IST Discover-E Index of Terms

Data on a computer that can be accessed without restoration. This term is often used to describe information currently displayed on a computer screen. The more technical usage refers to information stored on local storage media or a device that is visible to the operating system and/or application software with which it was created. Active data is accessible to users immediately and without modification or restoration.

A software program such as Word or Excel.  (commonly used in place of “program” or “software”): A program or group of programs designed to enable end-users to manage computer resources and/or utilize end user programs.

Information that is maintained for long-term storage and record keeping purposes, but is not immediately accessible. Archived data can be stored in a number of ways. For example, it can be written onto removable media, like a DVD or backup tape, or maintained on a system hard drive.

Electronic files appended to an e-mail message.  This term most commonly refers to a file attached to an email message. More generally, it refers to a file or record that is attached or associated with another, often for purposes of retention, transfer, processing, review, production and/or routine records management. Multiple attachments can be associated with a single file or record (referred to as the “parent” or “master” record).

The person or office that created or issued an item.

A copy of data for preservation purposes; data is often backed-up on a network file server or backup tapes.  Active electronically stored information (ESI) copied onto a second medium (like a CD, DVD or backup tape) in its exact form, often intended as a source for recovery should the first medium fail. Usually, backup data is stored separately from active data, and differs from archival data (though may be a copy of archival data) in method and structure of its storage.

The process of overwriting backup tapes with new data, typically on a fixed schedule (referred to as a “rotation”). Rotation schedules vary depending on the type and purpose of the backup tape. Practice Note: Once a duty to preserve arises, parties must suspend all routine deletion practices likely to result in the alteration or loss of potentially relevant evidence. This includes backup-tape overwriting, which commonly is overlooked.

Sequential numbering used to track documents, images or production sets (as with productions made in native format), which often includes a suffix or prefix to help identify the producing party, case name or similar information.  Practice Note: You cannot Bates Label a native document Best practice is to include a labelled place-holder.

(pronounced “cash”) A special high-speed storage mechanism that usually is utilized for frequently used data.  Website contents, for example, often reside in cached storage locations on a hard drive.

The process of searching through the unused parts of a disk for files that haven’t been overwritten and recovering those files. Word to the wise: “deleted” does not mean gone--deleting a file usually just unlinks it from your computer’s file system. With the right software, the deleted files can usually be recovered.

Process of documenting and tracking possession, movement, handling and location of evidence. Chain of custody is tracked from the time evidence is obtained, until presentation in court or other submission. A clear chain of custody is important when issues of admissibility and authenticity arise, as it can establish that the evidence was not altered or tampered with in any way.

A very handy agreement which states that if you accidentally give the other side your privileged documents, they have to give them back and can’t use them against you or claim they aren’t privileged anymore. There are no known reasons for not having a clawback agreement, but there are very good reasons to have one in place. A serviceable clawback agreement can be written in one paragraph. 

A sequence of numbers and letters that is essentially unique for each and every file in the world. Comes in several different flavors, including MD5 and SHA1. Extremely useful for finding duplicates, determining if someone has files they shouldn’t have, and identifying evidence.

Cloning is a term generally used when referring to making a copy of the drive, as an example, to put into another machine without having to install everything from scratch. Another reason for cloning is mainly for backup purposes. Typically, cloning programs are not configured properly to get all areas of the drive. There is also a problem with later authentication, meaning there is no way to tell if anything was deleted or added to the clone after the day it was made.

The National Institute of Standards and Technology (NIST) defines cloud computing, in part, as:  “… a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”

Internet-based computing wherein services - such as storage and applications - are delivered through the Internet, as opposed to using local servers or devices.

Process of examining and evaluating documents through the use of predetermined codes, and recording the results.

The reduction in the size of data to save storage space and reduce bandwidth necessary for access and transmission. “Lossless” compression preserves the integrity of the data (e.g., ZIP and RLE), while “lossy” compression does not (e.g., JPEG and MPEG). 

The process of retrieving or collecting electronic data from storage media or devices; an E-Discovery vendor “collects” electronic data from computer hard drives, file servers, CDs, and backup tapes for processing and load to storage media or a database management system.

A corrupted file is one that has been damaged and cannot be read by a computer in part or in whole. Common causes include viruses, hardware or software failures, and degradation due to the passage of time.

When the responding party forces the requesting party to pay for the costs of responding to certain discovery. Often a Solomonic remedy imposed by the Judge when one party is asking for too much but maybe shouldn’t be prevented outright from getting it. Under so-called American rules of discovery, cost shifting is unlikely to be applied to well-drafted and reasonable discovery requests.

