Upload
j-david-morris
View
338
Download
3
Tags:
Embed Size (px)
DESCRIPTION
Citation preview
Kazeon Confidential - DO NOT DISTRIBUTE
Winning in Court: Authenticity and Admissibility of Electronic Data
Kazeon Confidential - DO NOT DISTRIBUTE
Agenda for Today
Key Challenges of eDiscovery Today Questions for Consideration Customer Requirements Overview of Kazeon Solution Q&A
2
Kazeon Confidential - DO NOT DISTRIBUTE
Only 20% of companies are
prepared for eDiscovery
issues
70% of Discovery
costs are in attorney review
AttorneyReview
80% of ESI resides on laptops, file
shares and email systems
DigitalProliferation
Average cost of single
eDiscovery case is $1.5M
Cost
Fines or Jail Time for
Corporate Officers
$ Millions in fines for
inadequate or incomplete
data
Challenges of eDiscovery
++
++
Sources: Taneja Group, Gartner Group, ESG, Ponemon Institute
EscalatingCosts
IncreasingScrutiny and Risk
Preparation CriminalActions
Fines
Kazeon Confidential - DO NOT DISTRIBUTE
eDiscovery: Are You Prepared?
U.S. Federal Rules of Civil Procedure (FRCP) specify that electronically stored information (ESI) is discoverable– Ensures no surprises in court, everyone is prepared and each
party knows what the other has– Pretrial resolution strongly encouraged; both parties can evaluate
strength of other’s case
However…– 63% have been asked to perform legal discovery
request (increase of 57% in 1 year)– Only 47% say their “somewhat comfortable”
while 10% are not at all comfortable– Less than 20% of companies claim to be
prepared for eDiscovery Issues– Average cost of eDiscovery case is $1.5M
4
Kazeon Confidential - DO NOT DISTRIBUTE
FRCP 26 - Discovery
December 2006 Update– Handles discovery of electronic documents– Rules 16, 26, 33, 34, 37 and 45
26(a) Initial Discovery– Initial discovery of ESI data sources and making available to all parties
26(f) Meet and Confer / Discovery Plan– Meet and Confer Session – understand each other’s defenses, discoverable
material, develop discovery plan, seek settlement– Discovery Plan: what information each party will make available, in what form,
when and any privileged statement– Rule 16 scheduling conference; parties get organized to provide for efficient
process and facilitate settlement
5
Kazeon Confidential - DO NOT DISTRIBUTE
FRCP 26(f) - Timeline
Meet and Confer Session– As soon as practical after lodging suite (usually within 30-90 days)– At least 21 days before Rule 16 scheduling conference
Deliver initial disclosures to other party within 14 days of Rule 26(f) Meet and Confer session
Submit discovery plan to court within 14 days of Rule 26(f) Meet and Confer Session
Hold Rule 16 scheduling conference with 120 days of lodging suit
6
Kazeon Confidential - DO NOT DISTRIBUTE
Authenticity and Forensics
Historical Approach to Forensics Image copy of hard drives or data stored on servers High cost and big data management problems
– Average Cost $2,000 - $3,500 per drive– Duplication of data in down-stream review
7
Experts urge caution in using Forensic Imaging for Civil Cases A “forensically sound” copy of a file preserves details
of its chain of custody while accompanying metadata A copy/move activity records information about the
file, such as when it was written, ownership, times it had been “touched”, location
Validation that it is exact copy
Kazeon Confidential - DO NOT DISTRIBUTE
Advise from Experts
8
http://www.thesedonaconference.org/content/miscFiles/TSC_PRINCP_2nd_ed_607.pdf
…making forensic image backups of computers is only the first step of an expensive, complex, and difficult process of data analysis that can divert litigation into side issues and satellite disputes involving the interpretation of potentially ambiguous forensic evidence
…it should not be required unless exceptional circumstances warrant the extraordinary cost and burden
…protective measures that take into account privacy rights, attorney-client privilege, and the need to separate out and ignore non-relevant information
Kazeon Confidential - DO NOT DISTRIBUTE
Key Questions for Consideration
Do I know where all potentially responsive data resides and can I quickly find it?
How do I know if what is collected is complete and accurate?
How can I ensure that information is not altered to avoid spoliation?
How to cull down only relevant data and minimize legal review time and cost?
How do I ensure what I submit as responsive is authentic and how do I prove it?
