Craig Ball on Forms of Production

Here's a summary a section of Craig Ball's Electronic Discovery Workbook, on '"Forms that Function".

A. Form

- ESI should be produced in forms that function - that preserve the integrity, efficiency, and functionality of digital evidence.

B. Federal Rules of Civil Procedure

1. Fed. R. Civ. P. 26(f)(3)(C) requires that the discovery plan address the form in which ESI is to be produced.

2. Fed. R. Civ. P. 34(b)(1)(C) permits requesting parties to specify the form of production.

3. Fed. R. Civ. P. 34(b)(2)(D) allows the producing party to object to the requested form.

4. Fed. R. Civ. P. 37(a)(1) if there is a dispute the parties must meet and confer to reach a resolution.

5. Fed. R. Civ. P. 34(b)(2)(E)(ii) requires parties to produce ESI in the form in which it is ordinarily maintained.

6. If the parties can't agree, the requesting party has to file a motion to compel.

C. Native Files

1. Multiple forms should be used in most productions: images; native; near native; or hosted. Near native productions are useful for enterprise email, databases and social media content.

2. Ball advises against converting native files to TIFF images because:

a. the expense for conversion and for load files

b. spreadsheets cannot be easily converted into images

c. TIFF images tend to be 5-40 times as large

d. the images can't be de-duped.

e. a request for re-production with natives may be made.

3. Ball rejects these four excuses for refusing to produce native files:

a. hard to Bates label.

b. evidence may be altered.

c. native productions require broader review.

d. native files can't be redacted.

D. Form

1. Don't ask for documents - ask for information in a useful and complete form. 'Information items'.

2. Specify a format, not just native files. E.g. .xlsx; pptx.

3. For email, ask, "Can the form produced be imported into common e-mail client or server applications?"

4. Specify the load file format - include:

a. hash values

b. UTC offset

c. deduplicated instances

d. email folder path

e. redaction flags

f. embedded content flag.

5. Include logical unitization data

E. De-duplication and Redaction

1. Vertically de-dupe by custodian.

2. Don't perform near de-duplication.

3. Redactions should not impair the ability to search through non-redacted content.

Nuix Workstation

If you are using the current version of Nuix Workstation, released in May 2020, note that you will not be able to successfully process certain types of data without installing third party software. Nuix workstation is used to process data from both structured and unstructured data. Nuix Workstation can process, search, index, and analyze ESI. Nuix Workstation will identify email addresses; dollar amounts; company names; and phone numbers.

In order to process Lotus Notes archives with Nuix Workstation you will need to install Lotus Notes Client.

In order to extract data from video files, FFmpeg should be installed. FFmpeg includes codecs for decoding audio and video files. It can convert audio and video files into different formats.

Nuix uses ABBYY FineReader to OCR documents. The 'Nuix OCR Addon' must be installed for this feature to be enabled.

An plug-in is also needed to use Elasticsearch, which allows large data sets to be searched in realtime.

Unicode compliance

When considering which electronic discovery software to use, confirm that its processing is unicode compliant - that it can search and display foreign language documents which use Asian characters or the Cyrillic alphabet. Processing which is not unicode compliant may generate text with boxes or random symbols - something most of us have had the misfortune of encountering before.

UNICODE

ASCII

The ASCII character encoding only supports the Latin alphabet, and is limited to 128 characters. The UTF-8 unicode character encoding can support more than a million different characters and also covers Greek, Cyrillic, Coptic, Armenian, Hebrew, Arabic, Chinese, Japanese, Korean, and other major languages. The first 128 characters of UTF-8 are the same as the 128 characters of ASCII. Most text on internet web pages uses the UTF-8 encoding. It's important to confirm with an e-discovery vendor that the tools they are using for data collection and processing support unicode encoding.

Not all data is in unicode. Email systems may use their own proprietary encoding systems. In Japan the Shift-JIS format is widely used for email text. MS Exchange uses unicode for PST archives. However individual email messages saved with a .msg extension don't use unicode for the email header fields. Tools which collect local .msg files may garble the text of email headers unless an adjustment is made for the Outlook encoding.

Even if processing software is unicode compliant, it will still be necessary to use separate language detection software to determine which languages are present. Identifying the encoding can determine the alphabet, but not necessarily the language.