Computer Metadata File Electronic Discovery Workbook 2016 University of Texas School of Law LAW335E: E-Discovery and Digital Evidence Fall 2016 Ver. 16.0818 © Craig Ball, All Rights Reserved Name: Course Workbook Reading Assignments NOTE: This table is for your convenience; but, the timing and scope of your responsibilities in this course are established by the latest Syllabus, not this table. Always go by the Syllabus!! The following Workbook exercises and readings should be completed prior to the start of class on the dates set out for same below. There will always be additional readings on Canvas. Monday, August 29 Read pp. 4-84; Complete Exercise 1 Monday, September 12 Read pp. 85-101; Complete Exercise 2 Monday, September 19 (No class meeting this date) Read pp. 102-175; Complete Exercises 3-8 Monday, September 26 Read pp. 176-234; Complete Exercises 9-12 Monday, October 3 Read pp. 235-283, Complete Exercise 13 Monday, October 10 Read pp. 284-327; Complete Exercise 14, Part 1, pp. 282 Monday, October 17 No Workbook selections Monday, October 24 Read pp. 328-351; Complete Exercise 15 Monday, October 31 Read pp. 352-385; Complete Exercises 16-17 Monday, November 7 Read pp. 386-402; Begin Exercise 18 1 Contents Goals for this Workbook ...................................................................................................... 4 Introduction to Electronic Discovery and Digital Evidence .................................................... 6 Introduction to Discovery in U.S. Civil Litigation ................................................................... 9 The “E-Discovery Rules” (1,16,26,34 & 45) of the Federal Rules of Civil Procedure With Committee Notes accompanying 2006 and 2015 Amendments .......................................... 14 TRCP Rule 196.4 Electronic or Magnetic Data (enacted 1999) ............................................ 59 Electronic Discovery Reference Model ............................................................................... 60 What Every Lawyer Should Know About E-Discovery ......................................................... 62 Introduction to Digital Computers, Servers and Storage .................................................... 66 Exercise 1: Identifying Digital Storage Media ..................................................................... 84 Getting your Arms around the ESI Elephant ....................................................................... 85 Exercise 2: Data Mapping ................................................................................................... 91 Introduction to Digital Forensics .......................................................................................102 Exercise 3: Forensic Imaging ..............................................................................................132 Exercise 4: Encoding: Decimal, Binary, Hexadecimal and Base64 ......................................144 Exercise 5: Encoding: Running the Bases ...........................................................................158 Exercise 6: Encoding: File Extensions .................................................................................163 Exercise 7: Encoding: Binary Signatures ............................................................................170 Exercise 8: Encoding: Unicode ...........................................................................................173 Opportunities and Obstacles: E-Discovery from Mobile Devices .......................................176 Introduction to Metadata .................................................................................................184 Exercise 9: Metadata and Hashing ....................................................................................210 Deep Diving into Deduplication.........................................................................................216 2 Exercise 10: Metadata: File Table Data ..............................................................................224 Exercise 11: Metadata: System and Application Metadata ................................................228 Exercise 12: Metadata: Geolocation in EXIF ......................................................................230 Mastering E-Mail in Discovery ...........................................................................................235 Exercise 13: E-Mail Anatomy .............................................................................................273 Custodial Hold: Trust but Verify ........................................................................................277 Elements of an Effective Legal Hold Notice .......................................................................279 Exercise 14: Legal Hold ......................................................................................................282 Luddite Lawyer’s Guide to Computer Backup Systems ......................................................284 Databases in E-Discovery ..................................................................................................303 Search is a Science ............................................................................................................328 Exercise 15: Processing, Culling, Search and Export ...........................................................340 Forms that Function ..........................................................................................................352 Exercise 16: Forms of Production: Load Files .....................................................................372 Exercise 17: Forms of Production and Cost ........................................................................378 Preparing for Meet and Confer .........................................................................................385 Exercise 18: Meet and Confer ............................................................................................398 APPENDIX A ......................................................................................................................402 Materials for use with Exercises 14 and 18 ........................................................................402 3 Goals for this Workbook The goal of the exercises and readings in this Workbook is to completely change the way you think about electronically stored information. Despite its daunting complexity, all digital content—photos, music, documents, spreadsheets, databases, social media and communications—exist in one common and mind-boggling form: More than 95% of the information in the world exists on electromagnetic hard drives as an unbroken string of ones and zeroes, memorialized as impossibly tiny reversals of magnetic polarity. These minute fluctuations must be read by a detector riding above the surface of a spinning disk on a cushion of air one- thousandth the width of a human hair in an operation akin to a jet fighter flying around the world at more than 800 times the speed of sound, less than a millimeter above the ground…and precisely counting every blade of grass it passes. That’s astonishing, but what should astound you more is that there are no pages, paragraphs, spaces or markers of any kind to define the data stream. That is, the history, knowledge and creativity of humankind have been reduced to two different states (on/off…one/zero) in a continuous, featureless expanse. It’s a data stream that carries not only the information we store but all of the instructions needed to make sense of the data, as well. It holds all of the information about the data required to play it, display it, transmit it or otherwise put it to work. It’s a reductive feat that’ll make your head spin…or at least make you want to buy a computer scientist a beer. These exercises and readings are designed to get you thinking about the fantastic journey data takes from its simple, seamless existence as an endless stream of ones and zeroes to the seemingly-endless variety of documents, communications, records and formats that confound us in e-discovery. These exercises and readings will help you answer such questions as: 1. How do computers store data? 2. What are the differences between common storage media? 3. How do computers encode data? 4. How do computers use binary signatures and file extensions to distinguish file types? 5. How are foreign languages encoded differently from English? 6. What’s the difference between system and application metadata? 7. What are the seen and unseen elements of an e-mail message? 8. Where does deleted data go, if it’s not really gone? 9. How are deleted data recovered? 10. How do search tools and review platforms operate? 11. What is forensic imaging? 4 12. What are load files, how are they used and what challenges do they present? 13. What impact do alternate forms of production have upon cost and utility? 14. What are the key elements of an effective, cost-effective and defensible legal hold? 15. What should occur at meet-and-confer? Some of these questions may seem hyper technical and far removed from the day-to-day of e- discovery and the practice of law; but, they serve as essential building blocks in a solid foundation for development of practical skills. The absence of a solid foundation ultimately limits how high you can go. Thank you for enrolling in this class. Together, I hope we can make it a course you will value all your life. Craig Ball, August 18, 2016 5 Introduction to Electronic Discovery and Digital Evidence Discovery is the legal process governing the right to obtain and the