Where ESI is Stored and How it is Retrieved: Module 2 of 5

Summary

This script delves into the complexities of Electronically Stored Information (ESI) in legal discovery, exploring where ESI is stored, from local devices to cloud services, and the challenges of accessing it. It introduces data mapping and the concept of proportionality in discovery requests, crucial for managing costs. The script categorizes data storage into five types, from easily accessible active online data to more complex, encrypted, or corrupted data. It also touches on the ethical considerations for attorneys using cloud storage and the role of third-party storage services in discovery. The importance of chain of custody, metadata, and the impact of encryption on data accessibility are highlighted, with a look ahead to the practical aspects of data retrieval in civil and criminal cases.

Takeaways

• 💾 ESI (Electronically Stored Information) can be stored and retrieved in various forms such as local computers, cell phones, company servers, or cloud storage.
• 🗺️ Data mapping is the process of locating and charting all data and corporate policies regarding that data, which is crucial for e-discovery.
• ☁️ Cloud storage is a form of off-site data storage where the servers housing the data are not located at the same place as the entity that owns the data.
• 💡 The concept of proportionality, introduced to Rule 26 B of the Federal Rules of Civil Procedure, involves a cost-benefit analysis for ESI discovery requests to prevent excessive costs.
• 🔑 Types of data storage are categorized into five tiers based on accessibility and cost, ranging from active online data to erased, fragmented, or corrupted data.
• 📁 Personal data stored on personal devices and business data stored on in-house servers are both subject to e-discovery under FRCP Rule 26 and state discovery rules.
• 🔐 Encryption and password protection are common techniques used to ensure data privacy and security, but they can pose challenges in e-discovery when keys are unavailable.
• 🔎 Email is the predominant form of ESI, often requiring third-party search platforms to adequately respond to e-discovery requests due to lack of native search capabilities.
• 🔍 Databases present challenges in preservation and search for the discovery process, with proportionality and various technical capabilities being considered in discovery requests.
• 🚫 Third-party storage services are subject to subpoenas for data, raising ethical considerations regarding client security and privacy, especially with automatic encryption on devices like iPhones.

Q & A

What is ESI and why is it significant in the context of data storage and retrieval?

ESI stands for Electronically Stored Information. It is significant because it refers to any data stored electronically, which can include emails, documents, databases, and more. ESI is crucial for legal discovery processes, as it often contains evidence relevant to cases.

Who typically serves as the custodian of ESI?

The custodian of ESI can be the party who created the document or any entity responsible for data storage, such as a company, cloud storage host, or even an individual who keeps it on a local device.

What is data mapping and why is it important?

Data mapping is the process of locating and charting all data and the corporate policies regarding that data. It is important for understanding where data is stored and how to access it, which is crucial for compliance with discovery requests.

What does it mean for data to be stored 'on-site' versus 'off-site'?

On-site data storage means the servers housing the data are physically located at the same place as the business or residence of the entity that owns the data. Off-site storage, often referred to as 'the cloud,' means the data is stored remotely, usually by third-party providers.

What is the concept of proportionality in the context of ESI discovery?

Proportionality refers to a cost-benefit analysis applied to a discovery request for ESI. It helps courts determine whether the cost of accessing and retrieving ESI is justified by the potential benefits, such as the value of the information to the case.

How are different types of data storage categorized for proportionality analysis?

Data storage is categorized into five types for proportionality analysis: Type 1 (active online data), Type 2 (near online data), Type 3 (offline storage and archives), Type 4 (disaster recovery files), and Type 5 (erased, fragmented, or corrupted data). Each type has different accessibility and cost implications.

Why is email considered the predominant form of ESI?

Email is considered the predominant form of ESI because it is widely used and often archived for access. It can comprise up to 90% of all ediscovery due to its prevalence in business and personal communication.

What challenges do databases present in the ediscovery process?

Databases can present challenges in ediscovery due to their large volume of documents and the complexity of searching them. The process can be time-consuming and costly, and questions of proportionality often arise regarding the feasibility and cost of searching databases.

What is encryption and how does it affect ediscovery?

Encryption is the process of coding information in a way that it can only be accessed with a specific key. It affects ediscovery because encrypted data may be inaccessible without the key, which can pose challenges in legal discovery if the key is unavailable.

How do third-party storage services factor into ediscovery?

Third-party storage services, such as cloud providers, are subject to subpoenas for data they store. They play a significant role in ediscovery as they may hold ESI that is subject to discovery requests, and they may also be involved in encryption and data privacy considerations.

What role do digital forensics experts play in ediscovery?

Digital forensics experts are crucial in ediscovery when data is corrupted, destroyed, erased, or encrypted with an unavailable key. They use specialized tools and techniques to reconstruct or retrieve data that would otherwise be inaccessible.