Deduplication Explained

DEDUPLICATION · AGUIDEFORUKLAWYERS Deduplication Explained Hashes, Scope Choices and Why "the Same Document" Is a Legal Question COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES EDRM PROCESSING PRACTICE § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the copies that eat the budget 03 How it works: hashes and what counts as identical 04 The scope decision: custodian-level vs matter-level 05 Email's special problems: near-copies that are not twins 06 Keeping what suppression hides: custodian tables and copy evidence 07 The forensic cousin: hashing as copy-tracing evidence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : DEDUPLICATETOREVIEWONCE , BUTRECORDWHOELSEHELD EVERYCOPY : SUPPRESSIONMUSTLOSECOST , NOTEVIDENCE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the copies that eat the budget § 0 3 · THEMECHANICS How it works: hashes and what counts as identical 83) handles resemblance; dedup handles identity only. § 0 4 · THESCOPEDECISION The scope decision: custodian-level vs matter-level § 0 5 · EMAIL ' SQUIRKS Email's special problems: near-copies that are not twins § 0 6 · WHATSUPPRESSIONMUSTKEEP Keeping what suppression hides: custodian tables and copy evidence § 0 7 · THECOUSINDISCIPLINE The forensic cousin: hashing as copy-tracing evidence § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION SUPPRESSION PRESERVED INSTANCE DUP / COUNTERPART FORENSIC TABLE SOURCES METADATA THREAD PRODUCTION LAYER NEAR- LAYER § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEMEMOTHATELEVENPEOPLEHELD EXAMPLE2 · THESCOPEFIGHTSETTLEDBYARITHMETIC EXAMPLE3 · THE " DUPLICATE " THATWASTHEFORGERY ' STWIN § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · DEDUPLIC AT ION PA R AG RAPHFORTHEDISCLOSUREPROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The deduplication checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Does deduplication delete documents? Custodian-level or matter-level: which should we agree? Can we still prove who received a document if their copy was suppressed? The same email seems to appear several times in the review set anyway. Why? Two productions contain "the same" contract. Do we need to check? Can deduplication data itself be evidence? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY