Ccl legal news issue 3 by CCL Group

CONSULTING

DIGITAL FORENSICS

E-DISCLOSURE

LEGAL NEWS Issue 3

www.cclgroupltd.com

HOW TO SURVIVE IN THE serviCes POST-JACKSON WORLD...

IN THIS ED ITION...

gy – developing the strategies that ensure

> How to su rvive postJackson > Thought s of the month > Predictive coding > The ben efits of qualit y standards > The ESI q uestionnaire > Low cost e-disclosure ? > About C CL > CPD Cour se

vely supports business objectives.

Jackson Reforms: now that the 1st April deadline has passed, how are you going to survive ess case The – understanding the lifetime costs, in the post-Jackson world? Disclosure is one of the single largest drivers of costs in litigation, and wider implications of a planned IT project, and with the amount of electronic data increasing, as well as the growing array of devices that e our clients make the right decision for such to data is stored on, accurately estimating and carefully controlling the cost of electronic iness. disclosure is going to continue to pose challenges for all litigators.

tion and selection – bringing our unrivalled The practical aspects as well as the strategic implications of electronic disclosure are directly ge of the market to help clients select the right affected by the Jackson Reforms, with the aim being to limit disclosure to what is proportionate. m for their Sobusiness. how are litigators meant to ensure that disclosure costs are proportionate, properly planned and predicted, mostinterests appropriate approach for disclosure is adopted? negotiation - ensuringand thatthat our the clients’

ected at all times and that suppliers deliver on their

How to survive in the post-Jackson world – a bestto reduce practice ment methodology the risk ofworkfl IT projects ow of e-disclosure in all cases

, with well-defined terms that suit business needs.

management – using our proven project

ure they are completed on time, to budget and

ectives.Regardless of quantum and whether or not your case is caught under the new costs budgets rules, there is a separate requirement to estimate and file e-disclosure costs for all multi-track cases.

1 2 3

> When litigation is contemplated: Lawyers are under an obligation to inform their clients of the duty to preserve (this includes preventing deliberate deletion of potential documents) > Pre-issue stage: Right at the start of a case, it is good practice to get an understanding of your client’s data landscape: - what data is stored where - who the potential custodians are - what timeframes are relevant

> Issue stage: At this stage, you must think about using Form N264 under Practice Direction 31B (the ESI questionnaire). Using the information gathered during the pre-action protocol stage, you now need to consider what you need to do to ensure a reasonable search of disclosable documents, keeping in mind that this must bear a relation to the monetary value of the case. This means you need to consider the ease of accessing and collecting the data, as well as the cost. This information should be obtained through discussions with your client’s own IT department and external e-disclosure partner.

> Not less than 14 days before the first Case Management Conference (CMC): This is where all our prior preparation comes into its own. You need to file a report that briefly summarises what electronic documents exist, where they are located and how they are stored. It must also

contain an estimate of a broad range of costs (eg. for different scenarios) based upon standard disclosure, and must state which of the disclosure directions in Form N263 (the disclosure option form under Rule 31.5A) are being sought.

power to make any order for disclosure. The judge can either approve your strategy, or if you have not been able to agree on a strategy, then the judge will look at your documents and decide on a disclosure strategy for you.

With Form N263 there are two aspects to consider:

Even when both parties agree on a disclosure strategy, the judge can still overrule this and decide on an alternative strategy. The judge also retains the power to:

1. 2.

Which option for disclosure is most appropriate from the six in the menu option of 31.5A Whether disclosure should take place in stages (staged disclosure)

> Not less than 14 days before the first CMC: Form N264 under PD31B (the ESI questionnaire) also needs to be completed and exchanged at the same time as the above. In our opinion, best practice dictates that you should have already started filling this in much earlier in the case, which will make completion of the questionnaire at this point more straightforward.

> Not less than 7 days before the first CMC: Both parties must either meet face to face, or discuss over the telephone, to try and agree a disclosure strategy. If both parties cannot agree on a strategy, then at the very least you will need to discuss what you think is the most appropriate and reasonable disclosure strategy for the case. Remember: it is all about being reasonable and proportionate. In practice, you will find it more useful to do this as soon as possible.

