In-House Discovery?

I’ve seen opinions on law firms doing e-discovery processing or collections in house, as opposed to farming that work out to a vendor that are about as varied and strongly held as the Presidential election. Some people think it’s a great value-add for clients, or even a revenue source, while others would never, ever, take the focus away from their legal work, and don’t want to deal with the ethical risks involved in handling this stuff incorrectly.

I can’t really say that either side is wrong. Many of these folks have worked in this industry much longer than I have, and have more experience dealing with these issues. What I can say, is that if you’re going to do more of this work in house, it helps to know what resources you have, and how they can be applied.

For example, we don’t do a lot of in-house stuff, but we do a fair share. One of the things we do in house some times is get a forensic “clone” of a hard drive. When I get asked about getting a copy of a drive to work from, I generally say, that yeah, we can do that. Most of the time, that’s true. yesterday, it wasn’t.

Not because I didn’t have time, or I didn’t have a cloning tool, but because as technology has advanced, and the ultra-portable market has grown, we’ve discovered various types of hard drives that we don’t have the proper tools for. I can do a SATA drive or IDE drive from any laptop or desktop, but when you bring me an ultra portable with a 1.8″ drive with a PATA(ZIF) connector, or even one of the new SSD drives, there’s not much I can do. I don’t have the proper drive connectors to handle that. At the end of the day, we don’t have the resources a forensic expert would have to handle various types of media. That’s not our business. On the other hand, if we try to do some of this work in house, we’re going to run into the limitations of our resources, and sometimes that’s going to be problematic. Might we have been better off simply saying we’d have to send the drive out to be cloned from the very beginning? Maybe. Might our client balk at that sort of cost and find a firm that could do it in-house, and cheaper? Maybe. Is trying to be “somewhere in the middle”, being able to do some work in order to limit client costs, but not everything so that we’re not doing just that, going to bite us every now and then? Obviously, yes.

Is there a right answer? I doubt it.

Does the fact that I hadn’t ever seen the 1.8″ drive like that one mean I’ve been out of the tech loop long enough that my tech knowledge is starting to be irrelevant? Sadly, yeah. 🙂

Technorati Tags: In-houseEdiscovery, E-Discovery, Forensics, UltraPortableHD

4 Responses

  1. Andy

    Don’t feel too bad – I don’t think i’ve seen one of those drives yet either. Having said that, a quick visit to microcenter would probably furnish you with an adapter to deal with those drives.

    Out of interest, what would happen if you got a request to deal with one of the new encrypted drives?

  2. Mike McBride

    Mr. rcollins, we run into that too, though I haven’t with a Comm 64 yet. *L*

    Those are a bit easier to explain to attorney’s though, who get that the machine is obsolete, it’s a bit trickier when you have to explain why I can image THAT laptop, but not THIS laptop, especially when they’re both from the same manufacturer.

    Andy, you’re probably right, and that’ll probably be what we end up doing, but at the time, given the time constraints I was under and the time of day, running up to Microcenter wasn’t really an option. In terms of encrypted drives, usually we are imaging stuff from our own clients, so we would get the password, if it’s the opposing side, we would have to get the court to compel them to give up passwords, or image it themselves.

    That being said, I haven’t had to deal with one of the new encrypted drives yet, so we’ll see what happens!

  3. Justinian Lane

    I hear you about worrying that your IT knowledge is getting irrelevant. I spent almost ten years working at sometimes the bleeding edge of tech. Now, as a law student, I don’t work with anything more hardcore than a Core2 Duo laptop. 🙂

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.