Application A specific software program such as Word, Excel or Outlook.
Attachment Electronic files appended to an e-mail message.
Backup The activity of copying files or databases so that they will be preserved in case of equipment failure or other catastrophe. Backups are often done as a routine business operation. The retrieval of backup files is called 'restoring' them.
Burn The activity of copying files or to a removable media, usually a CD-ROM or DVD-ROM.
Computer Forensics Computer investigation and analysis techniques to determine legal evidence. Applications include computer crime or misuse, theft of trade secrets, theft of or destruction of intellectual property, and fraud. Computer forensic specialists use many methods to capture computer system data, and recover deleted, encrypted, or damaged file information.
Concept Search 'Concept search' in litigation refers to the search of electronic documents on the basis of ideas they contain, rather than just specific keywords. Concept searching is usually implemented by broadening a keyword-based search to include synonyms or using a thesaurus to include results related to the ideas in the search keywords, even though not directly derived from the keyword search term.
De-duplication or deduplication The identification and segregation of exact or nearly-exact files. De-duplication can substantially reduce the cost of working with electronic document, as multiple copies of the same file need not be reviewed.
Document Management System A computer system that tracks and stores electronic documents or image representations of paper documents.
Deleted files When a file is deleted from an operating system (e.g. Windows), the contents of the file may still remain intact. Specialized computer utilities can be used to reconstruct deleted files, sometimes bypassing the operating system and directly reading the raw drive sectors.
Electronic Data Discovery or EDD The process of gathering, reviewing and producing of documents in electronic format. Electronic documents include e-mail, memos, letters, spreadsheets, databases, office documents, presentations and other electronic formats commonly found on computer, network hard drives, back-up tapes and off-line storage such as CDs, DVDs, ZIP drives, etc.
Email strings A series of e-mails linked together by e-mail responses and forwarding. Email strings are often treated as a single document.
e-Discovery The collection, preparation, review and production of electronic documents in litigation discovery. This includes e-mail, attachments, and other data stored on a computer, network, backup or other storage media. e-Discovery includes metadata.
e-Discovery Amendments or Electronic Discovery Amendments Amendments to the U.S. Federal Rules of Civil Procedure, which became effective on December 1, 2006. The amended rules explicitly recognize electronically stored information and describe procedures to make it available in discovery. This obligation includes metadata. Principal provisions are summarized as follows as they affect e-Discovery:
>Rule 26 Automatic Disclosure of ESI: Parties in litigation must provide a copy (or description by category and location) of ESI that will support that party's claims and/or defenses.
>Rule 26 Enhanced Meet and Confer Requirements : Parties must meet and confer at the outset of the case to discuss their plans and proposals regarding the conduct of the litigation, including any issues relating to preservation, disclosure or discovery of ESI, including the form in which ESI should be produced and claims of privilege, or protection as trial-preparation material.
>Rule 26 Inadvertent Production of Privileged Information : If discovery information is subject to a claim of privilege, or protection as privileged trial-preparation material, the party making the claim may notify any party that received the information of the claim and the basis for it. After being notified, a party is required to promptly return, sequester, or destroy the specified information and any copies it has and is not permitted to use or disclose the information until the claim is resolved.
>Rule 26 Production Of Information "Not Reasonably Accessible": A party need not provide discovery of ESI from sources that the party identifies as "not reasonably accessible because of undue burden or cost." The party being asked to produce ESI bears the burden of demonstrating the information is not reasonably accessible because of undue burden or cost. Even if that showing is made, the court may nonetheless order discovery from that party if the requesting party shows good cause.
>Rule 33 Production Of ESI In Response To Interrogatories: Rule 33 provides the option to respond to an interrogatory by specifying and producing the business records, including ESI, which contain the answer.
>Rule 34 Production Of ESI In Response To Requests For Production Of Documents: Rule 34 provides the option to respond to an interrogatory by specifying and producing the business records, including ESI, which contain the answer.
>Rule 37 -- The "Safe Harbor" Provision: Rule 37 pertains to remedies for a party's failure to respond to, or cooperate in, discovery. Amended Rule 37 provides that, absent exceptional circumstances, a court may not impose Rule 37 sanctions on a party for failing to provide ESI lost as a result of the "routine, good faith operation of an electronic information system."
Electronic Image An electronic representation of a document in the form a 'bitmap', represented as a two dimensional array of brightness values for pixels.
'Electronically Stored Information' or ESI Files or other data that are stored on computers, file servers, disks, tape or other devices or media.
'Electronic Search In the context of e-Discovery, the ability to access all litigation documents in searchable electronic form and use selected keywords to find applicable documents for further review.
ePaper An electronic version of a document, usually in a PDF or TIFF file format.
File Server A computer used to store files for access by other client computers on a network of computers.
Forensic Computer Expert A litigation expert and consultant in the field of computer forensics. The steps taken by a forensics expert can include: 1) protecting a subject computer system during the forensic examination from any possible alteration, damage, data corruption, or virus introduction; 2) discovering all files (normal files, deleted yet remaining files, hidden files, password-protected files, and encrypted files), recovery of deleted files; 3) discovery of hidden files, 4) access to protected or encrypted files; 5) analysis of unallocated' and 'slack' space on a disk; 6) preparation of an analysis of a subject computer; 7) expert consultation; and 8) testimony at trial.
Forensic Copy A exact bit-by-bit copy of a computer drive, including slack and unallocated space.
Fuzzy Search Fuzzy searches return results even if the text to be searched is slightly misspelled. Fuzzy searches are helpful in returning a result even if the original text has been corrupted thorough an optical character recognition (OCR) error, which common in scanned documents.
