Articles

Many legal teams use endorsed searchable PDFs as their preferred format for producing electronic evidence. I suspect that two of the most common reasons for this may be that PDFs are a format attorneys are very familiar with, and that the productions can be prepared in-house using the tools the firm has.

I am generally not a fan of PDF productions because I think they lack both the advantages of a native production (e.g. maintaining the metadata and functionality of complex electronic files) and the advantages of a TIFF production accompanied by load files (e.g. flexibility and ease of use with legal review platforms). In fact, our experience shows that upon receiving a searchable PDF production, most law firms hire an outside company, or engage their in-house litigation support team to have the documents converted to a TIFF production with load files so that they can be loaded into a legal review platform.

In a perfect world, e-Discovery would be as simple as pointing your software at the data source, kicking back and waiting for all documents to be ingested and processed with 100% accuracy. However, in the real world, e-Discovery involves dealing with thousands of file types, some of which are very complex and cannot be automatically handled by even the most sophisticated e-Discovery platforms. Consequently, being able to perform defensible e-Discovery requires the close supervision of experienced e-Discovery experts and a well-thought-out exception handling policy.

Even though most e-Discovery projects involve image output (TIFF, JPG, PDF etc.), we find that the specifications of the output images are rarely discussed thoroughly. An important detail, which is usually omitted from e-Discovery processing specifications, is whether or not output images should be normalized.

Image normalization (in the e-Discovery sense) is the process of transforming images to make them consistent in terms of dimensions, resolution, color depth and orientation. For example, larger images can be resized to 8.5″x11″, landscape pages can be rotated to portrait, images with different resolutions can be converted to 300 DPI etc.

Most mailboxes contain both active and deleted e-mail messages. By “deleted e-mail messages”, I am referring to messages that were permanently deleted. For example, a message that was deleted using SHIFT+Delete in Outlook or a message that was deleted from the “Deleted Items” folder. In some e-mail platforms, deleted messages are not immediately purged and can easily be recovered. For example, Ms Outlook does not purge deleted e-mail messages from a Personal Storage Table (PST) file until the PST is compacted.

If you are involved in the production or review of electronic evidence, you might have seen e-mail addresses that look a bit different than usual. For example:

Have you ever wondered what these values are? The two scenarios we run into most frequently are as follows.

De-duplication is used extensively in digital forensics and e-Discovery as a way of culling documents. While the process itself is simple, de-duplication can be performed in numerous ways which affect review time, cost and your understanding of the custodians. Here are some questions that frequently come up while we discuss de-duplication options with clients.