Retention Policy Roundtable

This innovative survey may answer a lot of questions, and be very useful!

You can see the retention policies of various organizations here. If you add your own experience, you get a summary of the findings.

 Martin.

New Position

Hello all,

I must apologise. For quite some time I have not posted much of use on this blog. However, some of the articles still prove to be popular. I am currently starting my new job at Navigant Consulting in London, and hope to be able to use this blog more regularly in future. Hope you still find the articles useful in the mean time.

 Kind regards,

 Martin Nikel.

p.s. please remember that the articles on this blog are my own musings and should not be construed as professional opinion in any way.

Excel “Last Save Time” Metadata missing

We noticed with some Excel documents of an older version, that this property does not exist (i.e. 97 and earlier versions). Just a note to self…!

LegalTech NYC 2007

I haven’t posted here in quite a while, as its been very busy here!

I thought I’d just say a little about my first visit to LegalTech NYC, at the beginning of February.

 I had heard a lot about LegalTech from many people, most of them noting the ’social’ aspects of the event. Infact before I even got there, I had already had my entire time booked out with meals, cocktail parties and other social events.

The conference itself was well laid out, but I did find it a little confusing at first. However, I will be attending next year and I am sure I will see the same faces again!

SWF Flash Movie Files in Discovery

Flash movies pop up every now and again in e-discovery.

Flash movies are more than just movies. They are interactive. Sometimes they can be very complex software applications and can be created in numerous ways.

For discovery, these dynamic files can prove a problem when it comes to disclosure, do you disclose natively? And if you don’t want to, what other options are there?

The SWF movie format, much like any other computer application, can be ‘decompiled’, that is, broken down into the constituant parts that were used to build it. This can mean that sensitive data is passed on if disclosed natively. This might include hidden objects and text, programming code used to create the movie, and data about other embedded objects.

If these sorts of things are sensitive to your case, or even if you’d just like to be thorough, you shoud ‘decompile’ your movie to see whats there. Try something like http://www.swf-kit.com/swftofla-decompiler.html.

A program like this can also be used to convert the flash movie into other formats, that can’t be decompiled, such as AVI, MP3 and FLA. However, these conversions can be limited and remove some of the functionality of the flash movie, thereby excluding some of the content and purpose of the file (i.e. interactive parts of the movie). However, this may be the format that is best suited for disclosure of the content of the file should you wish to withold any of the potentially sensitive information held within.

Another point to consider, if you are going to disclose natively, is that flash movies have some (albeit limited) metadata held within. Newer versions can contain Author, Title, Description and some other basic fields, that can be seen through the properties of the file. You may wish to remove this metadata, but I am unsure how to do this without ‘recompiling the movie’ using Macromedia development tools.

Anyway, this is just a pointer. There is a lot more to this subject, but hopefully the above helps.

Regards

Martin.

DTSearch on multiple computers

With large data sets, it is often necessary to allow the index to be accessed by multiple workstations.

 However, due to the nature of a large data set, it may be made up of many indexes, generally stored in the same location as the data. Registering these indexes can be a chore if there are more than a couple of machines.

If the index is made in Forix, the forensic version of DTSearch, each set of indexes is set up with a library (.lib) file, which contains the names and locations of each portion of the indexes. This helps because you only have to add these library files to DTSearch to register the entire forix index. by mapping the same drive letter to all the machines you need to use, you can use the same library file on each computer.

To speed this process further if you have multiple library files/indexes, you can copy the registry settings in HKEY_CURRENT_USER for DTSearch and register these on each machine. This will place the same references to the library files on each machine. Voila! You have multiple machines working from the same data set.

