Electronic discovery services

The impact of electronic records in litigation and criminal investigations

With as much as 90% of all business records now created and stored electronically, it is rapidly becoming the rule rather than the exception that discovery opponents will seek production of your clients' electronic records. And modern technology that allows massive transmission and storage of electronic information invites abuse. For example, hackers steal information or damage systems; others perpetrate traditional offenses such as fraud, using computer technology. Simply acquiring and analyzing these huge volumes of data requires experienced investigators -- professionals trained in the forensic acquisition and analysis of electronic evidence.

Efficiently and effectively identifying, preserving, retrieving, and analyzing electronic data in support of an investigation or ongoing litigation has become fundamental to understanding and resolving disputes, and requires that the following questions be addressed:

• What relevant electronic and hard copy records exist?
• Where is the information located and what systems contain relevant data?
• Have appropriate preservation steps been taken to avoid overwriting data that could result in spoliation claims?
• Do backups exist, and if so, how and where are they maintained (e.g., tape, optical drives, on-site, off-site)?
• What forensically recoverable electronic logs and other "digital fingerprints" exist that can be used as crucial evidence?
• Is the review of electronic data being done in an independent manner so as not to compromise the evidentiary value of the material?

Responding to electronic records notices, orders, and subpoenas

Responding to requests for electronic information can be perplexing. First, identifying responsive information from huge stores of data — frequently measured in terabytes — can be time consuming, disruptive, and costly. Second, extracting data from computers in ways that reliably preserve evidence is not a simple undertaking, as data can easily be altered either intentionally or accidentally. Recognizing these facts, litigators and investigators in both civil and criminal cases have begun to focus carefully on electronic discovery and the role of computer forensics -- the science of reliably recovering and handling electronic storage media and the data contained therein so as to provide the appropriate foundations for admissible evidence.

PricewaterhouseCoopers' electronic discovery teams bring a highly professional, collaborative approach to our clients' electronic discovery needs. Using our proprietary tools and forensic laboratories worldwide, we can efficiently find, retrieve, preserve, analyze, and process a wide array of electronic information.

We assist clients by designing and implementing preventative measures such as:

• Information system policy and procedure reviews for electronic document retention and destruction
• Compliance reviews to ascertain whether policies and procedures are being followed
• Assistance in drafting/negotiating preservation and production agreements, orders, and document retention letters.

• A full spectrum of information system-focused investigative capabilities, including specialists in traditional commercial litigation matters, criminal investigative proceedings as well as SEC and other regulatory inquiries/investigations
• Computer Forensics — forensic images of media (personal computers, servers, backup tapes, other systems) and review of deleted/damaged data
• Inventory and mapping of relevant data sources and systems
• Analytics and processing of e-mail and other data including enterprise wide data storage and database systems
• Support for attorney work product, privilege and relevancy reviews of electronically stored data
• Creation of production sets (i.e., CD ROM, hard copy, web)
• Affidavits, declarations, expert reports and related testimony pertaining to the aforementioned
• Expert testimony in support of legal positions with respect to an electronic discovery request.

Acquiring and analyzing computer files

Forensic technologists are commonly retained to acquire and analyze computer files. At the start of most litigations or investigations, counsel often needs to move quickly to preserve vital evidence held on employees’ or other parties’ computers. We can rapidly deploy staff anywhere on the globe to gather forensic images of computers using recognized tools and techniques. We then work with counsel to review these images to identify key files as well as find any deleted or hidden files that remain on the hard disk -- deleting a file does not remove it from the hard drive.

In 2001 PricewaterhouseCoopers, LLP worked with the International Association of Chiefs of Police Advisory Committee for Police Investigative Operations, Technical Support Working Group, and the United States Secret Service to develop the Best Practices for Seizing Electronic Evidence (Version 2). This hands-on manual has been distributed to hundreds of thousands of law enforcement officers as a guideline for properly seizing computers and other electronic equipment without damaging the evidence these devices may contain.

Acquiring and analyzing email

Given the prolific use of email as the communication tool of choice within most organizations, it is not surprising that many litigators and investigators specifically focus on email during discovery. However, email poses the forensic investigator with some unique challenges.

• Emails are often found in a number of different places, for example one email may be found in the senders mail box on their hard drive, on network mail boxes and in the backups on the network and in each of the recipients’ mail boxes.
• Some emails have attachments that may contain vital evidentiary matter
• The high volume of emails often necessitates the use of keywords to focus a review.

The importance of networks

A fast-growing area which presents significant risks to corporate networks, is discovery orders in litigation matters. Over the past several years, attorneys have come to realize the discovery potential of e-mail and electronic document storage. As a result, courts are increasingly issuing and enforcing orders for the production of massive quantities of stored electronic documents (including back-ups). Such orders often require the suspension or alteration of normal network storage, back-up, and archiving routines because these normal operating procedures may result in the destruction of documents covered by the discovery request (e.g., the re-use of back-up tapes may cause the deletion of files covered by a preservation order, leading to sanctions or negative inferences in court). Unless appropriate policies and practices are developed in advance of litigation, the effects of such orders on organizational operations can be severe.

Even if properly prepared, responding to a broad discovery order can be difficult. PricewaterhouseCoopers can assist in the preservation of electronic records (including email), and can help corporate and outside counsel identify and respond to discovery requests by locating and producing responsive materials from very large network environments in an efficient and cost effective manner. We recover data using accepted data recovery techniques so that we can testify as to the validity of our computer forensic operations, thus allowing us to authenticate your discovery responses. In appropriate cases, we can assist in challenging unreasonable discovery requests by preparing affidavits explaining the full implications of a proposed preservation and/or discovery order, or challenge the integrity of the data provided in response to your own law firm's discovery requests.

Transaction and accounting data

Transaction or accounting data extracted from an organization’s general ledger is often the heart of a damages claim or an accounting investigation. However, many corporations find it difficult to undertake the demanding analyses required during an investigation or litigation due to both time and systems capability constraints. Working with our colleagues in the investigative group or directly with attorneys, we are able to quickly extract information from a corporate system to allow in-depth analysis of corporate data. Once out of this environment, the data may be reported on in new and innovative ways. For example, management of key earnings at the end of a company’s accounting period may be found by the daily trial balances obtained from a general ledger. This can often lead straight to the journal entries at the heart of a fraud.

Successful electronic discovery

The complexities of electronic discovery require a disciplined and experienced approach to manage the various issues you will face. PricewaterhouseCoopers' Electronic Discovery Services bring a rational, knowledge-based approach to our clients, helping to streamline the litigation process and bring about a successful outcome.

Our professionals will help ensure that your discovery requests result in:

• Complying with your preservation and production responsibilities
• Reducing the time and cost needed to review materials
• Preserving the evidentiary value of electronic information
• Validating legal positions
• Bolstering credibility