With less than 30 percent of all information ever appearing as ink on paper, the "paper trail" often turns out to be a "bitstream." This sheer volume of data held by organizations makes it clear that electronically stored information plays an essential part in litigation today. Once the information as been preserved, what’s next? Well, it would make no sense for anyone to read through all of upper management’s e-mails or review all the documents stored on an organization’s network. The solution? Applying search terms to the electronically stored information to identify responsive files and documents.

Successful searches of electronic data must produce information that is useful not only in what it tells you but in a volume that can be reviewed. The most efficient to achieve this is by constructing a list of terms that can be used to search through digital evidence to identify the most relevant documents for review. 

Selecting search terms may seem easy enough: pick terms that describe what we are looking for and search whatever electronic documents we’ve recovered. But careful selection is critical unless you want to review responsive yet irrelevant documents. Here are some elements to take into account when building thinking about searching electronically stored information:

• Determine what is to be searched: emails, documents, deleted files? Careful determination will reduce the number of hits to review and allow you to focus on what matters. Keep in mind that a focused search may provide you with focused results but may also prevent you from finding critical elements if the scope is too narrow.
• Be careful of generic terms: they will likely produce a large volume of irrelevant documents to review to determine relevance. The term “confidential” may be critical to the review but the organization may be including an automatically generated disclaimer at the bottom of all its e-mails that contains the sentence, “The content of this message is CONFIDENTIAL.”
• Be mindful of language: what may be targeted in English may be generic in French. Also, think of building your list of search terms in English and French (and any other language you think appropriate).
• Short words may produce a tall amount of work: short words, such as abbreviations, might produce thousands of search hits. These terms might be contained in random text patterns such as those contained in remnants of deleted documents or binary system files found on the computer system.
• Be wary of “embedded” words: short words may be contained in others. For example, if we’re searching for the word “car” as part of scheme involving the use of company or rental cars, the term would flag documents containing “North Carolina,” “South Carolina,” “carriage,” “carries,” “Carnegie Hall,” and thousands more. 
• Corporate culture: organizations make up their own language. Organizations have words derived from internal acronyms or inside language that only employees might use to describe elements specific to the organization.
• Some words may mean nothing to you, but they mean something to the computer. For example, if you searching for any documents relating to the “Atlantic” region of Canada, you should keep in mind that any system file containing a reference to the “Atlantic” time zone will be identified which could mean a lot of useless files to review.

In closing, it should be noted that the keyword selection process should be a joint effort by those involved in the case. This insures that adequate terms are selected and that they meet the objectives of all involved.

Huge volumes of business data are nothing new. But the ways data can hurt you these days – well, that’s a different story. In an age when your company can rise or fall on how they manage their information how an organization manages its ever-growing mountains of data can be the difference between a good day at the office and sheer disaster.

Some organisations take a “wait and see” approach to controlling information. They keep their fingers crossed for nothing to go wrong – and then call in help when it does. That’s a short-sighted view that creates more risk than reward. Because something always goes wrong. The only question is whether they’ll be ready for it or not.

Understanding challenges associated with electronically stored information will allow the organization to mitigate risks associated with the production of such information.

Stand and Deliver

An order to produce documents sounds simple. Carrying it out can be frighteningly complex for an organization which has never been faced with this. For example, what’s a document? From telephone logs to minutes, the SEC’s definition runs more than a hundred words. Needed documents may reside on a legacy electronic media for which the organization may no longer have the appropriate reader. Meeting the demands of a court or regulator is half the challenge. You’ve got to make sure finding and producing records doesn’t grind your business to a halt.

• What is the organisation doing with data from departing employees, inactive clients and historic transactions? This information may need to be produced in a timely fashion and without understanding where this information and how to access it, organizations may be faced with a much greater challenge than originally thought
• Can a litigation hold be implemented without halting or even affecting IT operations? Other functions of the organization need access to the information to operate and cannot be deprived of access to it. A well documented procedure becomes critical

Turn On the Lights

When organisations start identifying where evidence resides, its often like turning on the lights in a cluttered basement: they don’t exactly know where it is and once they’ve found it, it a challenge getting to it. The same thing could be said of e-discovery, organizations need to locate and preserve data.

• Can the organization easily identify where the targeted information resides and how to produce it? From backup tapes to the latest PDA, it can be a challenge to recover information. Furthermore, finding the information in complex document workflow systems and Enterprise Resource Planning and Customer Relationship Management systems can prove challenging when the organization does not understand how information is created, stored and destroyed.
• Are proper computer forensic procedures followed when information is being extracting from the media where it resides? Data retrieved without regard to its admissibility in court might as well never have been detected and collected. Proper procedures should be followed when handling and extracting electronic information whether it be for investigations or litigation.

Entrusting your data

When data stays within the organization, it maintains control over it. This is no longer the case when it ends up being outside the organization. And in most cases, data ends up being hosted at an outside facility by an e-discovery provider. But when it leaves the premises, you need to know who has it – their reputation, their facilities, their location and the regulatory environment they work in.

• Are there controls in place to make sure offsite data is adequately protected? Third party hosting providers should provide highly secure facilities for storing such sensitive information. Adequate physical and logical access control is critical
• What laws and regulations govern the handling of information in the location where it’s being managed? If your data is being moved from province to another or even another country, how does this affect

The questions above serve as a checklist for often forgotten elements which can be critical throughout the e-discovery process. Addressing these issues when planning and developing procedures will facilitate the process when it comes time to react.