Computer Forensics on a Budget

International In-house Counsel Journal Vol. 1, No. 4, Summer 2008, 560 564 Computer Forensics on a Budget HYATTYE SIMMONS General Counsel, Dallas Area Rapid Transit, USA In preparing for battle I have always found that plans are useless, but planning is indispensable., Dwight D. Eisenhower 1 I. Introduction Planning is the key to keeping computer forensics on a budget. Notwithstanding, rigid, inflexible plans that do not take into account the uniqueness of each case are useless. Therefore, the goal of this paper will be to provide the reader with general concepts for budgeting computer forensics expenditures that can be adapted to fit the individual case. Given the complexity of this task, this paper will make certain assumptions: First, that you have a case that is appropriate for use of computer forensics 2 ; Second, that the computer forensics will be performed by the necessary licensed and/or trained persons 3 ; Last, but not least, that you are either the owner of or have proper legal authorization to collect the electronic data (and hardware) upon which the computer forensics will be performed. 4 II. What is Computer Forensics (and how does it relate to E-Discovery)? Before you can budget computer forensics, you need to know how to recognize it and how it relates to E-Discovery. E-Discovery refers to any process in which electronic data [also referred to as electronic stored information or ESI 5 ] is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case. 6 Computer forensics is the term used to describe the numerous activities associated with the identification and preservation of computer or electronic evidence in support of some official or legal action in both civil and criminal matters. 7 As such, computer forensics involves the use of scientific and legal knowledge to collect, to preserve, to analyze, and to present evidence to a court. 8 Bottom line, computer forensics is used to support the E- Discovery process. Accordingly, budgeting computer forensics involves knowing when and how to use it to help with E-Discovery. III. General Concepts for Budgeting Computer Forensics: A Stage-by-Stage Analysis of the E-Discovery Process. Budgeting computer forensics requires constant fine tuning and plan adjustments to successfully achieve the desired goal: i.e. produce a reasonably accurate estimate of total costs and then keep track of these costs at each stage of the E-Discovery process, while efficiently adding computer forensics support as needed. The total costs of E-Discovery, also referred to as TCeD 9, consist of hard costs, soft costs, and opportunity costs. 10 International In-house Counsel Journal ISSN 1754-0607 print/issn 1754-0607 online

Computer Forensics 561 Hard costs are the actual invoices you pay to have someone (i.e. outside counsel, consulting experts, etc.) perform or assist with the performance of an E-Discovery task. 11 Soft costs consist of the time your Information Technology (IT) department, other staff, and your law department spends assisting in electronic document discovery. 12 Lastly, opportunity costs are comprised of the value of what everyone could have been doing if they had not had to cope with E-Discovery. 13 The following is one 14 possible application of these general concepts to each stage of the E-Discovery process. A. Event Evaluation Event evaluation refers to the legal determination of when a person should begin the preservation (or securing) of ESI. 15 This event could be a discovery request, a lawsuit, or something else. Accordingly, this is a decision the attorney must make; i.e. no amount of computer forensics is going to help the attorney determine under what set of facts he or she should start locating and preserving electronic data. A good decision is based on knowledge and not on numbers. 16 The attorney must make this decision upon his or her knowledge of the applicable law as determined by the facts of the situation, not upon budgetary considerations. In many cases, it is too early at this stage in the process for the client to estimate costs because the client does not know how much relevant 17 ESI exists. 18 B. Locating Electronically Stored Information At this point, and depending upon the facts, the attorney may want to hire a computer forensics expert as a consulting expert to assist the client in defining the various types of ESI, which may help the client in locating it. Normally, in civil cases, it is the client s IT department and other staff members who do the actual locating of ESI, but the complexity of [the] network infrastructures can make pinpointing the specific location of relevant ESI difficult and time consuming. 19 Still, if a computer forensics expert is hired, then it is time to create a budget. For example, this budget estimation could be based upon the approximate total number of hours that the expert will spend in consulting with you and your client at this stage of the process. Of course, this is only an estimate and subject to change as the situation changes. The idea is to set up a process whereby the attorney and the client can begin to establish reasonable cost controls. C. Collecting and Preserving Electronically or Digitally Stored Information Depending upon the media 20 upon which it is stored, digital information can be fragile and therefore altered, damaged, or destroyed by improper handling or examination. 21 When in doubt, use a computer forensic expert 22 to perform this task. Given the volume of data that could be involved, this could be one of the more expensive stages of the process. 23 The computer forensics budget at this stage could be based upon either the number of forensically copied hard drives that are prepared and/or on per gigabyte (GB 24 ) or larger basis.

