Where ESI is Stored and How it is Retrieved: Module 2 of 5

a discovering module to wear ESI is stored and how it is retrieved ESI storage the person in charge of data storage has turned the custodian of that data that could be the party who created the document and keeps it on a local computer or it could be a cell phone company or cloud storage host electronically stored information can be stored and accessed in many ways in places this means physical storage of data which requires some form of electronic usually magnetic media this media can include permanent media like personal computer hard drives company network drives phone

storage drives and so on it can also include temporary or removable media like flash drives the process of locating and charting all this data and attendant corporate policies regarding that data is called data mapping there are numerous data mapping platforms the media can be physically located anywhere and can be accessed from anywhere this includes hard drives in the cloud which means data stored off-site often by third party providers and accessed by the entity who is subject to discovery to begin in this module we will discuss where ESI is stored and how to access it one

factor in accessing ESI is the cost and as the federal rules allow discovery to be limited by costs that is an important consideration in discovery requests the cloud the cloud accomplishes off-site data storage which means that the server's housing the data are not located at the same place as the business or residence as the entity that owns the data on-site means that the servers are physically located in the same place as the person who generated the information for example an iPhone stores text messages on site but those texts are backed up in iCloud off-site documents

could be stored on a PC on site but the files are backed up in the Google cloud off-site the term cloud is shorthand for what is actually known as software as a service or SaaS cloud storage companies perform the data storage and access functions that could be accomplished on-site but which are usually cheaper to transfer to a cloud storage service the term refers to both the physical servers housing the data and the software that makes these servers perform storage function proportionality one of the major changes to rule 26 B of the Federal Rules of Civil

Procedure in 2006 and again as amended in December of 2015 was the introduction of the idea of proportionality proportionality is a cost-benefit analysis that can be applied to a discovery request for ESI prior to that time courts rarely considered the costs of discovery but it became evident over time that the cost of drilling down into millions of documents looking for certain keywords or an email chain we're expanding exponentially there were some cases where the cost of discovery were greater than the amount in question in the case so courts were given discretion to limit ESI production

on a case-by-case basis based on cost types of data storage one way to categorize these storage methods for a proportionality analysis breaks them down into five types type 1 active online data this is the data that the holder of the ESI actively uses and consists of all active storage on hard drives network servers or in the cloud this is the most easily accessible information and is the least costly to maintain and access it is first tier data type to near online data this is information that has been stored on removable media like flash drives external

disk drives SD cards etc it also includes data stored and accessed via remote devices like magnetic tape and optical drives it's also considered first tier because the data can be accessed quickly and easily type 3 offline storage and archives this is information that has been sent out for storage generally it's no longer in active use but it can be accessed if needed this is data housed outside of normal business and needs to be physically accessed this data is on magnetic tape optical drives etc it is reasonably accessible because it's still a part of normal business

operations it's still considered first to your data since it can be accessed relatively easily type for disaster recovery files these are off-site and usually compressed or encrypted this data could be physically held by a third party but may be more complex to recover this kind of data will be subject to a proportionality analysis because retrieval can be very costly it is second tier data type 5 erased fragmented or corrupted data this data may be difficult or impossible to access but it also may contain evidence of tampering with the data trying to reconstruct this data can

be very expensive and may not produce results the proportionality arguments here will often be speculative as in we know they erase this data but we need to access the hard drives to prove it courts vary greatly in how they handle discovery requests for this data people store their own data personally on their computers phones tablets and other devices businesses store data on their in-house servers all this data is subject to e-discovery under FRCP rule 26 state discovery rules and state and federal rules of evidence all this private data is also subject to the preservation rules

outlined in the first module third-party storage because cloud companies have physical control of data they're also subject to subpoenas for that data in addition attorneys who use cloud storage services are subject to ethical considerations regarding client security and privacy both of these ideas will be expanded on incoming modules principles of accessing cloud storage also apply to companies that transmit or store data as a regular part of their customer business models this includes phone companies like Sprint and t-mobile and social media companies like Facebook and Reddit there are also companies that offer encrypted storage if any

of these companies store data that was transmitted or posted by a customer then they are third-party data storage companies for purposes of responding to discovery requests or subpoenas who the actual owner of the data is might be unclear but all companies that store other people's data for any reason whether the customer even knows the data is being stored are subject to e-discovery like any potential evidence all ESI documents are subject to chain of custody analysis to determine their authenticity this is done by looking at the metadata of the documents and the storage devices to track

the documents creation in history forms of electronically stored information here's a look at some primary forms of ESI and how each may present difficult ediscovery problems email email is the predominant form of ESI comprising by one estimate 90% of all ediscovery that is because not everybody texts not everyone uses social media and not everybody stores data in the cloud but everybody uses email email is archived so that it can be accessed but email systems often don't have the native search capabilities to adequately respond to ediscovery requests so there are numerous third party email centric search

platforms available in the market databases databases also present preservation and search challenges to the discovery process databases can hold hundreds of millions of documents and even the most sophisticated search platforms can take a substantial amount of time and money to search properly in determining whether discovery requests sent to holders of a database are enforceable the threshold questions revolve around proportionality and will include questions about the standard and enhanced reporting capabilities of the database exporting capabilities database structure query language capabilities user experience and interface and more all of that can be expressed in general terms and