Let me know if you need any help for this. Martin.Nikel@gmail.com

DTSearch MDB files

Following on from the earlier articles about DTSearch, I was also provided with the follwoing solution to the MDB multiple records problem:

> “Deactivate the ODBC file parser for MS Access if possible.  dtSearch
> uses ODBC to index each row of an Access database (*.mdb files) as a
> separate document.  This use of ODBC to traverse Access databases can
> substantially slow indexing.  In applications such as forensic
> applications, indexing MDB files using dtSearch’s Unicode binary
> filtering algorithm is usually sufficient and is much faster.
>
> dtSearch Desktop:  to disable the ODBC file parser, either:  (a) move
> or delete dtv_odbc.dll from the dtSearch bin\viewers folder; or (b)
> use Options > Preferences > File Types to specify the Unicode
> filtering format for *.mdb files.
> dtSearch developer API: To disable the ODBC file parser, move or
> delete dtv_odbc.dll from the dtSearch bin\viewers folder.”
>

dtSearch service

IQPC Conference

IPCQ are running a conference on “The Advanced Guide to Conducting Regulatory and Internal Investigations” on November 27 - 28, 2006 at the Swissôtel The Howard, London, UK (see http://www.iqpc.co.uk/cgi-bin/templates/singlecell.html?topic=235&event=11210) The conference agenda looks very interesting and I hope by attending I will learn a few things regarding preparation for regulatory investigations. Topics to be covered include:

• The latest regulatory guidelines, enforcement priorities and penalties
• Preparing and planning for an investigation
• Disclosure management: communicating with the shareholders, regulators and auditors
• How to conduct investigations and when to waive or preserve privilege
• Optimising internal controls and financial reporting to minimise risk
• Conducting multi-jurisdictional investigations
• Effectively dealing with the media before, during and after an investigation

Hope to see you there.

Regards, Martin.

Opticon Viewer image problem

We had a problem reported that some colour Tiff images that we produced were not viewable in Opticon.

After a lot of diagnostics on the images, we found a few JPG Colour Tiff images that had been produced with Motorola (big endian) byte order and not Intel (Little endian) byte order.

 It appears that a lot of viewers can cope with this type of Tiff (including irfanview) but Opticon version 3 does not appear to support it giving the error “Unable to open the following image (11011): [path]” Where the path is correct.

Anyhow, we reproduced the tiffs with intel encoding, and they worked just fine.

Martin.

DTSearch and Long File names

We have built some bespoke apps on DTSearch, and its a smooth engine, but there are a couple of bugbears that we have had to work around.

These are not DTSearch problems, but just data problems.

 1. Long filenames.  We often move the data from a disc to a SAN, under some extra subfolders. This pushes the path length above the maximum. Windows then struggles to recognise these files and DTSearch can’t see them either. Therefore we move them to a higher level. I wondered if there is any application out there that can access and index files that are longer than the maximum length. I know there is a Linux version of DTSearch… does this help?

 2. Data files.
DTSearch indexes the records in MDBs, CSVs etc as individual documents. We now how to stop this, but I wondered what the purpose of this functionality was?

3. Zip files.

On a large data set, there is nothing worse than having to unzip everything first. However, it would be nice if there was a feature to stop DTSearch indexing the files within a zip file as separate entities. Does anyone know how to do this?

4. MSG Files

When extracting resulting files from DT Search, with HTML MSGs it has the annoying habit of exporting as a folder with constituant parts. I don’t know the solution for this problem. We want it to extract the original file! Help!

Martin.

Trial Bundles

Hi all,

I wondered if any of you out there have any opinion on the best way to create a trial bundle (software wise). If we have a lot of multi page tiffs, and counsel are making changes to the bundle, and taking one page of a whole document and including that, then chopping and changing the order of the documents, and using the documents or part of a document to form other bundles, such at witness bundles, is there any software that can manage this process (including moving individual pages of documents around)?

 Any advice on software/approaches most appreciated.

 Martin.

Taxes Management Act Possession or Power

During my research on document disclosure in the UK, I cam across a great article by DLA Piper on the duty to disclose documents under the Taxes Management act. It explains in easy to understand terms, the duty to disclose document in your ‘power’ or ‘possession’.

Please see http://www.legal500.co.uk/devs/uk/cc/ukcc_013.htm .  Similar concepts apply in the CPR rules Part 31.8:

31.8

(1) A party’s duty to disclose documents is limited to documents which are or have been in his control. (2) For this purpose a party has or has had a document in his control if – (a) it is or was in his physical possession; (b) he has or has had a right to possession of it; or (c) he has or has had a right to inspect or take copies of it.