9
Kazeon Confidential - DO NOT DISTRIBUTE
What Customers are Asking For…
Business Requirements– Efficiency
• Reduce cost with more efficient in-house data collection, analysis and preservation
– Speed of Resolution• Improve analysis and speed to
resolution with faster preservation and processing
– Downstream Savings• Create downstream savings by
sending single copy and only relevant content for legal review
– Reduced Risk• Improve ability to implement and
manage litigation holds on ESI at data source with complete and accurate results
Technical Requirements– Automation
• Reduce manual eDiscovery process with transparency to operations
– Defensible and Auditable• Defensible, repeatable and auditable process
– Control• Gain control of unmanaged and potentially
responsive data in a secured infrastructure
– Enterprise-Wide Coverage• Enterprise-wide coverage of ESI and Data Map
with single View
10
Kazeon Confidential - DO NOT DISTRIBUTE
Kazeon Solution for eDiscovery
Enables Corporate Legal and IT teams to:– Identify, classify, manage and preserve
information according to business value and risk
– Respond rapidly and efficiently to litigation, investigation, or compliance requirements
– Minimize cost of electronic discovery while mitigation organization risk
– Enable forensically-sound, defensible, auditable and complete discovery
11
Kazeon Confidential - DO NOT DISTRIBUTE
Electronic Discovery Reference Model (EDRM)
12
Kazeon provides solutions for both Proactive and Reactive eDiscovery
Information Management
VOLUME
Source: EDRM.NET
Proactive eDiscovery
Identification
Preservation
Collection
Processing
Review
Analysis
Production Presentation
RELEVANCE
Reactive eDiscovery
Kazeon Confidential - DO NOT DISTRIBUTE
Kazeon Proactive eDiscovery
13
Information Management
VOLUME
Source: EDRM.NET
Proactive eDiscovery
Identification
Preservation
Collection
Processing
Review
Analysis
Production Presentation
RELEVANCE
Reactive eDiscovery
Information Discovery
• Visibility of all information assets
• Data map of enterprise data• Custodian maps• Federated view across
enterprise
Indexing and Classification
• Automated indexing and classification
• Auto or user-defined tagging• Classification based on risk
and value• Associated appropriate
policies (retention, legal hold, disposition, encryption)
Proactive Management
• Manage and monitor information assets
• Archive and migrate data into ECM, Email Archive and Records Mgmt
• Modify policies as appropriate
Policy Enforcement• Apply and enforce policies
(retention, disposition, etc.)• Create auditable and
defensible process
Kazeon Proactive eDiscovery
Kazeon Confidential - DO NOT DISTRIBUTE
Kazeon Reactive eDiscovery
14
Identification
Preservation
Collection
Processing
Review
Analysis
VOLUME
Source: EDRM.NET
RELEVANCE
Information Management Production Presentation
Proactive eDiscovery Reactive eDiscovery
Identification• Comprehensive data
maps• Custodian reports• Enterprise coverage
Targeted Collection
• Custodian,mailbox, laptop and file shrs
• Keyword, date range based collection
• Collected data copied and preserved
Preservation• In-place legal hold
and release• Legal hold on
collected data• Support for hold
repositories (Enterprise Vault, NetApp SnapLock)
In-House Processing
• Indexing collected ESI
• De-duplication, system file culling
• Exception reporting
Analysis• Early case
assessment• Email threading• Keyword, date range,
boolean search
Review• Native or text review• Document coding• Export (native format,
metadata, content hash)
Kazeon Reactive eDiscovery
Kazeon = Repeatable Business Process with Standardized Tools
Kazeon Confidential - DO NOT DISTRIBUTE
Kazeon Legal Discovery Solution
As part of Kazeon’s eDiscovery portfolio, the Legal Discovery Solution automates the discovery, classification, searching, reporting and ability to take action on potentially responsive information scattered across the network
KAZEON INFORMATION ACCESS PLATFORM
TE
CH
NO
LO
GY
WO
RK
FL
OW
Search Classify Act
Scan Network, desktop, file shares, remote offices, endpoint laptops
Hundreds of file formats Create data map
Single-Step Collection from all locations
Content-based collection In-place Legal Hold or at
Target
Advanced Search Boolean, Wildcard,
fuzzy, proximity, range, boosting, grouping
Combine text & metadata attributes
Analyze summary and drilldown views
Predefined and customizable reports
Report by date, content, custodian or user defined fields
Quarantine, move, copy, protect, delete, encrypt
Export to industry standard formats
Monitor & ongoing Auditing
Legal Discovery Solution
Discover
Kazeon Confidential - DO NOT DISTRIBUTE
Basic metadata or full-text scans
Automated scan/rescan for incremental updates (proactive)
“One-step” process for targeted collection (reactive)
Transparent to end users
16
Discovery of ESI Sources
Proactive and Reactive discovery of ESI Sources
Kazeon Confidential - DO NOT DISTRIBUTE
Discovery of ESI Sources
Supports all file systems, group shares, desktop workstations, remote laptops, email systems and document and backup archives
Minimal impact on operational performance (out-of-band)
Supports over 400 file and document formats
VPN
Automatically discovers and scans network devices for further review and analysis
Server or Appliance
Enterpr
ise
Applica
tions
Kazeon Confidential - DO NOT DISTRIBUTE
Laptop/Desktop Collection
Agent-less scanning for laptops and desktops Scan profiles exclude windows binaries and
applications Checkpoint & auto-restart for efficient scanning Supports dynamic connects and disconnects Unique preview capability to view file text when
laptop is disconnected from the network
Remote Office Edition
LAN or WAN ConnectionLaptops and Desktops
Kazeon Cluster
Eliminate manual desktop collection and over-collection
Kazeon Confidential - DO NOT DISTRIBUTE
How Collection Works…
19
1 Discover or Target specific sources 2 Initiate “Single-Step”
Collection & designate Target
3 Refine Search Criteria for greater granularity
Source
Target
Exclude Windows Files, Directories, etc.