in case specific terms once proportionality is established the parties should work out amongst themselves what data is accessible and how it will be accessed and delivered what information is privileged needs to be addressed as well word processing and spreadsheets here we have data that is often changed and passed around to multiple users in the ordinary course of business the metadata changes every time the document or spreadsheet changes and numerous versions can be stored on numerous devices chasing down all the versions of these documents and spreadsheets around multiple users devices is a form of detective work

and the time involved may impact proportionality challenges also exist of course for all other forms of ESI faxes are long-distance photocopies but are also stored in various places audio and video files photographs and multimedia are geo stamped and have their own metadata but are also subject to editing other documents are subject to audit trails that are discoverable and of course the internet itself is a source of tremendous amount of information all in all while there is a lot of data that is discoverable it may not be so easy to get to it and there is

of course an entire ediscovery software industry dedicated to producing products that find transmit and analyze all this data trying to keep documents private encryption and password keeping data from prying eyes hackers or other unauthorized users require some effort on the part of custodians of that data the most common techniques to achieve privacy include password protecting encryption and physically separating the data storage unit from the rest of the system that last technique is called air gapping password protecting and encrypting files emails texts and other data is common practice for users to help ensure data privacy and

security when faced with the subpoena discovery requests encrypted files may cause some problems some of them fatal to the discovery request encryption is coding information scrambling in a way that only a party with the encryption key can translate it is as old as human communications traceable back at least as far as the time of Julius Caesar when we talk about data encryption in the modern context we're referring to a process that makes data inaccessible to a reader unless that reader has a key basic passwords are a type of encryption encrypted data keys are lengthy strings

of letters numbers and symbols those can be a varying length but the standard keys today are usually 256 characters or bits the 256 bit encryption is often referred to as military-grade there are two types of keys single key and public key a single key is held by the sender and the recipient this is also referred to as end-to-end encryption and is found in private texting platforms like signal and whatsapp public keys are used in e-commerce where one party say an online store holds a key available to the public and then each user creates a personal

password to access the website or purchase a product there are numerous encryption standards you may see initials like RSA PGP SSL S et des are others but for legal purposes the standard does not matter what is important is access to the data that is hiding behind the encryption key the three primary uses of data encryption within the legal context are in data storage data communication and online transactions for ediscovery purposes in civil cases courts will generally require data to be unencrypted by the respondent to a discovery request or subpoena under the principles of open discovery

discussed in module 1 so much of the time encryption really is not much of an issue the primary problems that may arise on the civil side and attempting to access encrypted data are ones where the data key is not available often because the one person who held the key died or can't be located there is some precedent in cases where the key can't be located to simply declare the data unavailable as not reasonably accessible because of undue burden or costs if we're covering the data is reasonable the court could order that recovery criminal cases are

a different matter because they run into the Fifth Amendment right to remain silent which may include the right to avoid making ones data available federal courts have taken both sides of this issue called compelled decryption some courts have held that the Fifth Amendment protects that data and some have ruled that it doesn't the recent trend seems to be away from the Fifth Amendment protecting the data however a military court recently ruled that forcing a member of the military to reveal his smartphone and password violates his Fifth Amendment rights on the other side a Philadelphia law

enforcement officer was recently found in contempt of court for stating that he could not remember his passcode third-party storage services are also subject to subpoena on both the civil and criminal sites the government and Apple for example are often at loggerheads over this particularly with the automatic encryption that comes standard on an iPhone newer iPhones contain the ability to block physical access to the phone by law enforcement by shutting down the phone's port blind subpoenas and digital forensics just to make things a bit more complicated there are independent encryption providers that sell services to encrypt

data and hold the keys specifically in response to a blind subpoena which is a subpoena served on the data storage service without the knowledge of the owner of the data for example law enforcement may subpoena iCloud for a user's data but not notify the user now the data is separately encrypted by this fourth party who holds the keys the fourth party then is in on the conversation of what data gets unencrypted and what data is subject to privilege or objection digital forensics there are times that extraordinary measures may be called for to retrieve data that

is impossible or nearly impossible to read in its current state these occur when data storage devices like hard drives or smartphones have been corrupted or destroyed or the data has been erased or when the data is behind an unavailable password or is encrypted and the key is unavailable in these cases computer forensics experts come to the rescue on the civil side these nights of the data wars can be independent companies with a team of techies who have tools to reconstruct the seemingly lost data on the criminal side they may be agents of the state and

federal law enforcement trained in the retrieval of seemingly irretrievable data these experts are very good at what they do but there are times when data is simply lost forever for instance erase data can usually be found pretty easily because full erasure of a hard drive is at least a two-step process and most people don't engage in the second step while a destroyed hard drive or smartphone may yield no useful data there are cases where the data was backed up without the knowledge of the device's user and thus can be found reconstructing lost data can be

very costly both in terms of time and technology on the civil side the costs of reconstructing this data will be subject to the usual proportionality test of the FRCP Rule 26 and the court may order either party to bear the cost of retrieval or order that it's too costly to do so on the criminal side the state will bear the cost in our next module we'll turn to retrieving data through discovery provided for under the Rules of Civil Procedure