The eMag Link Monthly Articles
January Edition
View previous articlesSearching Back in Time: Non-native restoration lets researchers recover records from long-dead systems*
In virtually all cases, the outcome of legal proceedings hinges upon discovering "who knew what and when." Electronic discovery (or e-discovery) often holds the key, by uncovering documents and files that were stored digitally - and subsequently tracing when they were created, to whom they were sent, who viewed and altered them, and what actions were taken as a result.
Although paper records still play a significant role, many larger companies archive and back up their documents electronically - which adds complexity to the discovery process. Individuals charged with e-discovery must be expert in how to search, sort and salvage the volumes of digital records contained in storage media. And they must be extremely cautious to ensure that, during their search efforts, none of the electronic data is altered or destroyed - neither inadvertently or purposely.
Current approaches
Two techniques currently dominate the process of e-discovery:
- Native restoration of data, which requires that the precise combination of hardware and software originally used to save the data must be available for discovery activities;
- Non-native restoration, which eliminates the need for the originating technology, and simplifies access to the wide range of hardware and software formats that may have been used by the party being asked to produce documents during litigation.
When initiating native restoration, a company is forced to recreate every technological environment in which it worked, spanning the entire period that the discovery process encompasses. With technology upgrades and new applications being brought to the market at a dizzying pace, few companies retain the systems they relied upon only a few years ago - much less anything older.
The whirlwind evolution of technology gives rise to countless e-discovery headaches. What happens if a company cannot find the operating software disks used to save data ten years earlier? Or if they are able to find the software, but it won't operate on the hardware they have in the office at the present time? What happens if litigation involves a company that went out of business five years earlier - and neither the hardware nor the software it used to back up its records can be traced?
Even when the native environment can be recreated, these traditional methods of e-discovery take a great deal of time. The process might be delayed for a variety of reasons - beginning with difficulties in identifying the original software and recreating the hardware configuration that supported it. Other hindrances include changes that might have been made in a company's server or domain names over time, for instance, making relevant data harder to recognize and retrieve.
Overcoming barriers
Non-native restoration addresses each of these issues. First, e-discovery vendors develop specialized software enabling them to interpret the data structure of backup software formats. This allows them to restore hundreds of different format versions without the originating software. Secondly, these vendors maintain an inventory of older and obsolete hardware components so they can gain access to the physical tape containing the data that is to be restored.
Non-native data restoration dramatically decreases expenses by making e-discovery faster and simpler. Direct costs alone - the investment required to purchase outmoded hardware or software to gain access to older electronic data, for instance - are prohibitive.
Plus, the longer it takes to complete an e-discovery project, the higher the price tag. Restoring data natively is a lengthy process - it simply takes time to sort through various software applications and systems, as well as to verify that material on backup systems was not altered. But with non-native data restoration, information can be retrieved regardless of the format in which it is saved - and without having to recreate the specific combination of hardware and software that was used at the time the material was preserved.
Challenges
Of course, non-native restoration has some difficulties. Several significant obstacles relating to hardware alone must be overcome, including:
- The physical media used to back up the data (such as magnetic tape) must be matched to the correct type and version of hardware. This is often a daunting task, since there may be scores of hardware configurations and various generations of specific technologies.
- Once the proper hardware is identified, it must be in working order so it is actually able to obtain the data saved to the storage media. This can be problematic, since older drives from the last few decades wear out and spare parts are increasingly difficult to locate.
- To ensure they can respond to requests for the production of data, the best non-native restoration vendors must maintain a redundant supply of functional drives, so they are able to provide hardware that supports the physical media in question.
Decoding older software
After operational hardware is identified and matched to the physical media, a second layer of challenges must be addressed: ensuring that correlating software can be found and installed to extract the stored information. The format in which backup records are stored can be compared to spoken and written languages, which change and develop over time to reflect the evolution of the society that uses them. Scholars may be exposed to literature written in ancient dialects of modern languages - Ionic or Doric Greek, for instance. When reading historic works, these students are exposed to the "native" language of that era. Yet those dialects - which can be compared to the typical progression of software releases - have become obsolete over time and are useless for modern communications. The same is true with older version or releases of backup formats - they cannot be understood by the newer versions of a vendor's software.
But, archaic or not, the messages contained in languages that have fallen into misuse are not lost. Linguists can study the ancient structures or seek out other scholars to assist them in translation. These colleagues have amassed, over time, the knowledge that allows them to "decode" the dead or alien language - so that they can retrieve the original content and meaning.
Likewise, restoration experts have written software that can access older software applications or programs and restore these formats non-natively, without re-creating the original backup environment to read physical media.
These software applications provide a second benefit, in addition to "translating" outdated communications: they provide verification that what was read from the backup media reflects only what was originally written to the disk, and that no modification took place during restoration. This allows the producing party to fulfill legal and forensic requirements stating that the data be restored with the original date and time indicators exhibited when it was backed up - providing true audit accountability.
Benefits of non-native restoration
Consider the following example: Eight years ago, Company A was purchased by Company B. In the weeks following the sale, significant numbers of employees were either let go or resigned - with about 12 managers quickly being hired by a competitor. Several months after the transaction, Company B filed lawsuit against the competitor and a number of the former Company A employees, charging that non-compete agreements had been violated. As is often the case, the competitor and the individual employees filed various counter suits, and years of litigation followed.
During the lengthy discovery process, all parties were required to produce a stunning number of paper and electronic records from a overwhelming number of sources, including hard drives, servers and backup tapes from Company A, Company B and the competitor; individual PCs and laptops used by employees of all three firms; all personal and home computers used by the employees who left Company B (even those not ultimately hired by the competitor); corporate e-mail systems at each of the three companies; and commercial e-mail and messaging systems all the individuals used for personal communications. The challenges in this e-discovery process were compounded by the fact that several of the individuals relied upon out-of date technology for personal use, had bought new computers and discarded the old equipment, and did not maintain backup files.
The collection of all this data would have been nearly impossible - and producing it would have been prohibitively expensive - if native restoration methods had been used. But with non-native e-discovery, relevant data was identified and retrieved in a matter of weeks, advancing the case more quickly and minimizing the costs associated with that stage of litigation.
As more and more data is being archived to electronic media, litigators will continue to be faced with the challenges inherent in e-discovery. They will need to consider options that help abbreviate the amount of time invested in producing documents, as well as reduce the costs associated with all aspects of the process. The technological advances represented by non-native restoration of electronic data address both issues, and offer a viable alternative for recovering critical evidence in an efficient and cost-effective manner.
*The following article was authored by Trey Wilkins of eMag Solutions. © 2006 ALM Properties Inc. All rights reserved. This article is reprinted with permission from Legal Times (1-800-933-4317 - LTsubscribe@alm.com - www.legaltimes.com).