eDiscovery & Digital Evidence

This 5-day course will provide you with an understanding of Electronic Discovery, starting with an introduction to discovery in Australian civil litigation and the Electronic Discovery Reference Model (EDRM). You will learn about the complexities of electronic data, including data storage media and metadata, and practice identifying digital storage media and working with metadata.

This class will also cover the critical role of processing in electronic discovery, including encoding, steganography, and data mapping. You will learn about opportunities and obstacles related to electronic discovery from mobile devices, preserving social media content as evidence, and using search protocols to hone your search skills.

By the end of the class, you will have knowledge on how to handle sensitive data with care, maintain the integrity of digital evidence, and comply with electronic discovery rules and protocols.

Learning Outcomes

Questions that will be answered in this class include:

• How do computers store data?
• What are the differences between common storage media?
• What’s the difference between system and application metadata?
• What’s cryptographic hashing and how do I use it?
• How do computers encode data?
• How do computers use binary signatures and file extensions to distinguish file types?
• How are foreign languages encoded differently from English?
• What are the seen and unseen elements of an e-mail message?
• Where does deleted data go if it’s not really gone?
• How are deleted data recovered?
• How are data preserved, processed and presented for attorney review?
• How do we cull and filter to reduce data volumes and isolate relevant evidence?
• How do search tools and review platforms operate?
• What is forensic imaging?
• What are load files, how are they used and what challenges do they present?
• What impact do alternate forms of production have upon cost and utility?

Course Outline

• Introduction to Discovery in Australian Civil Litigation
• Electronic Discovery and Digital Evidence: What we need to Know
• The Electronic Discovery Reference Model (EDRM)
• Introduction to Data Storage Media
  • Identifying Digital Storage Media
• Introduction to Metadata
  • Metadata and Hashing
  • System and Application Metadata
  • Geolocation in EXIF
• Introduction to Digital Forensics
• Processing in E-Discovery
  • Encoding: Decimal, Binary, Hexadecimal and Base64
  • Encoding: Running the Bases
• Encoding and Steganography
• Processing Part II
  • Encoding: File Extensions
  • Encoding: Binary Signatures
  • Encoding: Unicode
• Processing Glossary
  • Metadata: File Table Data
• The Big Six: Getting your Arms around the ESI
  • Compiling a Checklist of Sources
• Guide to Computer Backup Systems
• Databases in E-Discovery
  • Data Mapping
  • E-Mail Anatomy
  • Encoded Time Values in Message Boundaries
• The Next Arc of Exercises
• Custodial Trust but Verify
  • Forensic Imaging
• Opportunities and Obstacles: E-Discovery from Mobile Devices
• Simple, Scalable Solutions to iOS-Device Preservation
  • Preserving a Mobile Device
• Obtaining and Preserving Social Media Content as Evidence
• Search Science and The Streetlight Effect in e-Discovery
  • Honing Your Search Skills
  • Negotiating Search Protocols
  • Processing, Culling, Search and Export
• Forms that Function
  • Forms of Production and Cost
• The Annotated E-Discovery Protocol: A Primer on ESI Protocols
  • Technology Assisted Review
  • Meet and Confer
• The “E-Discovery Rules” – Civil Procedure