Understanding And Controlling EDisclosure Costs

EDISCLOSURECOSTS · AGUIDEFORUKLAWYERS Understanding and Controlling eDisclosure Costs The Multiplication Chain, and How to Break It COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: why disclosure bills shock 03 The anatomy of the bill: six cost stages 04 Expansion: why one gigabyte becomes two and a half 05 The multiplication chain, worked numerically 06 The review population: the biggest lever 07 Ten control levers 08 Budgeting and costs management 09 Reading a provider quote 10 Worked example: one matter, two cost stories 11 Common mistakes and technical limitations 12 Questions to ask · Suggested wording 13 Checklist and red flags · When to involve a digital forensic expert 14 Frequently asked questions 15 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : COSTSAREAMULTIPLICATIONCHAIN , ANDCOLLECTIONISITS FIRSTTERM § 0 2 · FIRSTPRINCIPLES The problem in plain English: why disclosure bills shock § 0 3 · THEBILL The anatomy of the bill: six cost stages § 0 4 · THEHIDDENMULTIPLIER Expansion: why one gigabyte becomes two and a half § 0 5 · THEARITHMETIC The multiplication chain, worked numerically CHAIN STAGE A · INDISCRIMINATE B · ASSESSED AND CULLED § 0 6 · THEDOMINANTTERM The review population: the biggest lever § 0 7 · THECONTROLS Ten control levers LEVER WHAT IT DOES 1 · Assess before you collect In-place volume reports, sampled richness and overlap measurement turn scoping 2 · Scope collection tightly Targeted, documented collection of tiered custodians and sources; forensic imaging 3 · Cull at processing deNISTing, global deduplication, date bounding and hit-tested terms applied where 4 · Thread and near-duplicate Review inclusive thread tails and cluster near-duplicates; routinely a third off the 6 · Stage the exercise Core scope now, extensions behind evidence-defined triggers; money follows the 7 · Negotiate terms with data Hit reports and sampled relevance rates in the exchange; negotiated culling terms 8 · Run hosting hygiene Promote selectively, archive released tranches to cold storage, decommission at 9 · Engineer the review Propagation, batching, decision trees, pace monitoring and seniority-matching; buy 10 · Buy well Itemised scenario quotes on stated assumptions (expansion factor, hosting term, § 0 8 · THECOURT ' SMONEYLENS Budgeting and costs management § 0 9 · BUYINGWELL Reading a provider quote § 1 0 · INTHEWILD Worked example: one matter, two cost stories RELLINGFORDVDANEHILLCOMPONENTS ( ILLUSTRATIVE ) § 1 1 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 2 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORANITEMISEDSCENARIOQUOTE SUGGESTEDWORDING · BUDGETASSUMPTION PA R AG RAPH ( DISCLOSUREPHASE ) § 1 3 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The cost-control checklist Red flags When to involve a digital forensic expert § 1 4 · COMMONQUESTIONS Frequently asked questions Our last disclosure bill was multiples of the estimate. What usually causes that? Is TAR actually cheaper, or just fashionable? Are eDisclosure costs recoverable from the losing party? What does hosting really cost over a matter? Should we push for fixed fees? Do costs arguments really move courts? § 1 5 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY