Tech Audit

Discovery Downsized

  • Print

Michael Barnsback, an employment and civil litigation senior associate at nine-lawyer firm DiMuro Ginsberg in Alexandria, Va., says that e-discovery is part of almost every case he sees.

But rather than make his life more difficult, he believes e-discovery has made it easier for small law firms like his to compete with large law offices.

Unlike the paper world, where large law firms often had to throw teams of attorneys at a document-review project, technology levels the playing field down to one person and a PC. “I think it equalizes the process,” Barnsback says. “I prefer e-discovery because if you’ve got hundreds of thousands of documents, it doesn’t take a lot of people to review them. I can sit in front of a computer and do [discovery] by myself if I need to.”

There are now hundreds of companies building their business around helping law firms review electronic documents. But for the most part, these companies are geared for litigation involving millions of documents. For small or straightforward cases, small-firm lawyers are learning to review documents for themselves.


The first lesson for small law firms may be that e-discovery is not easy, since it can involve evidence from a lot of sources few lawyers can be expected to fully understand. Deleted files, metadata, Internet history files, e-mail, hidden operating system files, cellular phones, handhelds and storage media are all discoverable. But since Microsoft dominates the world of technology, lawyers will probably find a lot of discoverable data is in a small number of formats, like Microsoft .pst files, which come from Microsoft Outlook e-mail. Mastering common­ly used formats means attorneys can handle at least some cases themselves without expert help.

Outlook files are generally difficult to search, especially if a lawyer is looking for attached files, but it is possible to do. Some lawyers will simply load a .pst file into their own Outlook software in order to look through it, but opposing counsel can point out that Outlook doesn’t protect against tampering.

A product like Aid4Mail Professional ($49) can extract e-mail and attached files. Other inexpensive products like dtSearch Desktop ($199) can search e-mail and other files. And if lawyers expect to do a lot of e-discovery, it is probably useful to invest in high-end tools, which can cost thousands of dollars. Such products include Guidance Software’s EnCase for capturing, searching and analyzing data ($2,500), though such products may require special training to use properly.

Responding to a request can be a heavy burden for a small business. As soon as litigation is likely, parties have a duty under current law to preserve all potentially relevant documents. Products like Norton Ghost ($69) allow an individual to make a digital copy of data, but such evidence may not be admissible in court, since making the copy can change some data.

However, a product like Ghost can be useful for helping clients keep the business going in the event they are hit with a major discovery request. John Simek, a computer forensics tech­nologist and vice president of Sensei Enterpri­ses in Fairfax, Va., recommends taking the hard drives from computers, making a digital copy on a new hard drive, and using the Ghost cop­ies to keep the business operating while storing the old hard drives for litigation purposes. That can cost thousands of dollars, but it is certain to satisfy any court order.

Forensic images can also be useful for discovering potential wrongdoing. If an employee or spouse is suspected of something untoward, it is possible to make a digital image of a hard drive while he or she is away. Such evidence can then be used to get a court order to subpoena the whole computer.


That’s not to say that lawyers should learn to handle all aspects of discovery themselves. E-discovery has added technical complexity to cases that lawyers cannot always take on.

Destruction of evidence was a straightforward issue when litigation involved just paper records—either a doc­ument was destroyed or it wasn’t. But, Simek says, attorneys and information technology staff can make innocent mistakes just by accessing documents, which can change or obscure relevant information.

“Most of the time, things like that might not matter,” he says. “But if you need to prove someone accessed a document on such and such a date, now your case [may be] much weaker.”

To find out whether a digital document has been altered, lawyers can look at metadata, the hidden information about document properties that tells when it was created and which computer accessed it. Barns­back once requested electronic copies of e-mails from opposing counsel, hoping to find out whether some were tampered with. However, opposing lawyers scanned paper printouts of the e-mails, then turned them into digital PDF files, which effectively eliminated any metadata.

Barnsback was eventually able to get the electronic originals, and he didn’t find any evidence of tampering. But in e-discovery, opposing counsel can seek sanctions if one side fails to produce requested evidence or produces it in an unusable form. Even if there are no negative inferences of destroyed evidence, it can lead to unfavorable jury instructions. “You really have to know what you’re doing if you get in a fight like that,” Barnsback says.

In a case involving recovery of deleted data, a small firm might try the aforementioned EnCase. But if the recovery work is becoming too big or involves too many unusual formats, it is time to consider an expert. Simek says his service can cost from $3,000 for a small case to $20,000 for business cases or large family law jobs requiring analysis and recovery of digital evidence. Typical rates for e-discovery legal technology consultants could be about $1,000 for hard drive analysis and $280 per hour for expert analysis.


When a lawyer has a lawsuit that might involve digi­tal evidence, the first thing to do is send a preservation letter to the opposing side specifying the data types, locations, individuals involved and nature of evidence likely to be requested. Lawyers can depose individuals and information technology staff to find out how documents are stored and moved within an organization and use that information in their discovery demands.

For responding parties, lawyers should make sure all litigation “hold” letters get forwarded to the client immediately. The lawyers then should prepare and circulate a memo outlining the steps to take to preserve evidence. That means halting normal business practices like rotating and deleting electronic data that could be relevant, and stopping routine tasks like disk defragmentation and other maintenance routines.

All relevant business units, activities, jurisdictions, facilities and key players should be identified and prepared to meet potential requests. Law­yers need to instruct their cli­ents and other attorneys not to review documents on their own or they could upset the chain of custody or destroy metadata evidence. Lawyers should also work with clients to find where privileged e-mails and documents are likely to be kept so that those can be segregated from other documents before the review process begins.

“You really have to think about what needs to be done right away,” Barnsback says. “You shouldn’t be reactive about this.”

And one thing small law firms can offer that large firms often cannot is more personal attention to a client. E-discovery is not always a dispassionate, technical process, and lawyers need to be ready to handle the emotions that can come into play. Especially in family law cases, hurt feelings can waste money on unnecessary discovery. Law­yers need to use both technical and legal sense to know whether information is actually discoverable.

“It can become emotional, and even against our advice people will insist that we keep digging for things like proof of adultery,” Simek says. “If a business customer gets a smoking-gun e-mail, they know to stop digging. But sometimes people don’t know when to stop.”



Here are some steps for small firms to follow when doing their own e-discovery:

l Send a preservation letter to clients listing what sorts of items might be requested.

l If you (or your client) receive such a letter, inform all relevant departments what data to preserve and how to protect it.

l Consider special software tools (see main story) to extract certain files, including deleted data.

l Preserve the chain of custody to prevent inadvertent changing or obscuring of metadata when accessing files.

l Identify and protect privileged data early.

l Hire an expert when things get complex.

Give us feedback, share a story tip or update, or report an error.