If you’d like further information, just send me an e

Make sure you are at home!

I don’t know what happened to this post. i think it just disappeared into thin air!

This is what it was supposed to say:

During the course of discovery of electronic evidence, typically collection of the data is entrusted to a few key people in conjunction with consultants and attorneys.

Often we find though, that the key IT people, especially those on the ground performing the collection of data, are entrusted to provide the data requested. Trouble is, they are not always aware of the importance of the task entrusted to them, and often a key contact ends up on two weeks holiday or working on bringing the email servers back up, instead of focussing on the tight deadlines of delievery of data.

If you are running through an exercise to provide data, the key people working on finding and extracting that data should be on call during the entire data collection phase, avoiding anyone who i likely to go on holiday. There is nothing worse than the task being passed from person to person with no real understanding of the issues at hand and theexpected dates for delivery of the data.

My recommendation is that the e-discovery consultant be responsible for the collection of data along with one key person that will be available during the discovery phase and responsible for assisting the consultant in finding the relevant information.

Does anyone have any experience of data collection going wrong due to people taking holidays? I know I have!

Martin.

Microsoft to join e-discovery bandwagon?

Just in case any of you had not seen this, it appears that Exchange has new ‘E-discovery’ features attached see : http://www.microsoft.com/events/EventDetails.aspx?CMTYSvcSource=MSCOMMedia&Params=%7eCMTYDataSvcParams%5e%7earg+Name%3d%22ID%22+Value%3d%221032304395%22%2f%5e%7earg+Name%3d%22ProviderID%22+Value%3d%22A6B43178-497C-4225-BA42-DF595171F04C%22%2f%5e%7earg+Name%3d%22lang%22+Value%3d%22en%22%2f%5e%7earg+Name%3d%22cr%22+Value%3d%22US%22%2f%5e%7esParams%5e%7e%2fsParams%5e%7e%2fCMTYDataSvcParams%5e

Foresically sound or not?

C64’sForensic examination?!

For what reason? What on earth would be stored on there? A couple of saved games and maybe some code half complete from “Input” magazine!? (remember that..).

Anyhow, my question about the below is, there are methods of connecting up parallel ports and floppy drives to transfer data from a C64, however, someone said to me that this was not ‘forensically sound’. What would one do in the situation whereby there is potentially information held within a system, but the only way you could get it was by using a non-forensically sound method. Surely if it was all audited and logged by a third party, this would be enough for any court to accept it as evidence? What would you do in this situation? Answers on a postcard, (or by comment or email!)Martin.

Taken from Guardian Online:

 ”the kidnapping of Natascha Kampusch has been complicated by the discovery of an obsolete computer in the house where she was held, Austrian police said today. Officers have been surprised to find that the kidnapper, Wolfgang Priklopil, a communications technician, appeared to have relied exclusively on a Commodore 64. The beige-coloured machine was popular in the 1980s but is now considered an antique, though some electronic dance acts still use it and it has a cult following among some fans of retro computers. It was hoped that the computer might contain information which might shed more light on the decision of Priklopil, 44, to snatch Ms Kampusch, when she was aged 10, in March 1998. However, Major General Gerhard Lang of the Federal Criminal Investigations Bureau, told reporters the computer would complicate investigators’ efforts to transfer files for closer examination. There are emulators available which can make a modern PC capable of running Commodore 64 programmes but Maj Gen Lang said it would be difficult to transmit the data from Priklopil’s machine to a modern computer “without loss”.

from  http://www.guardian.co.uk/austria/article/0,,1865500,00.html

e-disclosure precedent….. UK (???!)

Hi there all,

I know there are quite a few lawyers subscribed to my bLAWg and I have heard from many of you already. I wondered if any of you have any pointers to case precedents whereby claims have been thrown out, sanctions have been taken, or even individuals held in contempt of court due to the faliure of their e-discovery/e-disclosure being carried out properly? I have done a lot of research and can’t find much easily. I know the US has a lot of this type of information, but in the UK I can’t find much in depth regarding this area.

