Tips Toward Mastering E-Mail Evidence

In previous installments of this four-part series, we explored the simple, elegant structure of messages and why e-mail systems are actually complex databases. We wrap up with a discussion of e-mail collection, message IDs, threading, deduplication, and forms of production.

Austin, Texas, attorney Tom Watkins calls e-mail messages "the cockroaches of litigation. You can't get rid of them, and they always manage to turn up when company comes."

E-mail holds the revealing res gestae statements of the wired world. It's the evidence litigants crave and fear. It's been the lifeblood of white-collar business days for years. Yet this friendly form of information still confounds us in electronic data discovery.

KNOWING WHERE TO LOOK

We can't manage what we can't find, so it behooves lawyers to know the customary places where e-mail resides. In a Microsoft Exchange/Outlook environment, the starting point for collection is usually the Exchange Server, a name applied both to the messaging system hardware (the "box" in a client's offices, or virtualized in the cloud), and to the software that runs on that hardware.

An Exchange Server aggregates mail, calendars, contacts, and other data from multiple users (a department or an entire company) into a single massive database. A hold may be applied to all contents of the Exchange Server or just selected user accounts. It's been common to extract the contents of key custodians' mailboxes for search and processing; but Exchange Server 2010 natively supports search of and collection within Exchange.

"ExMerge" is what IT calls the Exchange Server Mailbox Merge Wizard. It's a simple, free utility for exporting server-stored e-mail of individual custodians to separate PST container files. ExMerge supports rudimentary filtering, allowing IT staff to cull by message dates, folders, attachments, and subject line content at the time of export. Using ExMerge intelligently is an effective, cost-free way to trim electronically stored information volume early, before processing and review.

A little-known feature of Exchange Server is the aptly named "Dumpster" that retains double-deleted messages. A message is double-deleted when it's deleted and then purged from the Deleted Items folder. By default, Exchange 2007 keeps Dumpster items for 14 days, but it can be configured from zero days to indefinitely. Prior to 2010, the Dumpster could be circumvented by users intent on deleting their files, and Dumpster contents couldn't be indexed for search. The Dumpster was redesigned in Exchange Server 2010 to reliably thwart user deletion and support the search of Dumpster contents.

To Continue Reading: Click Here
-----------------------------------------------
Source: Law.com
By: Craig Ball