Archives

Facing litigation and having to produce company documents to third parties can be an unsettling experience. Some businesses react to this by attempting to do as much of the identification, preservation and collection work in-house, using either company staff or their trusted IT consultants. While this sounds like a good idea for keeping as much …

Legal teams often choose to prepare image productions accompanied by load files, and many of them make simple mistakes or bad choices that make it unnecessarily difficult for the recipient to utilize the produced information. While helping a firm sort out a disastrous incoming production, I was inspired to write this post with the hope …

Many legal teams use endorsed searchable PDFs as their preferred format for producing electronic evidence. I suspect that two of the most common reasons for this may be that PDFs are a format attorneys are very familiar with, and that the productions can be prepared in-house using the tools the firm has. I am generally …

E-mail messages contain numerous metadata fields that are utilized by computer forensic examiners as well as legal teams. One key MAPI property that is frequently extracted by computer forensics and e-Discovery software, but yet usually overlooked or underutilized, is PR_CONVERSATION_INDEX. This property indicates the relative position of a message within a conversation thread and is …

File names are stored as strings in almost every operating system and database management system. While this works well in most cases, it causes files with names containing numerals to be sorted counter intuitively. For example, contents of a folder containing 7 files with numeric suffixes would ordinarily look as follows: Exhibit1.pdf Exhibit10.pdf Exhibit15.pdf Exhibit2.pdf …

In a perfect world, e-Discovery would be as simple as pointing your software at the data source, kicking back and waiting for all documents to be ingested and processed with 100% accuracy. However, in the real world, e-Discovery involves dealing with thousands of file types, some of which are very complex and cannot be automatically …

Even though most e-Discovery projects involve image output (TIFF, JPG, PDF etc.), we find that the specifications of the output images are rarely discussed thoroughly. An important detail, which is usually omitted from e-Discovery processing specifications, is whether or not output images should be normalized. Image normalization (in the e-Discovery sense) is the process of …

Most mailboxes contain both active and deleted e-mail messages. By “deleted e-mail messages”, I am referring to messages that were permanently deleted. For example, a message that was deleted using SHIFT+Delete in Outlook or a message that was deleted from the “Deleted Items” folder. In some e-mail platforms, deleted messages are not immediately purged and …

Modern e-Discovery software can extract hundreds of metadata fields from documents. Extracted metadata is typically stored in a back-end database and a subset of it is exported and included in the e-Discovery production or review database. We often receive questions regarding which metadata fields should be included in an e-Discovery review database or which metadata …

If you are involved in the production or review of electronic evidence, you might have seen e-mail addresses that look a bit different than usual. For example: /O=EXAMPLE/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=USERNAME Have you ever wondered what these values are? The two scenarios we run into most frequently are as follows: 1) LegacyExchangeDN & X.500 Addresses …