> First CMC: This is where you are required to justify the disclosure strategy that both parties have agreed upon. However, the court retains the

- decide whether disclosure will be completed in stages or straightaway - dictate what keyword and conceptual searches both parties should undertake - specify in what format the disclosable documents should be produced, and - decide what should be done with documents that did exist, but no longer exist (deleted documents) A final point to remember is that, even if you have completed Form N264 (the ESI questionnaire), and exchanged it, the judge can request you to complete it again if he is not fully satisfied. The main point to take away from this is that the earlier you engage in the disclosure process, the more predictability on costs you are likely to have, as well as a greater understanding of the tools and techniques that are going to be most appropriate, and most proportionate, for your case. As you know, cases worth £2 million or less are also subject to the new costs budgeting regime. For these, you will have to complete Form H (the costs budgeting form), along with the standard disclosure documents mentioned above. For a full overview of the practical considerations and best practice tips for cases worth £2 million or less, please check out the blog at: www.cclgroupltd.com/EDblog

STUART WHITE, Digital Forensic & Investigations Team Manager Stuart is one of CCL’s Digital Forensic & Investigations Team Managers with over seven years’ experience in conducting digital data investigations. To-date he has completed the computer analysis for over five hundred cases and given expert evidence many times, including at the Central Criminal Court. Stuart also has over 12 years of experience in the operation, architecture and development of computer systems; this includes many different operating platforms and equipment. Prior to joining CCL, Stuart studied at the University of Aberystwyth, where he graduated with a Masters degree in Physics with Planetary and Space Physics. His electronic investigation experience, training and scientific background provides him with the analytical skills and questioning mind that is needed in the ever changing world of digital data investigations and e-disclosure exercises.

Stuart’s thoughts for the month It is a very exciting time here at CCL, as we integrate traditional digital forensics with larger scale e-disclosure projects. One of the great benefits of taking a digital forensics approach to e-disclosure projects is the ability to search for and extract deleted data in order to allow that data to be viewed using an e-disclosure review platform. The deleted space, for me, is where all the most interesting and key data is stored. We should not forget that it is all too easy for a user to delete incriminating files very quickly at the touch of a button. We are now seeing the benefits of our ISO17025 accreditation across all areas of the business. The accreditation has taken an incredible amount of work and has really fortified our procedures and documentation. This has ultimately had a strengthening effect on all aspects of our work, and we are able to give our clients absolute confidence in the investigations we conduct on their behalf. This has become more important over the last few years, as both the courts and individuals become more computer-savvy and have a greater understanding of digital data investigations.

STEPHANIE KEYES, Account Manager Stephanie is an Account Manager at CCL, and has been with the organisation for five years, starting in the IT consultancy division of the business, providing strategic services to corporate clients. As a result, Stephanie has developed a consultative, collaborative approach to long-term business relationships. She is responsible for developing and managing CCL’s relationships with law firms involved in litigation, as well as corporate clients. Stephanie’s key priorities are to help clients understand and identify their electronic disclosure and digital forensic requirements, and scope their individual requirements in order to gain an in-depth understanding of current issues and future objectives.

Stephanie’s thoughts for the month Over the last few months, I have spoken to many firms who share the same frustrations with both e-disclosure and e-disclosure providers; the lack of consistency in quality amongst providers and spiralling costs being the ones that stand out. It is clear that being able to demonstrate standardised and stringent processes, and a commitment to quality, along with the ability to provide support and education on the obligations facing law firms as a result of the Jackson Reforms, are essential to firms when selecting an e-disclosure partner. There is an increasing number of providers in the market, making key differentiators even more important, and from my experience, the things that matter most to law firms aside from a competitive price are consistent quality, early visibility on costs and support in order to survive under the reforms. In terms of where the market is moving to, the focus is very much on conceptual and transparent searching, and predictive coding. Now that the Jackson Reforms are in place, firms need to look for more efficient and, ultimately, more proportionate ways to process cases with high volumes of ESI. Alternatives to traditional keyword searches provide this by reducing both risk and cost. The important factor then is ensuring that this is a transparent process which answers the question of why certain methods have been used in the way they have, to ensure defensibility. With the advancements in predictive coding technology, I see this becoming a standard option as keyword searches are no longer seen as the only way to search documents.