562 Hyattye Simmons D. Searching and Analyzing Electronically Stored Information for Production and Privilege Protection On average, 7.5 GB of electronic files (i.e. a combination of email, word processing, electronic spreadsheets, and text files) will produce approximately 2,429,000 pages if printed. 25 Assuming it takes a skilled attorney using available technology an average rate of one hour to [individually] review [and analyze] 100 [pages], it would take him or her 5 years to review [the first] 1 million [pages] working 2,000 hours per year. 26 As such, the culling and vetting process of E-Discovery can be the most expensive stage. This is also the stage at which the computer forensic expert, working with your IT department or your third-party E-Discovery provider, can be the most useful in reducing costs 27. Some of the most effective ways to reduce costs are through the use of search technologies, such as keyword searching, concept searching, and sampling. 28 The goal is to reduce all types of E-Discovery costs by reducing the time it takes to search, analyze, and produce the relevant, non-privileged ESI. IV. Conclusion In light of potential high costs, planning and the strategic use of computer forensic professionals should always be considered as a supplement to the E-Discovery process. 29 Trained and experienced computer forensic professionals, regardless of whether they are in-house or outside consultants, can provide comprehensive value to the collection, preservation, and production efforts. 30 Hyattye Simmons, General Counsel, Dallas Area Rapid Transit provides legal advice to the Board of Directors, President/Executive Director of the agency, agency attorneys, outside counsel, agency vice presidents, and other agency officers on all areas of law, while overseeing and managing the Legal Department. APPENDIX In Pursuit of FRCP 1: Creative Approaches to Cutting and Shifting the Costs of Discovery of Electronically Stored Information Mia Mazza, Emmalena K. Quesada, and Ashley L. Sternberg Cite as: Mia Mazza, Emmalena K. Quesada, & Ashley L. Stenberg, In Pursuit of FRCP 1: Creative Approaches to Cutting and Shifting Costs of Discovery of Electronically Stored Information, 13 RICH. J.L. & TECH. 11 (2007), http://law.richmond.edu/jolt/v13i3/article11.pdf.

Computer Forensics 563 Notes 1 The Columbia World of Quotations. New York: Columbia University Press, 1996. www.bartleby.com/66/, http://www. bartleby.com/66/11/18611.html 2 Regardless of whether you are a defendant or plaintiff, the cost of handling e-discovery can cost millions of dollars. See Mia Mazza, Emmalena K. Quesada, & Ashley L. Stenberg, In Pursuit of FRCP 1: Creative Approaches to Cutting and Shifting Costs of Discovery of Electronically Stored Information, 13 Rich. J.L. & Tech. 11, at [6] (2007), (Reprinted with permission in the Appendix). Therefore, you must ask yourself the following question: Does spending money on computer forensics make sense in a lawsuit against a Texas governmental entity, especially in situations where a claim may be either barred or have a cap on damages? 3 Computer forensics involves the scientific study (preservation, collection, analysis, etc) of computers and electronic data in a manner that is consistent with the principles of the rules of evidence and rules of procedure. See Michael Sheetz, Computer Forensics: An Essential Guide for Accountants, Lawyers, and Managers, p. 2, 25 (Wiley & Sons, Inc., 2007). Therefore, the person who performs computer forensics is often highly trained in both law and computer science. See Robert C. Newman, Computer Forensics: Evidence Collection and Management, pp. 130-135; pp. 325 338 (Taylor & Francis Group, 2007). In Texas, this person may also be required to have a private investigator s license. See Tex. Occ. Code Ann. 1702.002 (18), 1702.104(2), together with Tex. Gov T. Code Ann. 311.005(2); Tex. Occ. Code Ann. 1702.002 (16), 1702.321, 1702.322. For a general guideline for hiring an E-Discovery or computer forensic expert, See Sharon D. Nelson, Bruce A. Olson, John W. Simek, The Electonic Evidence and Discovery Handbook: Forms, Checklists, and Guidelines, pp. 32 39 (American Bar Association, 2006). 4 The 4th Amendment to the United States Constitution states, in pertinent part, that the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated Thus, in the area of collection of electronic data, governmental entities must be prepared to show that the person did not have a reasonable expectation of privacy in the data. It is this author s opinion that the best way to do this is with an Information Technology policy (acknowledged by the user) that all data stored on agency equipment is the property of the governmental entity. Additionally, there may be other federal and state laws that could affect the collection and production of a person s electronic data by a governmental entity. See Robert C. Newman, Computer Forensics: Evidence Collection and Management, pp. 20-23; pp. 30 36 (Taylor & Francis Group, 2007). Without IT policies, organizations risk exposure to litigation by both current and former associates. Id. at 38. 5 See Mia Mazza, Emmalena K. Quesada, & Ashley L. Stenberg, In Pursuit of FRCP 1: Creative Rich. J.L. & Tech. 11, at [2] (2007), 6 Robert C. Newman, Computer Forensics: Evidence Collection and Management, p. 346 (Taylor & Francis Group, 2007). 7 Id. at p. 16. 8 See Michael Sheetz, Computer Forensics: An Essential Guide for Accountants, Lawyers, and Managers, p. 2, 25 (Wiley & Sons, Inc., 2007). 9 Rees Morrison, Law Department Management: Calculating your Total Cost of Electronic Discovery (TCeD), posted on April 12, 2006 in Controlling Legal Costs Permalink, http://lawdepartmentmanagement. typepad.com/law_department_management/2006/04/calculating_you.html 10 Id. 11 Id. 12 Id. 13 Id. [It is this author s opinion that a calculation of this last stated cost should not include a governmental in-house legal department that handles the agency s litigation, since if this department were not working on this particular litigation it would have been working on some other litigation]. 14 Remember, planning is good, but a fixed plan is not. Thus, the key to success is to adjust the plan of action according to the facts of the case. 15 Electronically stored information.

