Computer Forensics / Electronic Discovery

New Electronic Discovery Rules Are Coming

October 2005
Library Sections:

The Judicial Conference met on September 20, 2005, and approved the recommendations of the Committee on Rules of Practice and Procedure regarding electronic discovery.

The approval occurred unanimously, without question or objection.  If adopted by the Supreme Court by May 1, the new rules will become effective on December 1, 2006 (absent intervention by Congress).

At this point, further meaningful change in the rules is highly unlikely.  The ideas contained in these new Rules will likely have a practical impact even before their effective date. Litigators should start to plan for the new rules now.

Early Attention to Electronic Discovery Issues

The ew rules amend Rule 26, Rule 6 and Form 35 to explicitly include electronic discovery issues. The litigants should address, as part of the Rule 26(f) conference, issues relating to the discovery and production of electronically stored information. The subjects to be discussed include the form of production, preservation of records, and whether the parties have reached agreement for documents inadvertently produced, or produced before a complete privilege review (i.e., claw back or quick peak agreements). The agreements reached should be reported to the court at the Rule 16 Conference, and included in the Court's initial scheduling order.

This change is sound, and reflects good current practice.

Electronic Information that is "not readily accessible"

Producing parties often complain about the burden and cost of producing electronic information. In reality, the cost of any electronic production is a small fraction of what a corresponding amount of paper would cost. The proposals attempt to address the cost and burden issue with requiring production (absent a showing of good cause by the court) of only that data that is "reasonably accessible".

Under revised Rule 26(b)(2):

"A party need not provide discovery of electronically stored information that the party identifies as not reasonably accessible. On motion by the requesting party, the responding party must show that the information is not reasonably accessible. If that showing is made, the court may order discovery of the information for good cause, and may specify conditions for such discovery."

The xplanatory notes to this rule indicate that the responding party need only describe the inaccessible data by category or type. There is no requirement to provide the equivalent of a detailed privilege log, since that might require a review of the data. If the responding party has actually accessed the requested data in response to the discovery request, that party may not rely upon this rule as the basis for non-production, even if such access occurred at substantial expense.

The change from the current system is subtle yet substantial. The current presumption is that the requesting party has the burden of showing only relevance before production is ordered. Under the proposed rules, the requesting party would have to show both relevancy, and that the data is "reasonably accessible". Of course the requesting party is usually not in a position of showing that requested information is readily accessible to his opponent.This will cause requesting parties to have to obtain initial discovery regarding their opponent's computer systems and the personnel who are capable of operating them.

A two-tier system of electronic discovery is mandated. The determination of what is not reasonably discoverable is based on (i) the cost of its retrieval, and (ii) the data that is available from more accessible sources.  The requesting party must first review data that is reasonably accessible, and then determine whether it is necessary to request data that is claimed to be not reasonably accessible.  

The responding party is allowed to assert which data is inaccessible.  Since there are no clear answers, this will be the source of ongoing discovery disputes.  Understanding data processing and storage is needed to obtain an answer that is best for your client.

Responding parties will no doubt suggest that all of the following data is not "reasonably accessible":