PREDICTIVE CODING

by Rob Savage

Predictive coding has been widely dubbed a ‘game changer’ and the ‘technology to watch’ for the last few years but in practice is yet to be fully utilised. I have seen cases of this being used in a triage or proactive context but rarely in anger. Predictive coding has the potential to reduce the cost of review (and some may argue improve accuracy too) if used on a sufficiently large case. With greater emphasis on cost and proportionality, this could be an increasingly attractive option. Much has been written about the benefits of using predictive coding but little about the practical considerations of its implementation. Personally I see there being three core requirements for an accurate and reliable system: 1 Robust, tested and defensible software 2 Statistically sound implementation strategy 3 Accurate and consistent training Each is vital to the success of the system, and an absence of any one of the three will result in a system performing badly and reporting low accuracy, or worse, performing badly but reporting high accuracy, leading to misrepresentations further down the line.

KEY COMPONENTS IN A PREDICTIVE CODING SYSTEM: •

Data Set – All documents that require coding

•

Control Set – A subset of the Data Set that is manually coded by a reviewer. This set is not used for training, but to check the performance of the system after training

•

Training Set – A subset of the Data Set that is separate from the Control Set. This set is manually coded by a reviewer and is used to teach the system how to code the remaining documents in the Data Set

The algorithms used to predict the relevance of documents are complex. They build up a ‘profile’ of what a responsive document looks like by using the manually coded training set. It will use not only the content of the documents but also metadata such as dates, times and authors. The fact that these algorithms are so complex and use multiple factors to predict, means that it is hard to independently verify their validity. It is therefore worthwhile using software packages from vendors who have published details of their algorithms. Implementation is not merely concerned with how the software and data is deployed but also the statistical validity of the selection of the key components of the system (see box). For example, it is vital that the control set is of sufficient size in order to produce reliable estimates of the accuracy of the system. The ideal size of the control set is dictated by the size of the data set and the ‘yield’, which is an estimate of the number of responsive documents that exist within the data set as a whole. The latest software packages will guide a user through implementation, for example by automatically selecting control and training sets, and integrating algorithms to estimate the accuracy of the system after training. This is a doubleedged sword. While it will ensure that the system is correctly set up to maximise performance, it does however tempt a user into using the system with no real appreciation of how it works, which can lead to a potentially embarrassing situation if questions are ever raised on the appropriateness of its implementation. In the field of computer science predictive coding is what is known as a ‘Supervised Learning Algorithm’ meaning the system knows nothing about the world (i.e what is and is not responsive) until someone, the reviewer, teaches it. Inaccurate or inconsistent training of the system will lead to inaccurate and inconsistent predictions. A tagging error made in linear review will result in one document being incorrectly classified; a tagging error made when training a predictive system could lead to multiple documents being incorrectly classified further down the line. For more information call Rob or Umar on 01789 261200 or email edisclosure@cclgroupltd.com

CASE STUDY Mobile device with advanced passcode lock THE CASE: CCL was asked to recover internet brows ing history and other data from a mobile device. However, upon initial inspection, the devic e was secured with an advanced pa sscode, which can be up to 32 alpha numeric characters long. It is currently impossible to try and guess a passcode this long, as current computers are not po werful enough to do this in our lifetim e. The suspect was not co-op erating and would not provide the lock code. WHAT CCL DID: In ord er to gain access to the data sto red on the phone, without ha ving the passcode, CCL’s analy st used jigs to connect to the actual circuit board of the phone and rec over a read of the data stored on the chip. This method meant that CC L was able to obtain a full physica l read of the device without remov ing the flash chip. It is also a cheape r and nondestructive alternative to other methods. Once a full read of the phone had been recovered, internally developed scripts we re used to recover and present the most pertinent data in an ea sy to understand format. Th e internet history was recovered, which showed significant changes in the suspect’s searching and brows ing activity immediately after the incident was suspected of occurrin g. Along with this data, deleted text messages were also rec overed using epilog, one of CCL’s pro prietary forensic tools. These deleted messages contradict ed the suspect’s version of events leadin g up to the timeframe in questio n. THE OUTCOME: Th e combination of bypassing secure lock codes and recovering hard to find and deleted data meant CCL was able to provide a full picture of the suspect’s activities, which show ed he was trying to hide evidenc e and pervert further investigations.