564 Hyattye Simmons 16 Plato (c. 427 347 B.C.), Greek philosopher. The Columbia World of Quotations. New York: Columbia University Press, 1996. www.bartleby.com/66/, http://www.bartleby.com/66/8/44508.html 17 Another decision to be made by the attorney. 18 See Mia Mazza, Emmalena K. Quesada, & Ashley L. Stenberg, In Pursuit of FRCP 1: Creative RICH. J.L. & TECH. 11, at [132] (2007), (Reprinted with permission in the Appendix). 19 Id. at [126], [127]. 20 Data stored on hard drive as compared with optical disc or backup tape. 21 See generally, ROBERT C. NEWMAN, COMPUTER FORENSICS: EVIDENCE COLLECTION AND MANAGEMENT, p. 8 (Taylor & Francis Group, 2007). 22 Again this could be an internal person or external person provided they have the training, and if required, a license. See TEX. OCC. CODE ANN. 1702.002 (18), 1702.104(2), together with TEX. GOV T. CODE ANN. 311.005(2); TEX. OCC. CODE ANN. 1702.002 (16), 1702.321, 1702.322. 23 See Mia Mazza, Emmalena K. Quesada, & Ashley L. Stenberg, In Pursuit of FRCP 1: Creative RICH. J.L. & TECH. 11, at [5] (2007), (Reprinted with permission in the Appendix). 24 A gigabyte is approximately 1000 megabytes. 25 Calculations derived from: Predicting and Taming Electronic Discovery Costs: Getting Granular, West LegalEdcenter - West Group, 2007 and How May Pages In a Gig?; LexisNexis Applied Discovery 2004. 26 See Mia Mazza, Emmalena K. Quesada, & Ashley L. Stenberg, In Pursuit of FRCP 1: Creative RICH. J.L. & TECH. 11, at [6] (2007), (Reprinted with permission in the Appendix). 27 For example, in the case of searching forensic copies of personal computer hard drives, the computer forensic expert can help reduce costs by reducing (between 30% - 60%) the volume of gigabytes to be searched by comparing all files on the drives against a list of known system files compiled by the National Institute for Standards and Technology, and then forensically extracting all files not on this list from these hard drives. 28 See Mia Mazza, Emmalena K. Quesada, & Ashley L. Stenberg, In Pursuit of FRCP 1: Creative RICH. J.L. & TECH. 11. at [16] [89]. The author wishes to thank the Richmond Journal of Law & Technology for granting permission to reprint this article. (During the use of these various search technologies, it is assumed that the proper steps have been taken not to alter, damage, or destroy digital or electronic data.) 29 American Law Institute - American Bar Association Continuing Legal Education, ALI-ABA Course of Study, March 22-23, 2007, Trial Evidence in the Federal Courts: Problems and Solutions Cosponsored by the Philip D. Reed Chair, Fordham Law School, with the cooperation of the ABA Section of Litigation, THROUGH THE LOOKING GLASS: IDENTIFYING AND AVOIDING RISKS UNDER THE NEW FEDERAL RULES OF CIVIL PROCEDURE, Samuel H. Solomon; SM078 ALI-ABA 303, 305 (2007). 30 Id.