Any help much appreciated!

 Regards,

 Martin. Martin.Nikel@gmail.com

useful tool - the blawg

One thing I have noticed since starting the bLAWg is how everyone seems to be only too happy to help others out. If there are mistakes in my posts, people have been giving feedback. If there is something they want to discuss, they email me. It opens me up to a world of new knowledge by enabling discussion on products, techie items, processes, systems, events etc. So thanks to everyone who has been involved and shown an interest!

Martin.

Attenex

I get great support from the states and never heard any serious complaints from our users. The Technical guys at Attenex are very quick to respond and are always open to new ideas (e.g. Combining Tiff and OCR to generate concept searching etc).

They are very open to discussing their techniques for deduping and near deduping. Teams that have used it have praised how quick it is to learn and easy to use. It certainly is easy to demonstrate to people. We have found it has helped on our Lotus Notes issues and the back-end database structure is very easy to understand, as it is structured very well. We have used the system a lot, and its very quick when set up correctly over even a slow internet connection. It’s going to save an awful lot of people and awful lot of time!

Martin.

Lotus Notes Search Date Range

Lotus Notes has a great indexing tool, that can even index attachments. When you need to perform a quick search, you can, and the results are very accurate. However, when it comes to searching for e-mail between sent or received between certain dates.

The Notes interface provides a ‘Date’ button to construct a date search. however, this provides the ability to search for only documents created or modified between certain dates. The created and modified dates of a notes email is similar in effect to searching using file modified and created dates. The dates can be changed by many processes, including a user simply changing a draft email, or by backup or archive tools that move the email or document around. Therefore this cannot be a reliable way to search for a date range.

The correct method to use would be to utilise the ‘Field’ button, to select the standard Notes fields that relate to ’sent’ or ‘received’ dates. There are more than one or two of these fields.

the correct fields to use will depend on the way your Dominio and Notes are configured. Typically though, the relevant fields are PostedDate (similar to Sent Date), deliveredDate (similar to received date) and ForwardedDate. This, combined with created and modified dates, should allow a search that catches all of those emails relevant to your date range. Let me know if you have any questions!

Martin. Martin.Nikel@gmail.com

Lotus Notes Links

Does anyone have any information on the way in which Lotus Notes links to external references? We believe that the URLs in “DockLinks” are generated automatically and can change according to the movement of the email from, say, one NSF to another. Thats why in two NSF files, you may have exactly the same email, but the “DocLink” reference is created dynamically for each email, so differs between each email. Any information anyone has on this point, or anyone who wants to correct this opinion, please do send me an e-mail.

Thanks,

Martin.

Discover-E again

Just had the presentation from Rich Radford et al, and this product looks slick! We’ll check it out with some of the guys that run it, but we are very impressed so far. hoever, as with all these things, you really have to look at what you’ve got and what you need and test the products thoroughly! Needless to say we have had some very good recommendations though! Thanks Rich! http://www.discover-e-legal.com

Martin.

forensics and SQL server

Ok, so what do you do when faced with an entire live SQL system to search or image? What do you suggest when it comes to this type of enquiry? how can you do this without taking the server out of action!? Any information would be most welcome.

Discover-E

I would be interested to hear anyones feed back on this product. We are about to get a demonstration and wondered if anyone has experience of the company and the support it offers. Also, does anyone have the product?

 Martin.

British Computer Society

The BCS has a great website with some good articles in security, compliance, forensics and law. http://www.bcs.org/server.php?show=nav.8256 Check out the security, Forensics and Compliance sections of the website. They are a very progressive organisation and seem to be keeping more up to date these days.

Get revisions of Word Docs

On the lit support group in Yahoo, a question was posed as to how to get a list of all word documents that had track changes turned on.

Here is my solution. Do what you will with it. I nor my company accept any liabltiy for the results of excecuting this code. If I were you I’d back up your files first… Place this code into a new Word Document VBA Module. Its not pretty, but its the basics to work from.