THE BENEFITS OF QUALITY STANDARDS – ISO1702 THE JACKSON REFORMS MEAN LITIGATORS REQUIRE NEW STANDARDS IN THE MANAGEMENT OF ELECTRONIC DISCLOSURE TO ENSURE A PROPORTIONATE AND DEFENSIBLE APPROACH The Jackson Reforms create challenges as well as opportunities for lawyers. One of the biggest challenges is having to deal with disclosure in a proactive, proportionate and defensible way. Quality standards can ensure that you are adopting a proportionate approach to e-disclosure by: • Giving you a fully defensible method of selecting an e-disclosure partner • Ensuring the e-disclosure process is efficient and cost-effective, and • Providing absolute assurance that tasks are done right first time, in a thorough, auditable and fully defensible manner What this means to you, and your clients, is a more efficient and proportionate e-disclosure process, and less time and money spent rectifying work that may have been done incorrectly in the first place by a provider without adequate quality standards.

CCL was the first, and is still the only digital forensics provider in the UK to be accredited to ISO17025 for our computer, mobile phone and SatNav laboratories, for collections, analysis, storage and production. This means that our data collections ensure evidential integrity is maintained, as our methods are fully defensible and will withstand scrutiny. It also provides assurance that work will be done right first time – providers who do not have adequate quality standards in place cannot guarantee this level of service, which could end up costing you, and your client, time and money.

WHAT IS ISO17025?

Quality is one of CCL’s core values. CCL is focused on establishing new standards in data collection and e-disclosure services.

ISO17025 is the International Standard for the General Requirements for the Competence of Testing and Calibration Laboratories. It is the preferred standard of the Forensic Science Service – the highest accreditation in the industry. The standard will become mandatory in criminal proceedings by 2015.

WHY SHOULD YOU CARE ABOUT QUALITY?

ISO17025 sets out what is expected of CCL in relation to our quality assurance and compliance with UKAS requirements.

Cases can be won or lost on data collection and preservation failures. Quality standards such as ISO17025 and ISO27001 focus on efficiency of processes, standardised and iterative procedures, and data – the management, preservation, collection and admissibility of it – and the crucial part these play in the success of an e-disclosure exercise. As e-disclosure services become increasingly commoditised, and as the Jackson Reforms increase the scrutiny on costs, there is always the risk that the quality of work being produced by some providers could be adversely affected. Robust quality standards go some way to addressing this, as they provide a set of standards and a framework that ensures industry-recognised best practice is followed throughout. They also ensure that business operations are as efficient as possible, increase productivity and improve quality. What this means to you, is: • A tangible and objective guarantee of evidential integrity • A reduced likelihood of error, and the cost, time and inconvenience involved in repeating work undertaken incorrectly • Reduced risk of data collection or preservation failures • Strengthened defensibility of your evidence in court • Assured objective benchmark of the reliability and quality of a partner’s work • Work is completed within a framework that ensures industryrecognised best practice and standards are followed throughout • Continual improvements in quality and effectiveness • Robust and efficient processes and procedures – that you can defend to your client and in court

ISO17025

WHAT ARE THE BENEFITS? •

•

Everything is done within an externally audited framework – high quality, standardised and repeatable processes ensure that all activities are efficient whilst maintaining a thorough approach. This approach helps keep costs proportionate and defensible – helping you to meet your obligations under the CPR UKAS requires providers with the ISO17025 accreditation to write a series of operating procedures specifically for each client – again ensuring a consistent, efficient and defensible approach tailored to your case Evidential integrity. The robust and externally audited nature of our processes and procedures ensures that the chain of custody is maintained, reducing the risk of the integrity of your evidence being challenged in court This is not a one-off accreditation. Regular audits and ad-hoc spot-checks by UKAS ensure that the standards are maintained at all times Trained and competent staff. CCL’s analysts undergo regular training which ensures we keep up to speed with advances in technology and forensic science. Training plans are externally audited and verified

25 & ISO27001: ISO27001

CCL’S ACCREDITATIONS:

Information security has never been as important as it is today. In an e-disclosure or digital forensics exercise, you need to ensure that your client’s data is in safe hands. ISO27001 provides that assurance.

