COURSE SUMMARY 

Gain an understanding of Electronic Discovery, starting with an introduction to discovery in Australian civil litigation and the Electronic Discovery Reference Model (EDRM). You will learn about the complexities of electronic data, including data storage media and metadata, and practice identifying digital storage media and working with metadata. 

This class will also cover the critical role of processing in electronic discovery, including encoding, steganography, and data mapping. You will learn about opportunities and obstacles related to electronic discovery from mobile devices, preserving social media content as evidence, and using search protocols to hone your search skills. 

By the end of the class, you will have knowledge on how to handle sensitive data with care, maintain the integrity of digital evidence, and comply with electronic discovery rules and protocols. 

LEARNING OUTCOMES  

Questions that will be answered in this class include: 

1. How do computers store data?
2. What are the differences between common storage media?  
3. What’s the difference between system and application metadata?  
4. What’s cryptographic hashing and how do I use it?  
5. How do computers encode data?  
6. How do computers use binary signatures and file extensions to distinguish file types?  
7. How are foreign languages encoded differently from English?  
8. What are the seen and unseen elements of an e-mail message?  
9. Where does deleted data go if it’s not really gone?  
10. How are deleted data recovered?  
11. How are data preserved, processed, and presented for attorney review?  
12. How do we cull and filter to reduce data volumes and isolate relevant evidence?  
13. How do search tools and review platforms operate?  
14. What is forensic imaging?  
15. What are load files, how are they used and what challenges do they present?  
16. What impact do alternate forms of production have upon cost and utility? 

COURSE OUTLINE 

• Introduction to Discovery in Australian Civil Litigation 

• Electronic Discovery and Digital Evidence: What we need to Know 

• The Electronic Discovery Reference Model (EDRM) 

• Introduction to Data Storage Media
• Exercise 1: Identifying Digital Storage Media

• Introduction to Metadata 
• Exercise 2: Metadata and Hashing
• Exercise 3: Metadata: System and Application Metadata
• Exercise 4: Metadata: Geolocation in EXIF 

• Introduction to Digital Forensics 

• Processing in E-Discovery
• Exercise 5: Encoding: Decimal, Binary, Hexadecimal and Base64
• Exercise 6: Encoding: Running the Bases

• Encoding and Steganography 

• Processing Part II 
• Exercise 7: Encoding: File Extensions
• Exercise 8: Encoding: Binary Signatures
• Exercise 9: Encoding: Unicode 

• Processing Glossary 
• Exercise 10: Metadata: File Table Data 

• The Big Six: Getting your Arms around the ESI 
• Exercise 11: Compiling a Checklist of Sources

• Guide to Computer Backup Systems

• Databases in E-Discovery 
• Exercise 12: Data Mapping 
• Exercise 13: E-Mail Anatomy 
• Exercise 14: Encoded Time Values in Message Boundaries

• The Next Arc of Exercises

• Custodial Trust but Verify 
• Exercise 15 & 16: Forensic Imaging 

• Opportunities and Obstacles: E-Discovery from Mobile Devices 

• Simple, Scalable Solutions to iOS-Device Preservation
• Exercise 17: Preserving a Mobile Device 

• Obtaining and Preserving Social Media Content as Evidence 

• Search Science and The Streetlight Effect in e-Discovery
• Exercise 18: Honing Your Search Skills
• Exercise 19: Negotiating Search Protocols 
• Exercise 20A: Processing, Culling, Search and Export Part I 
• Exercise 20B: Culling, Search and Export, Part II

• Forms that Function
• Exercise 21: Forms of Production and Cost 

• The Annotated E-Discovery Protocol: A Primer on ESI Protocols 
• Exercise 22: Technology Assisted Review
• Exercise 23: Meet and Confer

• The “E-Discovery Rules” – Civil Procedure