Case in Point 2010-05-31 05:00:53
May 31, 2010
About ‘Case in Point’ – ‘Case in Point’ is a weekly cartoon series, created by CaseCentral Corporation, that illustrates the lighter side of eDiscovery. ‘Case in Point’ also runs a contest inviting anyone from the expansive eDiscovery realm – lawyers, IT staff, judges, service providers, paralegals, writers and consultants – to submit their own humorous experience or a scenario they find particularly funny. Participants may submit cartoon ideas online at http://www.casecentral.com/caseinpoint/idea for consideration. Readers who see their idea turned into a cartoon will receive a copy of the final cartoon signed by the artist, Tom Fishburne.
Permission to reproduce ‘Case in Point’ cartoons is granted on the conditions that any cartoon used is reproduced “as is” and that the re-use is not for purposes of resale or direct compensation. Please provide CaseCentral with a copy of any such use by sending an email with attached sample to: caseinpoint@casecentral.com.
Case in Point mailing list – Visit www.casecentral.com/caseinpoint/mailsignup/ to have Case in Point sent weekly to your eMail. To opt out, send an email titled “UNSUBSCRIBE” to caseinpoint@casecentral.com.
Case in Point Resources – Get the ‘Case in Point’ one year anniversary screen saver: www.casecentral.com/case-in-point/resources/ or ‘Case in Point’ mobile for your iPhone or Blackberry: www.casecentral.com/case-in-point/mobile/.
Case in Point Café - Visit http://www.cafepress.com/CaseInPoint to turn your favorite cartoon into a keepsake or gift for that special eDiscovery somebody.
About the cartoonist – CaseCentral is pleased to feature Tom Fishburne as the cartoonist behind ‘Case in Point.’ See Tom’s bio here: http://www.tomfishburne.com/tomfishburne/bio.html
About CaseCentral – Case in Point is sponsored by CaseCentral. Visit www.casecentral.com to learn more about CaseCentral’s eDiscovery products and services.
Forensic 4cast Awards
May 27, 2010
The second annual Forensic 4cast Awards will be held as part of the SANS Forensic Summit in Washington DC on Thursday July 8 2010 at 7:30pm. This event will be held in front of a live audience full of digital forensic investigators, vendors, and other interested parties. The awards have been formed to celebrate the achievements of all those working in the field of digital forensics regardless of where they serve. Nominations are now being accepted at http://forensic4cast.com/?p=612. Please bare in mind that these nominations are for work that has been accomplished in the last 12 months only. Nominations will close on Sunday June 13 2010. Voting will commence shortly thereafter.
Avoiding common job application errors – questions please!
May 26, 2010
I'm delighted to announce that computer forensics recruitment specialist David Sullivan has agreed to become a regular columnist here at Forensic Focus. David has asked for any questions related to his first piece, "Avoiding common job application errors", to be posted to this forum topic where he'll be very happy to answer them publicly.
Access Data FTK v3 & Macintosh Forensics
May 26, 2010
The Apple Examiner has posted an article written by Brian Salmon showing the new features of Access Data’s latest release of FTK and how it applies to analyzing Macintosh data. The entire article can be read at http://www.AppleExaminer.com
Radio Tactics Launches Aceso v5 Mobile Phone Forensic Equipment
May 26, 2010
Radio Tactics Ltd - www.radio-tactics.com - a provider of mobile phone forensics equipment today announces the launch of Aceso v5. The Aceso v5 is an upgrade to the existing Radio Tactics Aceso device, which enables users from government and law enforcement agencies as well as the corporate sector to recover evidence from mobile phone handsets, SIM cards and media cards. This evidence can be used directly in a prosecution or as intelligence to assist an ongoing enquiry. The Aceso enables fast extraction of data from a mobile phone by a user with minimal training, allowing forensic experts to focus their time on more specialist areas...