Processing a large set of data and removing the junk data so that it’s easier to search and less expensive to host or transfer. It’s best for the parties to agree on the criteria that will be used to cull the data i.e. date range, file types, domains, file sizes etc.

A custodian is a person from whom the data is collected.

Electronic information stored on a computer/Electronically Stored Information or ESI.

Process of parsing data from electronic documents into separate fields, such as “Date Created,” “Date Modified,” “Author,” etc. In a database, this allows for searches across data or by sorting respective fields.

Use of specified parameters to identify specific data.

Method used to capture information relating to how ESI is stored, both virtually and physically. A basic data map will include name and location information, while a more complex data map may include several, if not all, of the following: software and formatting information; description of backup procedures in place; interconnectivity and utilization of each type of ESI within the organization; accessibility, policies and protocols for retention and management; and record custodian information.

Named or defined collection of data.

Refers to a collection of information, organized so that specific data or groups of data can be identified and searched quickly.

To expand or restore compressed data to its original size and format.  Practice Note: most eDiscovery vendors bill on expanded data.

A process that removes multiple copies of the same file from a set of files, leaving you with only one of the copies. This is super helpful when you have to review a large number of files and you don’t want to waste your time going line-by-line through files to see if they are the same. Horizontal or Global deduplication means removing all the duplicates across the board. Vertical or Custodial deduplication means keeping a copy of a duplicate if it belongs to a different custodian.

Refers to live data that has been deleted by a computer system or user activity. “Soft deletion” refers to data marked for deletion that may no longer be accessible to the user (such as the emptying of one’s “recycle bin”), but has not yet been physically removed or overwritten. Soft deleted data may be recoverable. Further, deleted data in general may remain on storage media, in whole or in part, until it is overwritten or “wiped” and, even after being wiped, it may be possible to recover information relating to the deleted data.

The process of removing or erasing data from active files and other data storage structures, although some or all of it may be recoverable with special data recovery tools.

One way of culling data (see above). One takes a huge list of checksums (see above) for known junk files and removes any matching files from the data set. The NIST part derives from the National Institute for Standards and Technology, who, among other things, maintains the list of junk files.

An organizational unit or container used to organize folders and files into a hierarchical or tree-like structure.  Some user interfaces use the term “folder” instead.

General term used to describe the process of identifying, locating, obtaining, reviewing, evaluating, and/or producing information and other evidence for use in the legal process.

Pages or files produced either in hard copy or through a software application, which constitute a logical single communication of information. For example, fax cover letter, faxed letter and attachments. For document review purposes, the cover letter often is referred to as the “parent,” and the letter and attachments as the “child.”

A typical field used in coding, examples include “correspondence,” “memo,” “agreement,” etc.

The process of moving data from another location to one’s own, typically over a network or the Internet.

Duty arising under state and federal law, upon reasonable anticipation of litigation, to preserve documents, electronic records and data, and any other evidence or information potentially relevant to a dispute. The duty also arises in the context of audits, government investigations and similar matters. The scope of the duty and what is required under a specific set of circumstances is determined by considerations of reasonableness and proportionality. Practice Tip: While the duty to preserve unquestionably arises upon the filing of a formal complaint, it also often arises sooner, such as when an investigation takes place or after receipt of a credible complaint or demand letter.

The implementation of litigation analysis and management protocol that provides for an aggressive stance, gathering information as quickly as possible to ensure the company can determine the most favorable way to resolve the case instead of simply reacting to opposing counsel. This process involves making a concerted effort to complete all the major work within the first 90 to 120 days of a lawsuit’s filing.  In order to truly conduct an ECA with a return on investment (or ROI), you need to start the process before you collect your first gigabyte of data. ECA should occur when you are assessing whether to file or defend a suit, or immediately thereafter. Conducting your case’s assessment at this point will ensure that you not only have a defensible approach, but that you minimize eDiscovery costs across the lifecycle of the case, especially down the line when you’re conducting a document/information review.

A process where the parties to litigation exchange electronic evidence. eDiscovery has been the subject of much teeth-gnashing and hair-pulling, with many lawyers and commentators complaining about its cost and difficulty, but eDiscovery is inescapable unless the parties live in caves and do not use computers. If a lawyer wants to prove that certain facts did or did not occur, then eDiscovery is strongly recommended.