ISO17025:

CCL-Forensics Ltd (for computer, mobile phone and SatNav analysis) -

WHAT IS ISO27001? Fundamentally, in a market where digital forensics and e-disclosure services are becoming increasingly commoditised, and with the Jackson Reforms putting increased scrutiny on the cost of e-disclosure exercises – this standard ensures that no corners are cut and that consistently high quality standards are adhered to. For CCL, securing this standard took over 500 man hours of effort and a financial investment of over £100,000.

ISO17025 FOR E-DISCLOSURE: The ISO17025 standard does not currently exist for e-disclosure services. CCL is working with UKAS to develop the ISO17025 standard for e-disclosure services, with a view to becoming the first ISO17025 accredited e-disclosure services provider. This means all the benefits outlined above will apply equally to our e-disclosure services – helping you, and your clients, adopt an efficient and proportionate approach to e-disclosure exercises.

ISO27001 is the International Standard for Information Technology – Security Techniques and Information Security Management Systems. It ensures that all sensitive data is stored and handled in accordance with strict procedures which are audited by SGS, a UKAS accredited body. It provides a methodology for the implementation of information security in an organisation. Given the confidential nature of the work undertaken by CCL, it is vital that this standard is in place.

•

• •

•

ISO27001:

CCL-Forensics Ltd -

Leading international standard for information security management. Protects the confidentiality, integrity and availability of client data

ISO9001:

CCL (Computer Consultants) Ltd & CCL-Forensics Ltd -

The International Standard for Quality Management Systems. It provides a set of principles that ensure a logical approach to the management of business activities, to achieve customer satisfaction

Investors in People: CCL-Forensics Ltd

WHAT ARE THE BENEFITS? •

General requirements for the competence of testing and calibration laboratories. The main ISO standard used by testing and calibration laboratories

Protection of client data. Provides confidence and assurance to your clients by having in place policies and procedures to protect the confidentiality, integrity and availability of client data: their data is in safe hands Confidentiality – securityclearance procedures and a confidentiality agreement signed by all staff ensure that critical and sensitive information stays within the company Robust processes to identify, manage and reduce the risks to key information Recognised worldwide as the leading international standard for information security management Clearly defined responsibilities and business processes

ISO27001 requires that information security policies and practices are subject to independent external review – this means that both you and your client can rest assured of the security of your data.

The UK’s leading people management standard, specialising in transforming business performance through people

Accredit UK:

CCL (Computer Consultants) Ltd -

The standard of quality for ICT companies in the UK

ACTIVELY WORKING TOWARDS: •

ISO17025: for e-disclosure services. This standard does not currently exist for e-disclosure services, so CCL is working with UKAS with a view to becoming the first ISO17025 accredited e-disclosure services provider

•

ISO14001: environmental management standard to ensure CCL incorporates environmental policy and procedures into our day-to-day activities, as part of our commitment to corporate social responsibility

•

ISO17020: for cell site analysis services. To ensure the high standards that we set in our laboratory are also adhered to when we are conducting cell site analysis work off-site

ISO17025 is held by CCL-Forensics Ltd for computer, mobile phone and SatNav analysis.

CASE STUDY IP theft THE CASE: The sales manager of a large IT company handed in his notice claiming that he was s in going to set up his own busines ent curr his with ition pet direct com s employer. He took three month of s garden leave as per the term his contract. y Several months later, the compan in fall l dua gra a of re awa became revenues. Further analysis revealed that an increasing amount of business was lost to their former sales manager’s new company. The risk manager, who had experience of digital forensic examinations, prevented the IT department from examining the suspect’s laptop. This is because any attempt to investigate the device, by an individual who is not a qualified digital forensic examiner, can potentially destroy vital evidence. Even the act of turning on a laptop can compromise the data contained within it, and contaminate the l. ‘digital trail’ which can prove vita r WHAT CCL DID: The risk manage n give was and L, CC contacted advice on the best way to handle the device. A security-cleared driver from CCL was dispatched to collect the laptop, which was immediately placed in a sealed s evidence bag to begin the proces of maintaining the integrity of the evidence. CCL took a forensic image of the laptop, which allows the y analyst to work on an exact cop it out with ice dev inal orig the of having to be switched on. The forensic image contains data about installed programs, live and deleted files, internal log files, registry entries – in short, there is the potential to recover t records of almost any activity tha ice. dev took place on the THE OUTCOME: CCL’s analyst was able to determine that approximately 30 minutes before the former employee resigned, he copied tens of thousands of records from the CRM system onto a memory stick.