Data Range
Key Words
Email Sender
4 Create and View Discovery Report
Name Report
Select Columns for Summary and Detail Reports
Kazeon Confidential - DO NOT DISTRIBUTE
Additional Search Capabilities
Advanced search includes:– Keyword (e.g. confidential, financial
projections, financial projections)– Phrase (e.g. “guaranteed revenue return”)– Boolean (e.g. word1 AND word2) OR (my
phrase) – word3)– Wildcard (e.g. filename: b?g)– Fuzzy (e.g. roam~.8)– Proximity (e.g. word1, word2 ~10)– Range (e.g. mtime: [01/01/2008 TO
02/22/08]– Boosting (e.g. word1^5 word2)– Fielded (e.g. owner: john smith)
Federated search and reporting for large environments
Email and user-defined templates
Advanced Search using Google-like search engine with full integration with authentication infrastructure
Federated Search and Reporting
Kazeon Confidential - DO NOT DISTRIBUTE
FRCP 26(a) and 26(f)
26(a) Initial Discovery– Initial discovery of ESI data sources
and making available to all parties
26(f) Meet and Confer– understand each other’s defenses,
discoverable material, develop discovery plan, seek settlement
– Discovery Plan: what information each party will make available, in what form, when and any privileged statement
– Rule 16 scheduling conference; parties get organized to provide for efficient process and facilitate settlement
21
Collection and Culling to create relevant Data Map for quick preparation in initial Discovery and preparation for Meet and Confer
Case555 - Data Map by Custodian
ESI Data Map - By Type or Group
Kazeon Confidential - DO NOT DISTRIBUTE
In-House Processing
Processing of ESI to cull-down to relevant results
Auto-coding to cull-down ESI– Attorney-Client privileged documents– Personal e-mails– Company Announcements– Rule based classification and re-
classification– Document preview– Sophisticated tagging identifies
“responsive, privileged…” docs– De-duplication
Composite object break-downs– .PST files down to individual emails
and attachments
– .ZIP multiple file archives – Early Case Assessment based on
Collection– Any exceptions found during the
culling process are reported for appropriate action
Kazeon Confidential - DO NOT DISTRIBUTE
Preservation
Copy culled ESI to hold repositories (Enterprise Vault, NetApp SnapLock, secured File Shares)
Removal of Duplications Preservation of Source
Hierarchy Preservation of Timestamps
(creation, access, modified times, etc)
Something about authenticity of copied data (hash values?)
After files have been culled, the next step is to take action on the results to ensure preservation of relevant data and protect against spoliation
Kazeon Confidential - DO NOT DISTRIBUTE
Legal Holds
In-place Legal Hold or at Target Forensically-sound copies maintain
chain of custody Preserved file attributes, metadata,
hierarchy, revisions and timestamps Preservation of original file-path folder
structure (source) Integrates with Archive Repositories
such as Symantec Enterprise Vault Continuous protection by automatically
scanning and preserving new files
After files have been culled, the next step is to take action on the results to ensure preservation of relevant data and protect against spoliation
Secondary File Share
Compliant Storage
Compliance Data Reference Data (NetApp NearStore)
Enterprise Vault, NetApp SnapLock
COPY to secondary storage or to repository
Kazeon Confidential - DO NOT DISTRIBUTE
Tagging Information
Customizable Tags Applied to Relevant Data;
– Responsive– Privileged– Reviewed– On Legal Hold– User-defined
Quickly identifying and tag privileged information for Meet and Confer / Discovery Plan – Privileged Statement
After files have been culled, the next step is to take action on the results to ensure preservation of relevant data and protect against spoliation
Tagged as: Responsive
Kazeon Confidential - DO NOT DISTRIBUTE
Authenticity and Auditing
Standard Audit Reports System Auditing
– All user and system activity with information about who did what when
– User login – OS startup & shutdown, cluster
startup and shutdown, reboots, and AD configuration changes
Data Auditing – Search Query and Report – File history by Source (history of
actions on a file/email/attachment)• Who, when, what, how, from, to,
input, output• Object path, Owner, Timestamps,
Size
Full Auditing of System and Data Activity and reporting to Rules of Evidence
Kazeon Confidential - DO NOT DISTRIBUTE
Content Analytics Reports
Analyze summary and drill-down views Analysis by date, content, custodian or user defined fields Export to industry standard formats (XML, CSV, PST, ZIP)