Failure to Test Keywords by Sampling a Prominent Consideration in Court’s Finding of Waiver
May 24, 2010
Mt. Hawley Ins. Co. v. Felman Prod., Inc., 2010 WL 1990555 (S.D. W. Va. May 18, 2010)
Where plaintiff (Felman Production, Inc.) failed to take sufficiently reasonable precautions to prevent the disclosure of a privileged email, privilege was waived.
In this case, the court addressed a number of issues, including the parties’ compliance with their clawback agreement and the applicability of the crime-fraud exception to 377 inadvertently produced, privileged emails. The primary focus of this summary, however, is the court’s analysis of whether the privilege was waived as to one specific email, “the May 14th email”, and in particular, its analysis of the reasonableness of plaintiff’s precautions to prevent such disclosure.
The May 14th email was inadvertently produced by the plaintiff amidst “a massive disclosure of e-discovery”. Plaintiff learned of the email’s production several months later when defendants attached the email to a motion to amend their answer. Three days later, plaintiff sent a letter noting that the email had been listed on plaintiff’s privilege log and demanding the email’s return. Thereafter, disagreement arose between the parties and the question of waiver was brought before the court.
Taking up the issue, the court first highlighted the five-factor test established in Victor Stanley, Inc. v. Creative Pipe, Inc., 250 F.R.D. 251 (D. Md. 2008): 1) the reasonableness of the precautions taken to prevent inadvertent disclosure; 2) the number of inadvertent disclosures; 3) the extent of the disclosures; 4) any delay in measures taken to rectify the disclosure; and 5) overriding interests in justice. Next, the court laid out the relevant provisions of Fed. R. Evid. 502(b) and indicated its intent to “apply Rule 502(b), considering Victor Stanley and similar cases as to reasonableness.” The court then quickly determined that the production was inadvertent and that plaintiff promptly took reasonable steps to seek the email’s return. Accordingly, the remaining issue for consideration was the reasonableness of plaintiff’s efforts to prevent such production in the first place.
Following a brief discussion highlighting factors for consideration, including the volume of documents produced, any applicable time constraints, the use of analytical software applications and linguistic tools, and fairness, the court then noted Judge Grimm’s remarks in Victor Stanley, namely, that “[t]he only prudent way to test the reliability of the keyword search is to perform some appropriate sampling of the documents determined to be privileged and those determined not to be in order to arrive at a comfort level that the categories are neither over-inclusive nor under-inclusive.” The court also pointed out the very interesting detail that plaintiff’s counsel had “participated in the Victor Stanley case ‘after all the events that are relevant…had taken place.’”
The court next provided a lengthy list of the steps taken by plaintiff and counsel to produce relevant documents while protecting privilege, including using “privileged search terms” to identify materials for individual review and conducting an “eyes on” review of those documents. The court also found that an unexplained glitch in the vendor-created database files contributed to plaintiff’s failure to identify the inadvertently disclosed email(s) where the file from which many of the inadvertently produced documents originated failed to build a complete index of potentially privileged materials.
Nonetheless, the court was unwilling to find that the inadvertent production of 377 privileged documents (plus the email primarily at issue in this summary) was “solely attributable” to the technological glitch and found that plaintiff and counsel “failed to perform critical quality control sampling to determine whether their production was appropriate and neither over inclusive nor under-inclusive, even though that firm was counsel in the Victor Stanley case”, among other things.
