PRESERVATION – PART 1: Delving into the Client’s Data Architecture – Identifying Devices As Witnesses | Articles

August 9, 2022

Articles

PRESERVATION – PART 1: Delving into the Client’s Data Architecture – Identifying Devices As Witnesses

Vestige Digital Investigations, President, CEO and Founder

MBA, CISA, CSXF, CMMC-RP

Here’s a technique of identifying those devices that may be witnesses in a particular case. This technique requires the development of knowledge regarding the distributed computing model in which clients provide devices to employees and network those devices by using equipment such as routers and switches.

This article discusses the manner in which Vestige examines the client’s data architecture in order to identify those electronic devices on which relevant electronic information is stored that must be preserved and used in the matter. It has been Vestige’s experience that counsel usually needs expert assistance in this area in order to design and execute a preservation plan that can be successfully defended if challenged by a party opponent. More importantly, because these devices identify the sources of information on which the case will be built, claims and damages proven, defenses raised, it is absolutely essential that the devices be properly identified.

Preservation is Key to E-Discovery

The power of the Computer as Witness paradigm is that it allows attorneys to begin to accommodate electronically stored information in any case by relying on a skill set that is well developed in practice: identifying key players/witnesses in a case. In order to accurately include as witnesses those electronic devices on which may reside relevant data (and which must be preserved) counsel ought to consider the following three step process:

STEP ONE:

Focus on the electronic device, not the individual electronic records or documents. Quit chasing documents in an electronic sea of data.
Generally, identifying relevant electronic devices as sources of electronic evidence is no more difficult than identifying key players. The identification of relevant electronic devices focuses upon the “device”—not upon the data resident on the device. This is similar to initially focusing upon identifying the witnesses and leaving to another day the act of interviewing each witness to identify relevant testimony. At the commencement of a matter, when the client and attorney have duties to preserve relevant electronically stored information, counsel ought to focus on preserving the “device” rather than the individual documents on the device. Preserving the device will automatically preserve the data on the device.

It is important to recognize that technological methods of preservation do not require key players, IT personnel, contract attorneys, paralegals or any other person to search the device. There is no need to expend time and money early in the case addressing the volume of documents resident on each electronic device that might be potentially relevant to the matter. There is no need to become concerned and overwhelmed by the volume of data that might exist in a particular case. Simply preserving the device automatically preserves all relevant information—while saving for another day the act of searching for that relevant information.
Finally, preserving the device, instead of individual documents, preserves all the evidence, including Content and Artifacts (artifacts tell us how a device was used), and can be accomplished in minutes (faster than the device can be searched); insulates the client from the litigation response process, and is easily affordable (a few hundred dollars).

STEP TWO:

Identify the devices used by key players.
Sometimes attorneys get overwhelmed by the number of computers and electronic devices used by a client. A hospital, for example, may have thousands of devices, including Radio Frequency Identification Devices embedded in everything from sponges to equipment and name tags. In such a situation, the “Computer as Witness” paradigm proves useful because it analogizes electronic devices to human witnesses who have some knowledge relevant to the matter at hand. For example, a client may have hundreds or thousands of employees; but not every employee of a client is a witness in a matter. At the beginning of a case, counsel always identifies those persons who may be witnesses. Counsel is rarely overwhelmed by the total number of employees because he understands that only a small subset of employees are likely to have any relevant information and be witnesses.

STEP THREE:

Similarly, Counsel ought not to be overwhelmed because a client has hundreds or thousands of computers and electronic devices in the workplace.
Not all electronic devices will be witnesses; but Counsel needs a process by which to identify potential electronic witnesses. It is suggested that Counsel can become skilled at identifying electronic devices that are potential witnesses by first identifying key players, and then identifying the specific electronic devices used by those key players to create information and/or to interact with others.