Pitfalls in the use of Standard Document Management Systems and Search Tools to Find Evidence

Clients sometime baulk at the cost of running an e-Disclosure process to search for and within documents, especially when they have a Document Management System (DMS) within their organisation and their IT team may even be familiar with downloadable search tools.

The client, therefore, sees an unnecessary expense or a potential saving within a costly legal process. So why should the client pause for thought and consider the merits of allowing their legal team to run an e-Disclosure process?

The search tools and DMS that are typically available run at the operating system level. This means that they run in, for example, Windows, Linux or MacOS. When run, the search tools they use will often make changes to the file allocation tables and these, in turn, can affect the read/accessed and modified dates for each file. User permissions and Windows Access Control Lists will be respected whilst the operating system is running, and this will often prevent the search tool’s access to some of the files that need to be searched, erroneously returning few results

This is very bad where, as is commonly the case, dates are important and file integrity is paramount in order to verify the evidence. Evidence must be preserved in such a way as to prove its authenticity in a defensible ‘chain of custody’ in order to avoid any accusation of contamination or tampering. IT Group often see cases where the court asks to see what the file looked like prior to it being accessed for this litigation. Was it, for example, accessed on a critical date? Often, the counterparty has raised concerns that key documents have been tampered with, which is simply the result of a poorly conducted search and review.

Further, these types of search tools are only capable of looking within certain file types (often MS Office documents). Other document types, for example, CAD files, images, zip files, software source code, binary files, etc. are not capable of investigation with standard search tools.

Significantly, these search tools also respect file system boundaries. This means that where a disk has been formatted or a file deleted, those disk areas will not be searched. Personal email may have been used to avoid company systems. These are often only accessed via a web browser and only forensic web artefact extraction tools will recover these types of fragments. Some of these search tools are becoming available to the public over the internet. However, the level of training, experience and investment necessary, puts them beyond the reach of litigants and the process of attempting to use them can cause horrific problems for the user.

In the case of email searches the results delivered to the legal team, using DMS searches, may not include much of the key detail the lawyer needs. For example, the emails may not be presented as email ‘trails’, making it much harder and slower to track those involved and the dates of involvement. Duplications will also often be present, leaving a much larger number of documents to be reviewed by the lawyer and making the cost saving still less attractive.

e-Disclosure data sets processed by IT Group are signed off with an Expert Witness Statement and accompanied with a report describing the volumes, types, authors, languages, size and duplicates to quickly start to assess the necessary resources and agree on budgets.