How Virtualization Affects EDD Collection

Virtual servers, desktops and storage are reaching the point of ubiquity. If you haven't already encountered your first electronic data discovery collection involving virtualization, it's only a matter of time until you do.

When you engage in collection in a virtualized environment, much of your job as an attorney remains the same: assess the situation, determine what needs to be collected and processed, and talk with your client and EDD vendor about what needs to get done. But realize that the underlying targets for discovery are radically different. If you stick to your old habits, you could be blindsided by high costs, hidden data and preservation issues associated with virtual machines. This article presents the information you need to ensure an efficient, complete and virtually painless collection.

Virtualization can affect your case in three main ways:

1. Increase costs and collections: Virtualization means the end of the "one computer per box" generation. If you get a rough estimate of an electronically stored information collection by merely counting the physical computers or servers, virtualization can throw your estimates way off. It is now commonplace for multiple computers to run on the same hardware that used to be reserved for one.

2. Cause you to overlook evidence: If certain forms of virtualization have been implemented, and an examiner is not made aware of it, they might miss crucial evidence. When searching a user's hard drive, for instance, certain files contained within encapsulated virtual machines may not respond to keyword searches. The virtual machine files may have to be "opened" prior to the search to ensure accurate results.

3. Increase the risk of collection issues and/or spoliation: Virtualization involves separating computers and data storage from its physical hardware. This new technology brings with it new features that may increase the possibility of losing or destroying ESI. Examples include the ability to:

• "roll back" a computer to a previous "snapshot" and inadvertently lose newer data;
• move computers and data from one piece of physical hardware to another and accidentally misplace or compromise data; and
• delete entire machines with a single click and completely erase data.

Your ability to overcome these issues in any case involving virtualization relies on how well you do the following:

1. Understand what virtualization is and how it is used in corporate environments.

2. Ask the right virtualization questions when meeting with your client.

3. Effectively communicate what you need from your client and e-discovery vendor.

To Continue Reading: Click Here
--------------------------------------------
Source: law.com
By: Jason Briody