Keyword Search The process of examining electronic documents in a collection or system by matching a keyword or keywords with instances in the various documents. Keyword searches can only be done on electronic files in their native format, in searchable PDF, or in files that have been associated with an OCR text file. Standard keyword searches will return a positive result only if the exact keyword or a close derivative is specified. Search derivatives returned by litigation support search engines commonly include 'stemming'. Stemming includes grammatical variations on a word, such that a search for "applied" would also return "applying", "applies", and "apply".
Harvesting The process of retrieving electronic data from various computers and other storage media, including computer hard drives, file servers, CD/DVDs, and backup tapes and devices.
Legal Hold A notice or communication from legal counsel to an organization that suspends the normal disposition or processing of records, such as backup tape recycling. A legal hold will be issued a result of current or anticipated litigation, audit, government investigation or other such matter to avoid evidence spoliation. Legal holds can encompass business procedures affecting active data, including, but not limited to, backup tape recycling.
Litigation Lifecycle The litigation lifecycle is the processes and practices commonly used to define a legal event. The litigation lifecycle begins when suit is filed and continues through post trial events.
Litigation Lifecycle Management The policies, processes, practices and tools used to handle a case in the through the litigation lifecycle in the most appropriate and cost effective manner.
Logical Document Determination or LDD A process of document grouping or separation used in some e-Discovery litigation support processes. For example, a document may be scanned and saved as three different images. LDD is the process of combining the separate pages into one electronic document for purposes of coding or OCR.
MD5 Hash Also known as a 'digital fingerprint' in litigation support and computer forensics, a MD5 hash is computer algorithm that takes the bits of a file as input and outputs a practically unique text string. An example is as follows. The MD5 hash for a text file of Lincoln's Gettysburg address is 4DDBE696B728EA3BE6E8EE0570F3299E. If one period is deleted from the text, the MD5 hash is completely different: 06ADE8709487AE60749EFDCB9F41D450. The hash will be the same when the file is accurately copied, even if the file name is changed.
Metadata or meta-data Structured information about an electronic file that is embedded in the file, but not normally visible when viewing a printed or on screen rendition of the document, that describes the characteristics, origins, usage and validity of other electronic files. Metadata has become an important component of discovery following the e-Discovery Amendments. Metadata can be characterized as application metadata or system metadata. Application metadata is information not visible on the printed page, but embedded in the document file, remaining with the file if it is copied. Microsoft Office routinely embeds many different types of metadata in word processing, spreadsheets and other applications. The same is true of other computer applications as well. Important types of metadata that may be embedded in Microsoft Office files includes: title, subject, author, comments, revision number, last print date, creation date, last save time, total editing time. Some documents may also include prior revisions and comments embedded in the metadata. System metadata is not embedded in the file, and instead is stored externally on the computer file system. System metadata does not remain with a file when it is copied. System metadata may include a file name, size, location, path, creation date and modification date. While application metadata can be modified, it is very difficult to modify system metadata. Some application metadata can be viewed as properties within an application or with third party metadata viewers. Analyzing the full range of application metadata, or system metadata, requires the services of a computer forensics expert.
Native File Format A file saved in the format as designated by the original application used to create it (e.g. a DOC or DOCX file created by Microsoft Word). Reviewing e-Discovery files in native format involves less processing cost than converting everything to page-equivalents like PDFs or TIFFs. However, review may be more cumbersome and time-consuming.
deNISTing Removing operating system, program and application files, using a database of file MD5 hashes of known and registered files. Useful in removing non-relevant files from e-Discovery collections before human review or keyword search.
Outlook Ubiquitous Microsoft personal information management (PIM) program, which includes email, task management and a calendar. All data is saved in a single PST file and/or OST on the user's hard disc drive, or on a server in Microsoft Exchange. Component Outlook messages may be saved and viewed as MSG files.
Outlook Express Microsoft email client that has been included with a number of versions of Microsoft Windows through Windows XP.
OCR or 'Optical Character Recognition' The process of taking scanned images (from documents) and electronically converting them into editable text. The output may be a text files (flat ASCII files), or it may be embedded in a more complex file, such as a searchable PDF.
OST file format File format used by the Microsoft Outlook as an offline folder file to make it possible for the user to work offline and then to synchronize changes with the Exchange server the next time the user connects. The OST file will be saved on the local computer.
PDF Developed by Adobe Systems, Inc., 'PDF' stands for 'portable document format'. PDF is the de facto standard for the exchange of electronic documents. PDF preserves the fonts, images, graphics, and layout of any source document, regardless of how the original document was created. PDF files can be shared, viewed, and printed with Acrobat, a viewer application available free from Adobe Systems. Documents can be converted to PDF using software products created by Adobe and others. Depending on how they are created, PDFs can also be searchable PDF, either by retaining text from the source document or by having a source image file converted by OCR. Depending on capture methodology, PDFs may retain some metadata.
PST file format File format used by the Microsoft Outlook personal information management (PIM) program, which includes email, task management and a calendar.
Spoliation The destruction or substantial alteration of evidence, or the failure to preserve evidence, for another's use in pending or foreseeable litigation.
TIFF TIFF or TIF (Tagged Image File Format) is an electronic copy of a paper document in the form of an image, and as such contains no embedded text, fonts, images, or graphics ( cf. PDF format). TIFFs are also compatible with a wide range of hardware and software platforms, and future development is not tied to any single company. TIFFs do not retain metadata from a source electronic document.