| |

In-House Discovery?

I’ve seen opinions on law firms doing e-discovery processing or collections in house, as opposed to farming that work out to a vendor that are about as varied and strongly held as the Presidential election. Some people think it’s a great value-add for clients, or even a revenue source, while others would never, ever, take the focus away from their legal work, and don’t want to deal with the ethical risks involved in handling this stuff incorrectly.

I can’t really say that either side is wrong. Many of these folks have worked in this industry much longer than I have, and have more experience dealing with these issues. What I can say, is that if you’re going to do more of this work in house, it helps to know what resources you have, and how they can be applied.

For example, we don’t do a lot of in-house stuff, but we do a fair share. One of the things we do in house some times is get a forensic “clone” of a hard drive. When I get asked about getting a copy of a drive to work from, I generally say, that yeah, we can do that. Most of the time, that’s true. yesterday, it wasn’t.

Not because I didn’t have time, or I didn’t have a cloning tool, but because as technology has advanced, and the ultra-portable market has grown, we’ve discovered various types of hard drives that we don’t have the proper tools for. I can do a SATA drive or IDE drive from any laptop or desktop, but when you bring me an ultra portable with a 1.8″ drive with a PATA(ZIF) connector, or even one of the new SSD drives, there’s not much I can do. I don’t have the proper drive connectors to handle that. At the end of the day, we don’t have the resources a forensic expert would have to handle various types of media. That’s not our business. On the other hand, if we try to do some of this work in house, we’re going to run into the limitations of our resources, and sometimes that’s going to be problematic. Might we have been better off simply saying we’d have to send the drive out to be cloned from the very beginning? Maybe. Might our client balk at that sort of cost and find a firm that could do it in-house, and cheaper? Maybe. Is trying to be “somewhere in the middle”, being able to do some work in order to limit client costs, but not everything so that we’re not doing just that, going to bite us every now and then? Obviously, yes.

Is there a right answer? I doubt it.

Does the fact that I hadn’t ever seen the 1.8″ drive like that one mean I’ve been out of the tech loop long enough that my tech knowledge is starting to be irrelevant? Sadly, yeah. 🙂

Technorati Tags: In-houseEdiscovery, E-Discovery, Forensics, UltraPortableHD

Similar Posts

  • |

    Why iOS Devices are Popular

    I’ve probably seen that Samsung commercial a dozen times over the last few days. The one that makes a pretty good mockery of people waiting in line for the iPhone 5. The one that makes a really good point about all the things that still, STILL, aren’t available for iPhone users, that we could have…

  • | |

    Linked – WordPress hacks expose law firms’ cyber-disconnect – and, perhaps, client data

    The lesson, as always, don’t use WordPress or any other web-facing technology if you aren’t going to keep up to date with it. “Earlier this month, users of the popular WordPress CMS were advised to upgrade to the latest version of the software to patch “an undisclosed critical vulnerability.” At the sound of that dogwhistle,…

  • |

    Over-Simplistic Scientific Intelligence

    And this really brings me back to my point, that we do a poor job of truly understanding science, statistics and cause and effect. We believe that algorithms have all been well-thought out, and produce a “true” result, even when they are trying to predict something as unpredictable as what traffic will look like 20 years from now. We assume social science studies are giving us the “right” answer for how to educate people, or train them for the best outcomes, without considering what we are teaching them about the larger world. We assume that we can tweak one belief, or one thing, without human beings reacting to those changes in unpredictable ways, all the while thinking our one change will cause the reaction we DO predict.

    We assume a lot that should never be assumed. We over-simplify a world that actually has more influences than we can possibly account for, and assume that what is really a small statistical difference represents a universal truth.

    It doesn’t. There are no simple answers. It takes hard work, hard discussions, and lots of listening to figure out the best way forward. Don’t wait for AI to tell you what to do, it may be missing quite a bit.

  • |

    Linked – Has paying the ransom become business as usual?

    This post is full of bad news like this: Radware released its 2018 Executive Application and Network Security Report. For the first time in the survey’s five-year history, a majority of executives (53%) reported paying a hacker’s ransom following a cyber attack. Ouch. Like most hacking/scam/spam tools, they are usually popular because they work. Ransomware…

  • Never fails

    Yes, you say something nice about a service, lots of other people start talking about it, and they start having problems. As useful as I think Twitter can be, currently the Gtalk IM function is completely unreliable, which means using my blackberry to send updates and get notifications doesn’t really work. I have to be…

4 Comments

  1. Don’t feel too bad – I don’t think i’ve seen one of those drives yet either. Having said that, a quick visit to microcenter would probably furnish you with an adapter to deal with those drives.

    Out of interest, what would happen if you got a request to deal with one of the new encrypted drives?

  2. Mr. rcollins, we run into that too, though I haven’t with a Comm 64 yet. *L*

    Those are a bit easier to explain to attorney’s though, who get that the machine is obsolete, it’s a bit trickier when you have to explain why I can image THAT laptop, but not THIS laptop, especially when they’re both from the same manufacturer.

    Andy, you’re probably right, and that’ll probably be what we end up doing, but at the time, given the time constraints I was under and the time of day, running up to Microcenter wasn’t really an option. In terms of encrypted drives, usually we are imaging stuff from our own clients, so we would get the password, if it’s the opposing side, we would have to get the court to compel them to give up passwords, or image it themselves.

    That being said, I haven’t had to deal with one of the new encrypted drives yet, so we’ll see what happens!

  3. I hear you about worrying that your IT knowledge is getting irrelevant. I spent almost ten years working at sometimes the bleeding edge of tech. Now, as a law student, I don’t work with anything more hardcore than a Core2 Duo laptop. 🙂

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Your post must include a link to this post.

How does this work?
Write a response on your own website and include a link to this post. Then submit your response’s URL here. Your response may appear here after moderation. To update or remove it, edit or delete your original post and submit the same URL again. Learn more about Webmentions.