THE ESI QUESTIONNAIRE The ESI questionnaire has been in existence since October 2010, when Senior Master Whitaker was faced with two parties that had failed to consider the disclosure of a substantial number of electronic documents, in the case of Gavin Goodale & Ors v Ministry of Justice. This questionnaire, more often referred to as the ESI questionnaire but officially called Form N264, has been slow to be adopted. Lord Justice Jackson explicitly approved it and it is now incorporated within Practice Direction 31B, applying to all multi-track cases where there are electronic documents. The aim was for it to be used: 1. Where the parties may find it helpful; or 2. Where the parties have been unable to reach agreement; or 3. If the court considers the parties’ agreement ‘inappropriate or insufficient’, the court ‘will consider’ ordering completion of ‘all or any part’ of the questionnaire. As the article on page 7 stresses, the more thought and consideration that goes into planning an e-disclosure exercise early on, the easier it is to undertake it efficiently and proportionately. Of course, following the new rules on disclosure that came into force in April, parties no longer have the default option of standard disclosure, and when deciding on the best strategy from the menu option within Rule 31.5A, it is the ESI questionnaire that will form the basis for discussions between parties on the most appropriate and proportionate disclosure strategy. Form N264 provides a ready-made template for scoping e-disclosure requirements. Understanding your client’s electronic data landscape and then engaging with the other side at the earliest opportunity, and even using form N264 at the pre-issue stage, has a number of advantages. It: • • • •

Promotes early consideration of the requirements and scope of the exercise, helping to reduce costs Explores the expectations of the other side, preventing unexpected and potentially costly changes in scope Provides a detailed basis for instructing an external e-disclosure provider, ensuring that potential partners are able to quote accurately, aiding predictability on cost Offers a tactical advantage and ensures greater influence over the terms of disclosure

This is all very well but the form itself is by no means straightforward to complete. It would be a mistake for any solicitor to attempt to complete this unaided, as the questions require consultation with the client’s internal IT team. However, bridging the technical gap between solicitor and IT administrator is no simple task. Not only do the right questions need to be asked, but the responses need to be distilled down to only what is relevant, ensuring that the information included in form N264 is succinct and accurate. For example question 4 asks: ‘Apart from attachments to e-mails, which forms of Electronic Documents were created or stored by you during the date range?’ Depending on the business and the nature of the case this list could be extensive, but only a small portion will contain relevant information, so an understanding of the technologies is required in order to make this assessment. Form N264 is a valuable blueprint and should be used whenever electronic documents are being discussed, even if it is only used at the pre-issue stage, or with a view to influencing a settlement, or as part of your risk assessment, before deciding to take a case on a conditional or contingency fee basis. Form N264 is a useful resource and proactive use can help control costs. Liaising with the client’s internal IT team and an e-disclosure partner at an early stage can make the process of completing it considerably quicker and more effective.

LOW COST E-DISCLOSURE? By Rob Savage With the Jackson Reforms now in full swing, litigators are facing the prospect of considering electronic disclosure for all multi-track cases. But in reality how feasible is e-disclosure on a case with a relatively low quantum? The cost of storing electronic data is as cheap now as it has ever been and the explosion of electronically stored information (ESI) is not a trend limited to the big boys in industry; it is entirely feasible that SMEs are themselves harbouring several terabytes of data. The question was put to me: can e-disclosure be done on a tight budget without cutting corners or sacrificing accuracy? It is an unalterable fact of e-disclosure that the more you want, the more you pay. Quite often economies of scale can apply to professional services time, however when it comes to software and review costs, it is very much a linear increase…you get what you pay for. However, with careful planning and a targeted approach, costs can be kept to a minimum.

