email printed out. The key thing is that as the volume of electronic information grows, you need to have more sophisticated search software."

Many Australian corporations still haven't realised how all pervasive search and data recovery software has become, says John Brand, co-founder and research director for IT research firm Hydrasight.

"These legal discovery orders can find information companies didn't know they had," he warns. "The legal firms we work with say there's more all the time. They're becoming more sophisticated in what they can retrieve.

"You do find that the threat of electronic legal discovery can settle a case.

"It can be very onerous and costly. Companies will often pay a fine or settle out of court to close a matter down."

Even if an organisation has meticulously deleted information from hard drives, laptops, desktop terminals and servers, that can be undone by information held externally.

"Information doesn't have to be retrieved from within your own organisation," says Brand. "You may have deleted material on your desktop, server and backup tapes, but it may still be recorded on an ISP's relay server."

Courts are becoming keener on native file review. This means material supplied in its original format, complete with all the hidden electronic filing and indexing code showing dates, locations, originating source and other control information generally referred to as metadata.

"A lot of courts are saying that evidence needs to be in native file," says Kroll OnTrack's Briscoe. "With native file there's the opportunity to look at all the metadata."

When material is being extracted from a hard drive for imaging, to create a court book, the normal processes of computer operation will modify the metadata, as the process of copying itself generates new authors and processing dates.

When Kroll OnTrack takes out hard drives for copying, it installs a write blocker to ensure nothing is written back to the target drive, ensuring a forensically sound copy with no access dates changed.

"The collection of evidence is very important, so that when it goes to court, the court knows there's no contamination," Briscoe says.

©Fairfax Business Media

Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

Join the newsletter!

Error: Please check your email address.

Tags datasecurityvoicemail

Show Comments

Market Place