Getting More Data for Less*
How Non-Native Data Recovery is Making EDD a More Affordable Option
Businesses often operate like pack rats, hanging on to every piece of paper that was ever generated during their long and drawn-out histories. Year after year, the boxes continue to pile up, with the tacit understanding that it is better to keep everything than lose something that will be needed down the road. As we move into the electronic age, the same principle still applies-the more you keep, the less the risk. And with a plentiful supply of inexpensive storage options and increasing compliance demands resulting from legislation like SEC requirements, HIPAA and Sarbanes-Oxley, electronic data is being stored at an ever-increasing rate.
It is quickly becoming apparent, however, that as companies continue to retain tremendous amounts of information, few have the ability to properly manage this data and provide access to it when it is needed. For attorneys in particular, this presents a challenge, because even the most compelling evidence is meaningless if it is not readily accessible. While most organizations believe they can quickly access their data, they often find at a particularly inconvenient-and potentially expensive-time that this is not the case. Failure to be responsive to requests for data can lead to fines, economic sanctions and litigation, and this, in part, has helped to fuel the growth of EDD in the industry.
When it comes to electronic data discovery (EDD), most attorneys agree on the following two points-it's a major asset in collecting, analyzing and producing evidence and it's too expensive. But recent technology advancements, specifically those related to non-native data restoration or the restoration of data outside of its originating application, are proving the latter point to be untrue. Non-native data restoration from storage media has emerged as a timely and cost-effective way to leverage EDD. By eliminating the need for the originating software, firms can restore data even if the company is no longer in existence, if the owner of the data cannot find the software disks or if the software will not operate on today's modern computers.
For example, the majority of discoverable information produced by companies today is found in email or other messaging formats. Whether part of the message content or in an attachment, the recreation of a chain of events or knowledge trail usually includes an examination of email. Even though there are only a handful of email applications in use today, this was not always the case. Until just a few years ago, there were many more email systems in use, making the recovery of this information through traditional EDD methods an insurmountable task. With the advent of non-native recovery, data can now be restored regardless of the format in which it is stored without having to recreate the native environment, or the combination of hardware and software that was utilized at the time the data was preserved.
Atlanta-based eMag Solutions is one example of a vendor that maintains non-native support for hundreds of backup software formats, with similar capabilities for various e-mail systems, making this process much easier than it once was. At a time when the majority of discoverable information produced by companies is found electronically, this new and innovative method helps firms achieve more comprehensive results than traditional EDD methods at a fraction of the cost.
Native vs. non-native recovery
All too often lawyers experience the typical witness conflict or "he-said, she-said"
scenario. Let's take an example where a one party is accused of sending an email containing
relevant evidence to another party at her work email address. If he denies sending the email
and she claims to have both received it at her work account and forwarded it to a co-worker
at her work email address, many attorneys would think that restoring the data from all three
hard drives be the fastest, most cost-effective way of proving the email did not contain the
said information.
In reality, however, it is actually faster and less expensive to use non-native methods to restore the backup of the office email system and extract all three email boxes. By doing so, the firm can show not only what he sent her, but also what she received at her work email account and what she forwarded to her colleague.
In these situations, attorneys usually resort to the forensic imaging of a hard drive because it is the most common method of data recovery. With this process, all files are restored to the computer hard drive by recreating the originating applications. Even if only a small subset of data is needed, attorneys tend to gravitate to this method because law, by nature, is a risk-averse profession, and sticking with the most common method of data recovery is generally a safe bet.
The non-native restoration of data, however, is almost always faster and less expensive. Why? Traditional methods are much slower than non-native recovery and often delayed by challenges such as inconsistent server/domain names, tape drive corrections and hard-to-find originating software. Plus, restoring a hard drive brings a host of issues along with it, such as the possibility that data was altered or deleted before it was turned over to be examined. The costs of recreating the native environment can add up as well, especially with the expenses related to purchasing, installing and configuring hardware and software. Add to that the fact that it is virtually impossible to recreate a native environment because no two software installations are the same, and the result is a costly and complex method for recovering data.
With non-native data restoration, these issues are irrelevant. The result is a more accurate, efficient and cost-effective way to gather data. In fact, while the forensic recovery of a hard drive can cost upwards of $2,500, the non-native recovery of the three email boxes in the earlier example might run less than $1,000 and produce more accurate and, potentially indisputable, evidence.
Bringing the past forward
In a recent intellectual property case, an employee was accused of sharing trade secrets with a new employer. In order to prove that this was in fact the case, the email systems of both companies had to be restored in order to recover what the employee was working on before he left the first company, who knew about it, what he worked on at the second company and who he talked to about it. In order to recover this information, emails had to be recovered from a variety of email systems, many of them out-of-date and no longer in use. This task could have been prohibitively expensive if it was restored through traditional methods, but by using non-native recovery methods, EDD became a viable and effective method of retrieving the required data.
After two weeks, all of the relevant data was recovered, which is significantly faster than it would have been restored otherwise. In addition, this client also continued to save money long after the information was recovered by storing the data in an online repository that allowed users to query the information through a search engine interface. Taking advantage of this electronic storage method gave users the ability to quickly cull data using keywords to find the information they needed before it was converted to the appropriate format. Online repositories also facilitate the selective deletion of non-essential data and duplicate files, resulting in lower storage costs and significant time savings.
With this technology at their disposal, law firms can quickly and efficiently search and sort millions of documents - a task that used to take months by hand and required endless hours of manpower. As corporations and law firms become more geographically dispersed, this feature will become even more valuable with multiple users needing access to data from various locations around the world.
A better way to restore data
In today's litigious society, companies face hundreds of lawsuits a year. Whether it's a sexual harassment case or an SEC investigation, the requirements are the same-to determine who knew what, what they did with the information and when they did it. To meet the demands of these cases, companies need access to critical evidence stored in electronic data without the frustration and high price tags that often come with traditional EDD. Luckily, there is now more than one way to restore electronic data.
By eliminating the need to recreate the native operating environment, including back up software, operating systems, patches and passwords, non-native data recovery makes the process of recreating history much simpler. For years, most attorneys were correct in thinking that EDD was too expensive. Until now, cost containment has been the biggest obstacle facing the widespread adoption of EDD in the legal field. But with technology advances making data restoration more affordable than ever, it is time for the legal industry to reevaluate how it gathers and presents evidence. For corporate and outside counsel looking to recover critical evidence at a fair and reasonable price, non-native restoration of electronic data is making EDD a more viable option.
*The following article was written by Shawn Strickler, eMag's Director of Forensic Solutions, and it originally appeared in Law Journal Newsletters' e-Discovery Law & Strategy newsletter www.ljnonline.com/alm?edisc.