by Rob Jones, Legal Consultant, Kroll Ontrack

With case budgets increasingly under scrutiny, is extra expenditure on electronic discovery tools a solid investment? In Wetton v Ahmed, the Court of Appeal affirmed the First Instance Judge’s method of dealing with the factual issues. In a case with aged facts and in which the contemporaneous written evidence was “far from complete”, His Honour Judge Simon Brown QC sought to “test the [oral] evidence by reference to both the contemporary documentary evidence and its absence.” This case underlines the importance of documentary evidence and its power to corroborate witness testimony; a point which needs little reinforcement. However, gaining access to contemporaneous documentation can be challenging and so here is a reminder of the important things to remember when searching for documentary evidence.

Data is like an iceberg, in that the majority of its mass lies beneath the surface of what is apparently accessible. Paper evidence can usually be obtained easily, as can mailboxes or the contents of a personal or shared file on a network. But if, for example, your case involves any claims of deception, then there is a risk that important evidence could have been deleted. This is when it may be critical to don the thermals and dive beneath the surface, to examine more obscure parts of the body of data. Suddenly, information sent by texts or stored on backup tapes could be critical.

While an iceberg may be seen easily from above the water, there are occasions when it may be difficult to spot; the same is true of data. Most cases involving electronic searches for evidence begin with the same navigational problem:  how to find key documents without necessarily knowing what they look like or where they reside. It is fairly common to begin a search by speaking with someone who understands the peaks and ridges of the IT estate, but this can be a complex and daunting task. Misunderstandings can lead to mistakes, so it is important to ask the right questions and be unafraid to ask for help as and when it is needed.

The power of hindsight is particularly useful in e-disclosure situations. Though it is now 3 years old, we should not forget what the Zimmers case taught us: that electronically stored information (ESI) can be found in the unlikeliest of situations. In this case, a computer that held case-turning evidence was thought by the Claimant’s legal representation to be unusable. To the surprise of no-one but the most hardened technophobes, the data was accessible. Its discovery brought the case to a rapid conclusion and nearly brought about a wasted costs order against the claimants solicitor. The lesson here is to recognise early on the times when expert help is needed.

Individual items of data are often replicated far and wide. On their travels through the internet, the billions of emails that are sent and received each day have many ‘resting points’. The most significant of these in a business investigation are likely to be the email servers or vault systems – if used – through which they pass. If emails are stored centrally, then it is also likely that they will be backed up routinely. A monthly back up policy significantly increases the chances that the same emails are captured and held at least a dozen times in a year. If emails are deleted, then it is likely that they may be found on the hard drive of the computer that was used to delete them.

When conducting a factual investigation, these ‘resting points’ are the three most common sources to turn to. However backup tapes can be voluminous and badly organised – making it expensive to restore and extract data from them. At the very least, backup tapes should be removed from circulation, so that they cannot be overwritten. If there is a need to go through them, sampling may be an alternative to full catalogue and restoration. This works on the premise that the oldest available information will reside on the earliest set of tapes and that these can be compared to more recent or intermediate ‘snapshots’.

The problem of (and solution to) volume
When data is captured, be prepared to handle it in enormous quantities and have a strategy for reducing it. Practice Direction 31B encourages the use of technology and good working practices such as data sampling, de-duplication and using a staged approach to disclosure for controlling volumes and costs. Some examples of the filtering options that could be utilised to help limit the cost and burden of e-disclosure are:

•    Isolate documents from a  certain key date range and exclude those that fall outside of this range
•    Focus on particular key custodians  or on a particular type or category of documents
•    The use  of agreed keywords
•    Identify duplicate documents

Keyword searching in particular has had something of a bad press, but warrants better explanation. The problem with keyword searching, as generally perceived, is that it has no middle ground. A long list of keywords has the tendency to produce too much information, whereas a short keyword list tends to produce too little. For this reason it has often been described as a blunt instrument.

Conversely, the skillful application of powerful search technology can cut through huge swathes of data very quickly, which may lead us to conclude that we have simply lost the sharpening stone in many situations. Successful keyword searches are normally the product of careful thought and testing on samples of live data, rather than being based solely on interviews. Of course, search terms are not fool-proof, however by developing Boolean searches through iteration, the results can be dramatically improved.

Testing keywords in this way can seem like an unappealing and endless tunnel, from which there is no escape. But rather, the approach should be to settle quickly on sensible terms by reference to the documents. In other words; do not over-revise your keywords. If you are broadly satisfied with the results, plan to modify the searches if new information comes to light during the course of the review. Take comfort in knowing that supplementary searches can be performed as part of an ongoing sweep up exercise. Be brave enough to move on and alert enough to know when you need to go back. Of course, intelligent or predictive review technology is quickly catching on because it promises to alleviate the burden of time and energy that is required to run searches.

Search management is project management
Managing a search is managing a project. There are likely to be many stakeholders involved in a search exercise, who each in their own way, will either help you or block you. Therefore to gain the appropriate backing from senior people and to allow flexibility for unforeseen events it is  necessary to formulate a robust structure to your search. While it is possible – and in some cases, necessary – to begin a search two weeks before a disclosure deadline, it is not generally a sensible thing to do.

There are many aspects to the project – beyond the parameters of the search – that have to be managed.. Budgets are increasingly one of the main aspects that have to be managed. This means that before a project can even begin ,budgets need to be predicted accurately and then sold to financial decision makers in the correct manner.. ESI searching, its tools and costs are not concepts with which many people are familiar, though many have their own views as to how they might be used. When confronted by an additional cost, with no appreciation for how the technology can save money, it is not surprising that in many cases the final decision is not necessarily the most cost-effective.

And what about the actual review? Should you outsource, insource, or use intelligent review technology? Whatever method you choose to analyse the documents, you must follow a process in order to achieve defensibility. That process does not need to be overly formal (especially in those cases where the review is managed by one or two people), but the more complex the task, the greater the need for a well documented and auditable process. In cases where budget is a concern, the old adage “you have to speculate to accumulate” often rings true. Well managed application of intelligent review technology can dramatically decrease the man-hours required in a case, and show a solid ROI that outweighs the up-front cost.