Electronic Discovery

The amount of Electronically Stored Information (ESI) in corporations has grown exponentially in the past two decades, and almost all litigation now involves an element of electronic discovery. The marriage of legal, technical, and financial elements, coupled with the immense universe of data, has made electronic discovery complicated, expensive and inefficient. Corporations and law firms need a trusted partner with the expertise to reduce risk, an efficient process and to trim cost and enough resources to manage any size project on any timeframe. Cornerstone provides all that plus groundbreaking virtual technologies to make all projects easier, faster and less costly.

Cornerstone’s electronic discovery process encompasses:

Intake

All electronic media received by fins is first examined, checked-in and entered into a tracking database to ensure that it is handled properly and securely through every step in the process and that any special handling requirements are met. An Evidence Auditor provides a level of additional review before the media is delivered to Cornerstone’s lab for analysis.

Early Case Assessment Services

Cornerstone uses early case assessment strategies and software to securely and defensibly reduce the volume of data and eliminate extraneous file types. This dramatically reduces the cost of discovery by limiting the amount of required processing and document review. Through these processes, Cornerstone provides full and detailed iterative analyses, enabling legal teams to adjust processes and defensibly optimize decisions regarding what requires review.

Cornerstone Early Case Assessment Services reduces review sets with a combination of:

• De-duplication
• Forensic pre-culling
• File filtering
• Searching
• Categorization
• Iterative reporting

Processing

Cornerstone’s best-of-breed technology captures the full text plus more than 100 types of metadata from email, attachments and loose electronic documents in over 150 different languages. Cornerstone’s processing software is capable of processing almost any type of file, recognizes image files (such as PDF, TIF and JPG) without text for OCR, parses any type of embedded object, and maintains multiple level document hierarchies to ensure the most accurate data extraction possible. Cornerstone takes advantage of today’s technological breakthroughs in virtualization and global software development. It runs on virtual servers tied to individual microprocessor cores which work in tandem to give unprecedented scalability and speed. Cornerstone’s virtual-machines process divide work among each of its units, then collect the product from each and organize it into its proper order. For example, a quad-core processor can run up to four processing servers simultaneously and complete a unified task at a much higher rate of speed. Preserving and safeguarding the integrity of client data is paramount; thus Cornerstone infrastructure and processing environment is a SAS -70 Type II certified, highly restricted, scalable environment and designed in accordance with electronic data processing best practices and quality control procedures.

Foreign Languages

Cornerstone technology can not only display, search and process in more than 150 different languages, including Chinese Japanese, and Korean, it can automatically detect the language of origin and index the document accordingly, allowing for more efficient searching and more effective assigning of documents. Cornerstone is capable of processing languages in several Unicode formats in addition to non-Unicode single and double-byte formats. Furthermore, intelligent searching processes are capable of adjusting terms to be run over left to right, right to left, and other language-specific syntax.

Email

Cornerstone processes data from a variety of email server and client applications in its native format, including Microsoft Exchange (EDB), Outlook (PST), Lotus Notes (NSF), cc:Mail, Thunderbird and more. Cornerstone is also capable of processing non-standard email formats such as Eudora, MBox, GroupWise, Netscape and others by using industry-leading conversion techniques. Emails can be processed and grouped on a customer-defined basis and Cornerstone captures all mail items regardless of its originating folder (sent items, inbox, deleted items, etc.) or message type (contact, task, calendar event, etc.) in order to allow the clients the flexibility to review only what they deem necessary.

Electronic Files

Cornerstone has engineered its process and technology to handle any type of document, even system and proprietary filesin addition to the standard Microsoft Office applications and other common formats such as Acrobat, HTML and text files. Cornerstone can also limit its process to only include user-created files on a per custodian basis.

Production

Cornerstone Project Managers and Consultants work with clients to determine the optimal form of production for their case based on the expectations of opposing parties; court or regulatory-mandated requirements; the relative risk of inadvertent production; difficulties in redacting and tracking of native files; and the relative costs and burdens involved.

Native Productions

Production in a native format can be cost effective, as file conversion becomes unnecessary. Native productions, however, also provide access to all associated metadata so an additional level of review is necessary as such metadata could contain privileged information that should not be shared. Cornerstone works with its clients to mitigate this risk and is familiar with the requirements of regulatory bodies such as the Securities and Exchange Commission and divisions of the Department of Justice.

Cornerstone’s native production services include the following:

• Reconstitution of PST, NSF and other container files
• Scrubbing of metadata within native files
• Naming native files with client-specified production numbers
• Hybrid productions to support redaction and minimize cost of converting large files such as spreadsheets and presentations

Image Productions

Images such as Tagged Image File (TIFF) and/or Adobe Portable Document Format (PDF) formats are the most common forms of production. Images have the advantage of being a static format that can be Bates numbered and redacted, and it is also harder to accidentally alter the data and easier to control the metadata that is produced. However, because files must be converted, image productions often require additional processing time and cost and it is often necessary to produce accompanying text and/or metadata.