The EDRM is not the be-all and end-all of eDiscovery, but it is a good place to start. While every law firm, consultant, and ESI provider claims they follow the EDRM, few actually cover the entire EDRM, which includes:

• Information Management
• Identification
• Preservation
• Collection
• Processing
• Review
• Analysis
• Production
• Presentation

This refers to the process utilized in the management of documents, whether hard copy or electronic. In the case of hard copy documents, it includes those steps necessary to make them available electronically, such as images, archiving, etc.

An electronic or digital picture of a document; the most common image used in E-Discovery is TIFF (Tagged Information File Format)

ESI is used to refer to all information or data found in computers, tablets, mobile phones, servers, the cloud, social media sites, etc. (Basically, it refers to anything stored digitally that may need to be processed, hosted, and reviewed.)

Electronic mail or computer-based mail.

A series of e-mails linked together by e-mail responses or “forwards”.

The process of preserving and storing email.

Metadata embedded with content.  See Metadata.

A procedure that makes the contents of a file or message scrambled and unintelligible to anyone not authorized to read it.

To expand or restore compressed data to its original size and format.  Practice Note: most eDiscovery vendors bill on expanded data.

Because a native file is designed to be electronically usable, it tends to be inherently electronically searchable.  Converting to TIFF removes application metadata.   To restore a measure of electronic searchability, parties extract text from the electronic document and supply it in a file accompanying the TIFF images.  It’s called multi-page extracted text because, although the single-page TIFFs capture an image of each page, the text extraction spans all of the pages in the document.  A recipient runs searches against the extracted text file and then seeks to correlate the hits in the text to the corresponding page image.

A form of production (usually native, or nearly native) wherein the fields that hold discrete bits of information remain in place. For example, an email when converted to a PDF file is no longer fielded because the “to:” and “from:” fields of the email in a PDF document have the same status as any of the other text on the page. In contrast, when email is produced in a native or near-native format, the “to:” and “from:” fields retain their special status, and it is possible to construct searches like ‘from:hook@bidness.com to:crook@bidness.org subject:conspir!’ using a review platform. This can be very effective.

A collection of data or information stored under a specific name, called a filename.

A suffix to the name of a file, separated by a dot. Often an abbreviated version of the name of the program in which the file was created or saved, the suffix indicates the program that may be used to open the file.

The organization or characteristics of a file that allow it to be used with certain software programs.

Refers to a computer attached to a network, of which the main purpose is to provide a centralized location for shared storage of computer files (such as documents and images) that can be accessed by the workstations attached to the same network. File servers are the heart of any server network. They can contain data for other programs or direct access to documents themselves.

The application of scientifically proven methods to retrieve, examine and/or analyze data in a way that can be used as evidence.  Practice Note:  this is the most defensible collection method.

Electronic evidence can be “produced” (i.e., exchanged) in multiple forms. For example, if there is a Word file on your client’s laptop, and you need to produce it to another party, you have several choices: (1) you can copy the file to some sort of transfer media (e.g., a thumb drive) to produce an exact copy; (2) you can convert the file to PDF and produce the PDF file; (3) you can print the file to TIFF (see below) also produce a load file that contains searchable text; or (4) you can literally print the file out on a piece of paper using a printer and deliver a copy of the paper to the other party. There are pros and cons to each form of production. If you are billing hourly, the only known “pro” of option 4 (printing) is that it wastes a lot of time and paper, and often results in motion practice. For reasons that we do not comprehend, some attorneys are flustered by native production and instead choose to have files produced PDF.

The internal structure of a file that defines the way it is stored and the programs in which it can be used.

The act of preparing a storage medium ready for first use.

The protocol for transferring files over a network or the Internet.

When a data file can be searched for specific words and/or numbers.

Searches that use approximate, rather than exact, matches.

Self-contained storage device, generally with a high capacity, that has a read-write mechanism and one or more hard disks.

A hash value (or hash) is an alpha-numeric string that is generated by an algorithm and uniquely identifies original data. It is useful to authenticate data (such as a file) for evidence admissibility in court, for determining duplicate documents and for identifying alterations to documents. Common hashes are MD5 or SHA. An example of a hash value: d41d8cd98f00b204e9800998ecf8427e.

Method of coding that provides quick access to data items capable of being distinguished through use of a key term, like the name of a person. Each data item to be stored is associated with the key term, the hash function is applied to that term, and the resulting hash value may then be used as an index that permits users to select one of several “hash buckets” in a hash table.  The table contains pointers to the original item.

An element in an electronic document (usually appearing as an underlined word or image) that links to another place in the same document or to an entirely different document when clicked.

Refers to an exact replica. Image may refer to a type of document, such as a .tif or .jpeg. To image a hard drive means to make an identical copy. Forensic imaging is a bit for bit copy and can be made at a logical or physical level, meaning a user just copies the C drive or the D drive or the unallocated space (which is   where deleted data resides). The main advantage to forensic imaging is the checksums and verification by digital fingerprint contained in the image format, which show that the image has not been altered in any way since the day it was made. If the image has been altered, the CRC values (checksums) and the digital fingerprint (such as the MD5 hash) will change and not match, and the image will not verify.

Capturing an image, usually from data in its native format, so it can be entered into another computer system for processing and, often, manipulation.

To bring information or data to one environment or application from another.

Records that no longer are routinely referenced but must be retained, usually for audit or reporting purposes.

 In the context of electronic discovery, index refers to database fields used to categorize, organize and identify each document or record.

The entire kit and caboodle relating to a company’s information/data, be it paper documents or ESI – not just document retention policies and document retention, but the true life cycle of information, which includes:

• Hiring of the custodian
• Assignment of data sources – mobile phone, tablet, PC/MAC, server, shares, wikis, etc.
• Maintenance, upgrades, and backups of data sources
• Creation and enforcement of retention policies
• Legal holds/identification
• Preservation
• Collection
• Processing
• Review
• Analysis
• Production
• Presentation
• Archiving/data disposition or reuse

A search – of the text of documents in a database – designed to retrieve documents containing a “keyword;” generally the most basic of a number of searches; depending on the software application’s capabilities, a variety of advanced searches can be performed.

Assume that your client has 1TB of data that could be responsive to discovery requests. Assume that you agree on some keywords with the other party. Assume that those keywords are “hits” for 500,000 documents. Linear review is the process of having a human--usually a lawyer--set eyes on each of the documents before any of them are produced to the other side. On average, human reviewers can review 55 documents per hour, and the average hourly cost for a reviewer is $70 per hour. That means you’ll spend, ahem, more than $600,000 on document review! The process will also take several months, even for a large review team. But the legal system doesn’t have time for this. Discovery is supposed to finish … it can’t drag on and on for years while reviewers strain their eyes and wonder if this is what they went to law school for. In short, linear review is a bad idea, and it’s prohibitively expensive and time-consuming. Alternatives include technology-assisted review and creative use of keyword searches, selective review, and clawback agreements.

A document provided to a custodian when litigation is on the horizon or already happening that instructs him or her how to avoid deleting or corrupting evidence. Sometimes litigation hold letters confuse ordinary people by telling them things like “cease rotating backup tapes.” Ideally, a litigation hold should be readable and comprehensible by its target audience, and compliance with the hold should be monitored. Watch out for company-sponsored paper shredding or hard-drive dumping events!

A special file that you get (or give) with other files that provides additional information about those files, such as the directories they came from, metadata not contained in the files themselves, Bates numbers corresponding to the files, and information about the requests to which the files are supposed to responsive. Even though load files are essentially “flat”--i.e., non-relational databases (like Excel files)--they appear in any number of bizarre proprietary formats. There is no agreed-upon standard for formatting load files, and unless one happens to own the same software that was used to generate the load file, viewing one can be a serious pain in the hindquarters. If you don’t own the software that generated the load file, you may want to ask for a comma-delimited (CSV) file instead, which at least you can open in Excel.

An object on which data is stored. Examples include disks, backup tapes, servers and hard drives.

A meeting (or phone call) at the beginning of a case for lawyers to talk about discovery and try to reach agreement on preliminary matters like forms of production and dates for depositions. Required in federal court. Most often the meet & confer session is “phoned-in” both literally and figuratively, to the detriment of everyone involved. Best if counsel prepare beforehand, talk with their clients about eDiscovery and the evidence that’s likely to be sought, and come with a game plan.

Least helpful definition: “data about data.” More helpful definition: contextual information about computer files that helps explain how/when/where/why they were created. Metadata can also prove that a piece of a evidence “is what it purports to be”--e.g., “even though he denies it ladies and gentlemen, this email is in fact an email written by Mr. X on [insert date] from his home computer.” Metadata comes in two main categories, embedded metadata and system metadata. The handy thing about embedded metadata is that it travels with the file, so that if you copy the file to transfer media and give it to your opponent, it will still be there. In contrast, system metadata does not travel, and is therefore difficult to produce in discovery. Examples of system metadata are: directory paths, last-modified dates, and created dates. System metadata is often produced in load file that accompanies the discovery response.

Duplicating data or a disk in a manner that results in an exact copy. This is often done for backup purposes.