  1. Backup tapes - The notes to the rules describe data that is only retained for disaster recovery as being not reasonably accessible.  This will certainly be used by producing parties to mean that that back-up tapes fall into this category.  Although back-up tapes are useful for disaster recovery, they are more commonly used to find a prior version of data because the most recent version has become corrupted, or contains a change that the user no longer desires.  No data processing person worthy of collecting a paycheck would tell his employer that the backup data was not reasonably accessible.  When backup data is needed for reasons outside of litigation stonewalling, the information will be obtained, recovered and used within 24 hours.  How inaccessible is that?
  2. Archival data - Archival data and backup data are terms that are often loosely used interchangeably.  They are actually quite different.  The difference is important if one successfully argues that backup data is not "reasonably accessible".  Backup data are large files, usually compressed onto tape.  Email and database tapes usually must be recovered in total before being used.  Once backup tapes are recovered, individual files can be located and used.  In contrast, archival files are specifically identified as being significant, sometimes because of government requirements or for historical preservation.  Archival files are usually organized and maintained in their native format.  Although archival files are not actively used, in most cases they can be easily and quickly retrieved.
  3. Legacy data - Legacy data refers to files that are used with a prior software or hardware combination.  Legacy data is more difficult to recover.  Legacy data could be likened to paper documents that have been placed in long-term, off-site storage.  If such paper records are clearly relevant, a party can not avoid production by simply asserting that the records are stored off-site.  Nevertheless, the new Rules imply that such records are not reasonably accessible without getting permission of the court.
  4. Computer forensics- Data that has been deleted but simply not overwritten on the magnetic media requires special software and related training to recover.  This information truly is not reasonably accessible, and should not be the subject of routine discovery that is paid by the producing party.  Although computer forensics is not nearly as expensive as complaining parties wish to assert, the reality is that computer forensic work is (i) almost always paid for by the party seeking its use, and (ii) can be done with little disruption to the producing party. Accordingly, the new rule solves a computer forensics problem that is not commonly occurring.

Businesses obtain tremendous efficiencies by storing and retrieving data using technology advances.The savings are enormous. The most inaccessible electronic data is still far less expensive to retrieve than any paper sitting in dusty boxes in a warehouse. Parties seeking production will claim (with justification) that this data is not "inaccessible" simply because it is less convenient than other data.

Assertions of Privilege after Production

The revisions add Rule 26(b)(5)(B) that sets forth a procedure to present to the court when parties have inadvertently produced data, as follows:

"When a party produces information without intending to waive a claim of privilege it may, within a reasonable period of time, notify a party that received the information of its claim of privilege.  After being notified, a party must promptly return, sequester, or destroy the specified information and any copies."

This is a challenging area, since it involves common law, evidence doctrine, and legal ethics.  There is obviously a limit as to how much the FRCP can accomplish in resolving the issue.  Depending on the jurisdiction and the facts of each case, inadvertent production of privileged information can mean waiver of the privilege as to that document, all privileged documents on that issue, or even all privileged documents for the entire case.   

Because of the volume of electronic information that parties retain, parties frequently attempt to minimize the cost and delay of an exhaustive search for privileged information by agreeing to protocols that minimize the risk of waiver.  These protocols include so-called "quick peek" and "claw back" arrangements, which allow for (i) production without a complete privilege review and (ii) an agreement that production of privileged documents does not constitute a waiver.

The proposals sanction the use of claw-back arrangements when the request to return privileged information occurs within an unspecified "reasonable" period.  Although most potentially-privileged documents can be found relatively quickly through key word searches, a possibility exists that all privileged records may not be located using this means.  Most commonly, this occurs because of word or name misspellings that a computer will miss, but which would readily be apparent to a human reviewer.  Extensive time can be spent (and usually wasted) looking for the isolated and unexpected document that could not be located using such key word searches.  

Obviously, no party wants to produce privileged documents, regardless of what the Rule says.  The real point is what happens when something privileged is released.  In this regard, arguments about a "reasonable" time misses the objectives of (i) reducing the cost and arguments of electronic discovery, and (ii) allowing modern technology to advance justice.  To reduce the cost of electronic discovery, the manual review of all records for privilege purposes should be skipped entirely, not simply done within a "reasonable period". 

The Notes to the new Rules acknowledge that there is no bright line for what is reasonable, as follows:

"Many factors bear on whether the party gave notice within a reasonable time in a given case, including the date when the producing party learned of the production, the extent to which other parties had made use of the information in connection with the litigation, the difficulty of discerning that the material was privileged, and the magnitude of production."

A party faced with an inadvertent production should argue that a "reasonable" time period has been met by simply raising the issue rapidly after the problem became known, and not because some arbitrary time has occurred since the original production.  In the event that an unexpected document that should have been privileged is produced, it will usually be readily apparent to all.  The court should use its broad power to maintain the privilege regardless of the passage of any time period, if it is clear that a waiver was not intended.  

