The process of Document Discovery has become a well worn tool in the litigator’s bag of tricks. It is a popular belief that if someone has, thought or said something they shouldn’t, somewhere there was likely to be a piece of paper with it written down. Even though we continue to march toward the long held ideal of the paperless office, we still find row upon row of filing cabinets stuffed to the gunnels with potentially incriminating evidence. However, with the current reliance on technology; computers, PDAs, mobile phones and, sometimes, even printers can offer up far more potentially valuable bounty. Digital Document Discovery is, quite simply, the discovery of documents that were created electronically and/or stored digitally.

What You See, Isn’t Always What You Get

The increasing awareness of the value of digital evidence in both civil and criminal matters brings with it many new challenges, not least of which is the concept of what digital evidence actually is. In its most fundamental form, digital evidence is exactly what it says on the tin, digital! It is simply a stream of ones and zeros. But, by using software tools and a little knowledge we can turn this data into information. Quite simply, what we see when we open a document in software such as Microsoft Word is an interpretation of the data that forms the document. This information can be found in word processing documents, spreadsheets, emails and database files to name but a few.

However, the information we see when we use the appropriate software is often just the tip of the iceberg. The deeper value of digital evidence can often be found in the information that is normally hidden from the viewer. For example, a Word document may contain details such as the name of the original author, the owner of the software used to create the document and even previous versions of the document while an Excel spreadsheet might contain hidden cells and formulae. These are all examples of the valuable evidence hidden within the data that is known as metadata, or “information about the information”. It is only possible to recover this metadata, which might be just the “smoking gun” we are looking for, electronically.

As a result of the way we work with and store this digital information, the next challenge that faces us is that of possible spoliation. Digital evidence brings with it a unique potential for spoliation. Simply opening a Word document and printing it can alter document content such as dates, or metadata such as user details and information about the last printer to be used. Other potentially vital information such as the last date the file was accessed or modified can also be changed. Because of this, the discovery and disclosure process must be carefully controlled and monitored if we are to maintain the evidential integrity of the documents in our case.

Tell Me When To Stop

The sheer quantity of available information can also create difficulties for us. The extent to which the discovery and disclosure of material is increased through the inclusion of digital evidence can be both a blessing and a curse. In a recent case of IPR theft, DataSec recovered more than 6000 relevant documents from 330 gigabytes of data seized during the execution of an Anton Pillar order. The search, equivalent to a review of more than 630,000 documents was completed in only 4½ days. Whilst the quantity of recovered documents and the time in which the search was completed would put most paper discoveries in the shade, the client’s lawyers still had significant quantity of documents to assess.

As a result of the ease with which data can be distributed between computers, multiple copies of a document may exist throughout an organisation. Distribution can occur through everything from the humble floppy disk to the use of writeable CDs to the sending of files as attachments to Email. Such proliferation needs to be identified and filtered out unless, of course, it is pertinent to the action we are pursuing!

Proliferation also highlights another problem. Where do we look for the documents? Most modern offices, from the smallest SOHO through SMEs and on to the big Corporations now employ some kind of network with which to connect their computers. These networks may hold documents centrally on dedicated computers known as Servers. These computers may be located in other countries and consequently other jurisdictions. Even the Internet can be a potential store for documents relevant to our case. Space can be rented on computers anywhere in the World on which documents can be stored and accessed via the Internet and Email services, such as HotMail, are Internet based (HotMail’s servers are located in the USA).

Another digital benefit is the ability to recover documents that have been deleted. Because of the “way computers work”, if a document has been stored or manipulated on a computer, even though the User may have deleted it, fragments or even complete copies can be routinely recovered. Kenneth Withers, in his article “Is Digital Different? Electronic Disclosure and Discovery in Civil Litigation” , describes this as the “Vampire Effect”. In other words, no matter how hard you try to kill it, it will always return.