• Data capture • Processing • Review • Production The output of each phase forms the input of the next. So, a larger volume of data at the outset often means larger volumes, and hence higher costs, throughout the e-disclosure exercise. I am always a little cautious about adopting an overly targeted approach to collections. It is not uncommon for investigations to change direction, bringing new areas into scope. An overly targeted collection may result in having to re-collect at a later stage, incurring unnecessary costs. A targeted but diligent, future-proof collection strategy should be used, with careful planning to accommodate for, as much as is practicable, future changes in investigative direction.

processed. Processing costs, if not correctly managed, will eclipse large portions of the budget. Careful thought should be given to what documents you are looking to disclose. In the example case shown below, if we are only interested in files created in 2007 and later, we can immediately cull over 50% of the data. Furthermore, if we were only interested in Microsoft Office and PDF files, we could reduce the remaining by, say, a further 70%, meaning that we end up processing just 15% of the original data. These reduced volumes will mean lower costs through all subsequent phases of the exercise, most noticeably in review. So in answer to the original question: can e-disclosure be done on a tight budget? The answer is yes. However, this requires meticulous planning at an early phase and an in-depth understanding of the matter in order to make early informed decisions on what data is likely to be relevant.

Many of the mainstream e-disclosure tools offer pre-processing functionality. This should be used to reduce, as much as possible, the amount of data being

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

(None)

Volume

The key to controlling costs lies in carefully selecting what to process. The Electronic Discovery Reference Model (EDRM - www.edrm.net) identifies nine phases to an e-disclosure exercise.

Greatly simplified these can be distilled to:

OUR SERVICES

ABOUT CCL CCL is the UK’s largest digital forensics laboratory, and a leading provider of e-disclosure and IT consultancy services. From our beginnings as an independent IT consultancy in 1986, we have developed our services to respond to advances in new technology, the increasing importance of data, and the need to manage, recover and protect it. In 2001, we setup our digital forensics laboratory. CCL is now the largest digital forensics provider in the UK, and the only one to hold the ISO17025 standard for our computer, mobile phone and SatNav laboratories. We provide digital forensics services to a broad range of organisations, ranging from law enforcement agencies, civil and criminal law firms, to corporate clients. CCL has been in the e-disclosure market since 2009 and to date, has completed over 200 e-disclosure cases.

• Part 31 e-disclosure services • Digital forensics - All operating systems - Smartphones/mobile phones - Tablets - SatNav analysis - Cell site analysis - CCTV analysis • Collections • Part 25 search and seizure orders • Part 35 expert witness services

COMING UP NEXT MONTH: Bribery act IP theft – how to respond Digital data investigations Scan the QR code with your smartphone for more content.

THE NUMBERS CCL employs over 100 full-time members of staff, including 65 consultants and analysts who have completed: • • • • • •

200+ 2,500+ 50,000+ 2,000+ 700+ 450+

e-disclosure cases digital forensic (PC) cases mobile phone cases consultancy engagements legal and defence cases expert witness assignments

For more information call Rob or Umar on

01789 261200

email edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com 8

CPD C AND OURSE ‘E-D THE ISCL J ACK CCL prov SON OSURE ides ever yt C REFO elect hing you PD cour RMS s ronic e n s fo Direc ally s eed to ’ kno r lawyer tore tio

n 31 B an d inform w about s. These d the d co a Deliv Jack tion und isclosure ver ered s e of o r ensu n Re form Practice res y by our in s. ou a -hou of th re se e three Jackson prepare counse l, d R can b CPD hou eforms to mee our CPD t o r e the r cour n s h are e-d el num ber o d at you availabl isclosur equirem se en ro e. e, f atte ndee ffices, su and the One to ts CCL’s cour bjec s. se t to a cour ‘e-Disclo mini se co sure mum vers: and the J acks on R • Int eform rodu s’ ction • Pra to el ctice ectro nic d Direc • Ru isclo tion le 31 sure 3 1 B an .5A d the • Co ESI q ntrol ling uest Cost • To ionn ols a s aire nd te • Ke chniq y cas ues es