E-Mail Archives And Litigation: Here's How To Get It RightE-Mail Archives And Litigation: Here's How To Get It Right

FOLLOW THE MAP
Legal discovery requirements are set forth in the Federal Rules for Civil Procedure, which govern federal civil lawsuits. The discovery process is complex and expensive, averaging in excess of $1.75 million for a single case, according to Gartner. It consists of many stages and may require several technologies, including content repositories, discovery tools, and legal-review software and services.

To help make sense of it all, many enterprises now rely on the Electronic Discovery Reference Model, a conceptual framework that guides IT through all the stages required to meet federal rules that govern the use of ESI in litigation. EDRM was launched in 2005 by consultants George Socha and Tom Gelbmann, and more than 100 organizations have since participated in construction of the framework. EDRM also has been widely adopted by vendors. Companies that sell content repositories and discovery and legal review tools use the model to describe where their products fit in the process. Socha and Gelbmann are now overseeing creation of an EDRM XML schema to facilitate data transfers from one set of products to another. Thirty organizations, including Symantec and Autonomy, have signed on to help develop the schema.

As the graphic below shows, there are nine main steps in the discovery process. E-mail archiving products may include many of the functions outlined in EDRM and also can be used to export content to tools that specialize in other phases of the process.

The first step in the EDRM framework is information management. This is more a goal than a step: Those with mature data management architectures will be able to meet discovery requests with a minimum of fuss. In a well-developed system, unstructured information is indexed on a schedule so that IT can quickly find and identify relevant data. Information should be stored in managed repositories, such as an archive or a content management system, for easy retrieval.

Next step is identification. Once a discovery request is initiated, the organization has to determine what information is required, where it's stored, and who are the custodians, defined as individuals who have relevant information under their control, say, on their hard drives or on a file server or storage system.

Search and index technologies are required for identification. A good e-mail archive will index the metadata and content of e-mail, including attachments. An index makes discovery searches faster and more efficient by returning a higher percentage of relevant information. Most archives index the content stored in them and provide search capabilities for both users and administrators. Also valuable in the identification stage are search products from vendors such as Autonomy, Kazeon, StoredIQ, and Recommind.

(click image for larger view)

Preservation and collection come next. Once you identify the data you want, IT has to preserve it and ensure that it isn't altered or deleted. For instance, opening a document can change critical metadata, such as the access date, which can then affect the validity of the document--known as "spoliation" by legal types. In addition, if the enterprise has a retention and disposal policy, potentially relevant data must be placed under litigation hold, which suspends deletion of e-mail and files that may be relevant in a lawsuit.

An e-mail archive also can serve as a preservation system. It provides a common repository for actionable information and removes the preservation burden from individual employees--an excellent idea. Symantec Enterprise Vault's Discovery Accelerator add-on module lets an investigator put archived mail on litigation hold. Many archive products also will encrypt mail and create a hash value for each message to prove that no changes were made.

The processing, or culling, phase aims to reduce the initial size of the data set. A first-round search is likely to produce reams of irrelevant mail, documents, and files, including duplicates and content unrelated to the legal matter. E-mail archives often include the ability to eliminate duplicate copies of messages and attachments before they're saved, thus serving as a form of early processing.

The review, analysis, production, and presentation phases are oriented more toward legal counsel. A host of specialized products and services from vendors including Attenex, LexisNexis, Clearwell, and Xerox Litigation Services provide a workflow and management system for the material related to a case.

Because e-mail is the primary target of lawyers, an e-mail archive makes a sensible foundation for organizations facing--or expecting to face--litigation. As the EDRM diagram shows, an e-mail archive will play a significant role in many phases of the discovery process. An archive can reduce your discovery time from days or hours to minutes. Look for capabilities such as litigation hold, indexing, and search in an e-mail archive product or service.

And don't forget that archives are useful outside the courtroom. They provide additional storage resources for users and ease the strain of growing mail volumes on production e-mail systems.

Photo illustration by Jupiterimages