Applying the five-factor test established in Victor Stanley “in the context of [the court’s] findings and the commentary to the rules”, the court found that plaintiff and counsel did not take reasonable steps to prevent disclosure and that the privilege was therefore waived:
First, the precautions taken to prevent inadvertent disclosure were not reasonable. As warned in Victor Stanley, 250 F.R.D. at 257, the failure to test the reliability of keyword searches by appropriate sampling is imprudent. Second, the number of inadvertent disclosures is large, more than double the number discussed in Victor Stanley, a number which underscores the lack of care taken in the review process. The May 14 email resonates throughout this case--a bell which cannot be unrung. Its content has had great influence on Defendants' discovery requests and deposition questions. Confidentiality cannot be restored to that document. Third, the extent of the disclosures is not known to the Court because the 377 documents have not been submitted in camera. Fourth, there has been delay in measures taken to rectify the disclosure of the documents. It is an important fact that identification of privileged documents which were disclosed to Defendants was made by the Defendants, not Felman or its counsel. Finally, as in Victor Stanley, id. at 263, Felman has "pointed to no overriding interests in justice that would excuse them from the consequences of producing privileged/protected materials."
A copy of the full opinion is available here.
EnCase file copying and Windows Short File Names
May 24, 2010
By Lee Hui Jing, EnCe "A couple of months ago, one of my clients, an Investigating Officer from a Law Enforcement Agency, had requested me to extract some of the files from an image copy of a hard disk. The total number of files to be copied was 1,030. Sounds easy right? This job of a few clicks turned out to be a nightmare when I found out that I was short of 2 files in my destination folder..." Read more
Case in Point 2010-05-24 05:00:52
May 24, 2010
About ‘Case in Point’ – ‘Case in Point’ is a weekly cartoon series, created by CaseCentral Corporation, that illustrates the lighter side of eDiscovery. ‘Case in Point’ also runs a contest inviting anyone from the expansive eDiscovery realm – lawyers, IT staff, judges, service providers, paralegals, writers and consultants – to submit their own humorous experience or a scenario they find particularly funny. Participants may submit cartoon ideas online at http://www.casecentral.com/caseinpoint/idea for consideration. Readers who see their idea turned into a cartoon will receive a copy of the final cartoon signed by the artist, Tom Fishburne.
Permission to reproduce ‘Case in Point’ cartoons is granted on the conditions that any cartoon used is reproduced “as is” and that the re-use is not for purposes of resale or direct compensation. Please provide CaseCentral with a copy of any such use by sending an email with attached sample to: caseinpoint@casecentral.com.
Case in Point mailing list – Visit www.casecentral.com/caseinpoint/mailsignup/ to have Case in Point sent weekly to your eMail. To opt out, send an email titled “UNSUBSCRIBE” to caseinpoint@casecentral.com.
Case in Point Resources – Get the ‘Case in Point’ one year anniversary screen saver: www.casecentral.com/case-in-point/resources/ or ‘Case in Point’ mobile for your iPhone or Blackberry: www.casecentral.com/case-in-point/mobile/.
Case in Point Café - Visit http://www.cafepress.com/CaseInPoint to turn your favorite cartoon into a keepsake or gift for that special eDiscovery somebody.
About the cartoonist – CaseCentral is pleased to feature Tom Fishburne as the cartoonist behind ‘Case in Point.’ See Tom’s bio here: http://www.tomfishburne.com/tomfishburne/bio.html
About CaseCentral – Case in Point is sponsored by CaseCentral. Visit www.casecentral.com to learn more about CaseCentral’s eDiscovery products and services.
To Avoid ‘Plain View,’ Investigators Need Blinders
May 24, 2010
The 1st, 4th, and 7th U.S. Circuit Courts of Appeal have applied the plain view doctrine to computer searches. The 9th U.S. Circuit Court of Appeals rejected the doctrine in United States v. Comprehensive Drug Testing. This article looks at the pros and cons of both approaches... More (LTN)
Types of Digital Forensics Research
May 21, 2010
by Chris Hargreaves "Browsing through the forums on Forensic Focus, on numerous occasions I have come across requests for MSc project ideas. An MSc project is a research project, and that requires the identification of an area of research in which a contribution can be made. It is possible to list a number of technical areas that are in need of further research, for example, mobile devices, games consoles, cloud computing etc. However, the aim of this article is not to provide specific project topics, but to present the different types of research that can be carried out..." Read more