40+ standard reports or easily create custom reports
Kazeon Confidential - DO NOT DISTRIBUTE
Analytics: Matter Management
Analyze by Case, Legal Exception or Type of Document Take Action directly from Search or Reports
40+ standard profiles or easily generated custom profiles
Kazeon Confidential - DO NOT DISTRIBUTE29
Review Analytics
Kazeon Confidential - DO NOT DISTRIBUTE30
Review and Production
Produce de-duplicated, culled and pre-reviewed data for further legal review Export search results to native format or CSV, download to PST or ZIP Kazeon Hold Location used by downstream legal review tool for further legal
review and production (Attenex, Summation, Concordance)
Select specific files or entire Result Set for Download to ZIP. Emails export to PST format
Export selected search / report rows to XML or CSV format
Kazeon Confidential - DO NOT DISTRIBUTE
Complete Enterprise Coverage
Enterprise-wide deployment including data center, remote offices and mobile users Supports all file systems, group shares, desktop workstations, remote laptops, email
systems and document, email and backup archives Minimal impact on operational performance (out-of-band and agent-less)
ExchangeServers
EmailArchives
DocumentArchives
Encrypted Storage
File SharesBackupArchives
Desktops, Remote Offices and Laptops
PST
Enterpr
ise
Applica
tions
Remote Offices
WAN
Desktops, File Servers
Data Centers
Information Server (Software-Only or
Appliance)
No IT Personnel
IT Personnel
Mobile UsersInternet
Kazeon Confidential - DO NOT DISTRIBUTE
Federated Enterprise Deployment over WAN
Enterpr
ise
Applica
tions
Regional HQData: 50+ TB
WAN
File Shares, Desktop, Laptop, Email
Corporate HQData: >100 TB
Remote OfficeData: <1 TB
WAN
Remote OfficeData: <1 TB
Kazeon Server(Software Only)
File Shares, Desktop, Laptop,
EmailFile Shares, Desktop, Laptop,
Kazeon Server(Software Only)
Kazeon Cluster
Kazeon Cluster
File Shares, Desktop, Laptop, Email
Federated Enterprise Deployment
Typical Data Landscape 1 Corporate HQ: >100 TB 1-2 Regional HQ: 50+ TB Remote Offices: <1 TB Each
Deployment Summary Kazeon IS1200 Servers in
Corporate and Regional HQ Kazeon Software Deployed
and manages Remote Offices
Federated View of Information Kazeon Information Center at Corporate HQ provides single view
of enterprise-wide data Unified (federated) view of Search across clusters Unified (federated) Reporting from one interface (aggregate results
by policy rule, etc)
Information Center
Only search results are sent to Information Center reducing impact on network
Kazeon Confidential - DO NOT DISTRIBUTE
Kazeon’s Portfolio for Legal Discovery
Intelligently search, classify and act on electronically stored information – complimentary to existing data protection products
33
1. Kazeon Information Access Platform software Core enterprise software for file and email discovery, classification,
indexing and workflow actions
2. Kazeon Information Server Product for solving customer business challenges optimized to address
Information Security & Privacy challenges
3. Kazeon Information Center Product for creation of federation groups (groups of clusters), Unified
search and unified reports across federation groups
4. Exchange and Enterprise Vault Connectors Search and classify email from exchange Integration with Symantec Enterprise Vault
Kazeon Confidential - DO NOT DISTRIBUTE
Key Capabilities and Benefits
Key Business Benefits– Identify, classify, manage and preserve
information according to business value and risk– Respond rapidly and efficiently to litigation,
investigation, or compliance requirements– Minimize cost of electronic discovery while
mitigation organization risk– Enable forensically-sound, defensible, auditable
and complete discovery
Technical Benefits– Delivers highest performance and best scalability– Broadest support of information (structured, unstructured
data with over 400 file formats)– Broadest reach and deployment options (enterprise wide
to remote offices and endpoints)– Simple and easy to deploy with lowest TCO– Unified view of entire enterprise from single console– Only solution to deliver Proactive and Reactive Legal
Discovery– Fully automated for continues eDiscovery
34
Awards:
Kazeon Confidential - DO NOT DISTRIBUTE
Thank You
Recipients will receive complimentary white paper: Legal Discovery and Litigation Preparedness
Recording of presentation will be posted on kazeon.com
Please complete online survey For more information or product
demonstration:– [email protected] or info@kazeon.
com– 1.877.KAZEON1– www.kazeon.com
35
Kazeon Confidential - DO NOT DISTRIBUTE
Thank You