In a "quick peek" agreement, the issue involves not an "inadvertent disclosure", but a purposeful disclosure of information "without intending to waive a claim of privilege".  Under such an arrangement, the responding party makes all potentially relevant information available.  The requesting party reviews the information and designates that which is responsive to the requests.  The responding party then reviews the designated information for privilege issues, and produces what it believes is relevant and non-privileged.  Quick peek solutions produce enormous savings, but have the risk that a third party or litigant in a parallel action can claim that the agreement does not bind them, and the issue of privilege has been consciously waived. 

When Should Sanctions Occur for Data Destruction?

The new rules add Rule 37(f) involving sanctions for the loss of electronically stored information, as follows:

"Unless a party violated an order in the action requiring it to preserve electronically stored information, a court may not impose sanctions under these rules on the party for failing to provide such information if:

(1)The party took reasonable steps to preserve the information after it knew or should have know the information was discoverable in the action; and

(2)The failure resulted from the loss of information because of the routine operation of the party's electronic information system."

When evaluating the reasonableness of steps taken to preserve information, one must remember that electronic data is inexpensive to copy and archive.  The data causing the greatest challenge are (i) databases that are constantly being updated with current information, and (ii) backup data that is scheduled to be overwritten after some period.  Both of these oft-cited examples can be solved by simply making a copy on inexpensive tape, and then not recycling those tapes until the litigation is resolved.   

The notes to the new rule describe a process for assessing the reasonableness of steps taken to preserve electronic information, as follows:

"In most cases, a party acts reasonably by identifying and preserving reasonably accessible electronically stored information that is discoverable without a court order.  In some instances, reasonable care may require preservation of electronically stored information that is not reasonably accessible if the party knew or should have known that it was discoverable in the action and could not be obtained elsewhere.  Preservation may be less burdensome than access, and is necessary to support discovery under Rule 26(b)(2) if good cause is shown.  The third limit depends on what the party knows about the nature of the litigation.  That knowledge should inform its judgment about what subjects are pertinent to the action and which people and systems are likely to have relevant information.  Once the subjects and information systems are identified, e-mail records and electronic files of key individuals and departments will be the most obvious candidates for preservation..."

This above language instructs that a producing party should retain more than "reasonably accessible" data.  The opposing argument is that if only "reasonably accessible" data need be produced under Rule 26(b)(2), then such information need not be part of a typical litigation hold.  Of course, by the time that the issue of what is "reasonably accessible" is determined, the data will be gone. 

Realistically, this is not a change from what the majority of courts have already done.  Sanctions would be allowable if the party failed to take reasonable steps to preserve information after it knew or should have known that information was discoverable, or if the party violated an order issued in the action.  Most courts require a fault beyond negligence before imposing a severe sanction.  Lesser sanctions, such as awarding additional costs of discovery or computer forensics to recover data, have occurred without requiring a high level of culpability.

How Should Data be Produced?

Rules 34(b) now specifies that the requesting party may specify the form in which electronically stored information should be produced.   Unless the court or the parties agree otherwise, the parties have two default forms that are roughly analogous to what currently exists for paper.  Specifically, parties must produce information in a form in which it is ordinarily maintained, or in an electronically searchable form.  The producing party need only produce information in one form.

This rule will stop parties from producing large file collections as static "tiff" or "pdf" image files, which significantly increase the cost by making it impossible to use electronic search and sorting capabilities.


Discovery of electronically stored information should generally follow the same results that would be achieved with paper.  The new FRCP rules modify this result somewhat in an effort to limit the cost of discovery.   To achieve proper results, parties will need involvement by in-house and outside data processing professionals.

Fulcrum Inquiry has electronic discovery and forensic accounting experts that frequently assist litigants and their lawyers resolve disputes.  By combining business and accounting skills with technical computer capabilities, we are able to offer more practical advice regarding computer forensics and electronic discovery issues.