The Federal Rules of Civil Procedure dictate that reasonable efforts must be made to preserve, collect and produce to adversaries any evidence related to anticipated litigation and where forensic services are typically required. However, civil litigation typically does not require the same order of magnitude as criminal matters, and appropriate tools, processes and economies of scale can be applied to increase speed and reduce cost and risk throughout the process. By combining Cornerstone’s forensic expertise with its experience in electronic discovery and by working with its clients to determine the specific case needs and potential risks Cornerstone creates the right defensible forensic solution for each particular matter.

Benefits

1. Speed Cornerstone forensic engineers are able to simultaneously image multiple computer systems,effectively doubling or tripling the speed of other service providers. Overall electronic discovery project velocity is further increased by Cornerstone’s Forensic Culling process, which safely and effectively isolates essential data and funnels out the extraneous items.
2. Cost Cornerstone understands the balance between eDiscovery and forensics and can design a cost-effective yet still reasonable and defensible approach for any matter. Also, by employing Forensic Culling, Cornerstone can significantly reduce the base population of data that is ultimately subjected to processing, reviewing, hosting and production, reducing overall electronic discovery costs by up to 50% or more.
3. Defensibility Cornerstone follows Department of Justice guidelines for the handling of all evidence. Each step of the discovery process is fully documented and all findings are supported by facts obtained during examinations. Cornerstone’s professionals have a variety of certifications including CCE, CHFI and EnCE. Certified and reliable experts handle all planning and work.
4. Documentation For all evidence collected, the chain of custody is properly documented to assure integrity and provide an audit trail back to the original source. This includes numbering and tagging of evidence, photographing computer systems and relevant components, and thoroughly recording all descriptive details such as the make, model, serial number, employee name, and asset ID that are associated with each device from which evidence is collected.
5. Security Cornerstone’s standard best practices for handling evidence include measures to ensure that it is not altered in any way during the collection process and can be safely preserved. Cornerstone employs the latest advanced tools and software such as write blocking appliances which prevent change or damage to originals. Specialized forensic tools and processes such as hash comparisons are used to verify that an exact copy is acquired and preserved.

Forensic/Collection

Cornerstone’s standard best practices for handling evidence include measures to ensure that it is not altered in any way during the collection process and can be safely preserved. Cornerstone employs the latest advanced tools and software such as write blocking appliances which prevent change or damage to originals. Specialized forensic tools and processes such as hash comparisons are used to verify that an exact copy is acquired and preserved.

Expert Testimony

Cornerstone experts cannot only develop a defensible process based on best practices and the Federal Rules, they will also testify in hearings or in court as to the validity of that process. Cornerstone can also provide expert services to audit and analyze the preservation efforts of opposing parties and provide documentation in support of briefings.

Cornerstone’s Computer Forensic Services include the following disciplines:

•     Collection planning
•     Link analysis
•     Data preservation and collection
•     Advanced forensic analysis
•     Computer user profiling
•     Password decryption
•     Data imaging
•     Cell phone seizure and data acquisition
•     Email server mailbox collection & verification
•     Cellular phone analysis
•     Advanced email investigation
•     Evidence custody chain and
•     Digital investigation reporting
•     inventory tracking
•     Expert testimony
•     Preliminary forensic culling & filtering
•     Declaration and reporting
•     Exhibit production
•     Deleted file recovery
•     Registry analysis

Cornerstone provides its clients with cost efficiency in the forensics process by designing a specific solution based on the needs of the client and the matter. In addition, Cornerstone helps its clients save throughout the discovery process by forensically and defensibly culling data. Forensic Culling reduces the amount of data that must be subsequently processed and searched from custodian hard drives after they’ve been collected and imaged in the field. Typical forensic reduction only involves the elimination of system files by using NIST or NLRS known system file lists as a guide, but Cornerstone’s Forensic Culling goes beyond traditional de-NISTing to include and isolate other extraneous folders such as program files or IT user accounts. These can hold large volumes of data that are typically not useful or relevant for electronic discovery review. For example, the PC may contain a profile which is merely used for IT administrative purposes to store a backup of the installation set or standard package of applications, utilities and shortcuts to resources that are deployed for all users within their organization. Cornerstone individually can confirm each such case and omit them from the data extractions where appropriate. Typically, less than 50% of the data remains to be forensically extracted, resulting in a greater than 50% reduction in downstream processing, hosting and review costs.