Sub Revisions()

Dim fso As Scripting.FileSystemObject
Dim app As Word.Application
Dim mydoc As Word.Document
Dim fsoFolder As Folder
Dim folderStr As String
Dim file As file

Set fso = CreateObject(”Scripting.FilesystemObject”)

folderStr = InputBox(”Enter folder path”, “Enter Folder name”)

Set app = CreateObject(”Word.Application”)

Set fsoFolder = fso.GetFolder(folderStr)

For Each file In fsoFolder.Files

If Right(file.Name, 3) = “doc” Then

    Set mydoc = app.Documents.Open(file.Path)

    If mydoc.Revisions.Count > 0 Then

        Debug.Print mydoc.Name & ” ” & mydoc.Revisions.Count

    End If

End If

Next

End Sub

You can write out the Debug.Print file to a Text Stream Object. It works I think!

Martin.

http://ediscovery.wordpress.com

bLAWgs I know of

Links to blogs I was given via LitSupport Group on Yahoo. Some very good examples there. I can but only aspire to emulate!

http://www.estrinlegaled.typepad.com/
http://informeddecisionmaking.blogspot.com/
http://www.infogovernance.blogspot.com/
http://www.discoveryresources.blogspot.com/
http://arkfeld.blogs.com/ede/
http://www.ediscoverylaw.com/
http://informeddecisionmaking.blogspot.com/
http://www.fuzdata.com

And a particularly good forum: www.accesslitigation.com/forum.

Martin.

Print outlook in date order

Something of a secret up until now.  Faced with the problem of printing thousands of emails sorted in Chron order from outlook 2000, sorted by date. When we printed, the emails would come out in a random order all together.

I battled for a while to find the answer. Simply go to tools options, the Mail Format and set the defult to ‘Plain Text’ for outgoing mail… and hey presto, it prints in order…..  Obvious really… (!?!?!). Anyone need any help with this one, feel free to mail Martin.Nikel@gmail.com

EDRM

Our boss keeps hyping about this. I have been studying closely and it really is good. It’s about time someone brought some structure to the jungle of Litigation Support and e-disclosure. Now if only more UK vendors and law firms would take note. LiST is I guess working towards this, and their website is a great reference also

http://edrm.net/index.php/Main_Page

http://www.listgroup.org/

Legalworks Second Annual e-Disclosure Forum

Something in London…!

The disclosure of electronic information, records retention practices and the new Practice Direction to Part 31 of the CPR continue to present struggles to practitioners and litigation support managers in the United Kingdom.The Practice Direction to Part 31 of the Civil Procedure Rules (CPR) now specifies certain factors which the Court should take into account in determining whether a search for electronic documents is reasonable and proportionate. What is meant by “electronic documents?” What are your new obligations with respect to electronic data? Are you prepared?

West Legalworks, the pioneer in the education of professionals in the United States on eDisclosure, electronic discovery and records retention practices, presents this second annual eDisclosure Forum. This comprehensive one-day conference is your chance to hear the opinions of some the leading figures in eDisclosure and records retention from both sides of the Atlantic who will analyse and offer solutions to the day to day issues faced by solicitors, barristers, litigation support managers, paralegals and their clients in England and Wales.The programme will focus on the state of the industry in the UK and examine the current and emerging trends in eDisclosure and records management practices. Bring your most pressing questions and challenging problems. The distinguished panel of experts will answer your questions during the sessions as well as during the networking luncheon and reception.Achieve all this in one day Hear from the Honourable Master Whitaker and the Honourable James C. Francis, IV of the United States District Court for the Southern District of New York on proportionality and costs. Learn from the experience of leading eDisclosure experts on how to address such issues as minimising escalating costs of electronic document review, disclosure of metadata, format of disclosure and whether a communication gaps exists between lawyers and technology. Tips from corporate counsel on establishing effective records retention policies and managing electronic evidence in global corporations. An in depth examination of the impact of the Practice Direction under Part 31 of the CPR on eDisclosure and records retention practices… and how to make both more manageable and less expensive.

Click here: http://guest.cvent.com/EVENTS/Info/Summary.aspx?e=f70d9941-4071-40ea-a2b0-074ba94d34ef