| 2 minute read

Early Case Assessment Helps Reduce eDiscovery Costs

man cost meter

 

Anyone who has been involved with an eDiscovery review project knows that the most expensive aspect is the review process. But a great way to keep costs down is to leverage technology and review less data. That’s why the team at Avalon suggests early case assessment (ECA). ECA can be described in numerous ways, but the simplest is: It’s a process used to get insight into data stores prior to full processing and review.

Insight is gained by ingesting data, then running any number of filters to provide preliminary reports. The non-responsive data is simply set aside, not deleted from your set, so you can go back and change methodologies/workflow at any stage of the project. Filters can then be refined as many times as needed to get the optimal result, i.e., the smallest data size required to be reviewed. Note that you can apply analytics during the ECA phase and take advantage of clustering, email threading, and conceptual searching.

Here are three way to help reduce collected data, so your review process is more efficient: 

System Files

Data is often collected from the local drives of custodians. Harvesting an entire local computer drive will get you copies of all the computer/non-custodial files on that machine. Except for very special cases, you probably don’t need to spend money processing and reviewing those underlying computer files. These underlying computer-generated files can be removed by running the data against the NIST list. (NIST, which stands for the National Institute of Standards and Technology, maintains a list of these applications with the National Software Reference Library project. So, to “deNIST” is to remove all the applications and files against this master list.) DeNISTing is a very common approach to removing computer files that do not need to be reviewed.

Deduplicating

No one wants to read the same thing twice – and spend money doing so – but you can prevent that by deduplicating. All electronic files have an electronic fingerprint that you can use to pull away duplicates within your source set. Standard deduplicating can be applied globally (across all data in your set) or by custodian (only within one custodian). Standard global or custodial dedupe is used in most data sets. Different data sets may benefit and/or require different deduping methodologies.

Keyword and Date Filtering

After system files are removed and your data set has been deduped, most clients will then apply date and keyword filters. These are the “go-to” methods to search and they can be the most powerful. It’s important to note, however, that date filtering will only be as good as the metadata that was collected (incorrect dates will produce incorrect results), and keywords are mostly an exact science applied to an inexact medium (especially true for email). Custodians can converse for days on a topic without explicitly mentioning it, so the context of a message may be just as important as the keywords used. Also, depending on the organization, they may also use code/nicknames for projects and may use specific jargon. So, for keywords, the best practice will be to interview your clients to get a sense of any commonly used terms prior to drafting your terms. You will also want the ability to review your hit results, so you can fine tune your keywords prior to processing and review.

Conclusion

Avalon’s ECA workflows let you analyze and synthesize processed data in the cloud quickly, so you can evaluate key facts, assess risk, determine your case strategy, and reduce cost. Our experienced team members can talk to you about your case and suggest the optimal workflow for navigating your various ECA options, which will ultimately save you and your clients time and money on review.

If you need assistance with eDiscovery or any of our other litigation support services, contact the experts at Avalon today.

Blog Articles

The CDK Incident and Recommended Actions from Avalon Cyber

Thousands of car dealerships’ operations slowed to a halt last Wednesday as their core dealer management system, CDK, shut down. CDK Global announced that they were investigating a cyber incident and “Out of an abundance of caution and concern for our customers, we have shut down most of our systems and are working diligently to get everything up and running as quickly as possible” according to spokesperson, Lisa Finney. The company said later that day that most of their critical systems were back online, but the next day they announced that another incident had happened.

Get Ready for the New 36-Hour Cyber Breach Notification Rule for Financial Institutions

If you’re in the financial sector, no doubt you’ve already heard, and hopefully, are prepared or preparing for, the new federal banking rule regarding cyber breach notifications. This new rule, which took effect April 1, 2022, with full compliance required by May 1, 2022, requires banking organizations and bank service providers to notify banking regulators within 36 hours after a notification event, which is the tightest timeframe in U.S. history.

Cybercriminals Never Sleep (And Neither Do We)

According to the latest cybersecurity industry research, market demand for Managed Detection and Response (MDR) services continues to climb. In fact, experts forecast that by 2024, 40% of midsize enterprises will use MDR as their only managed security service. That might sound like a large percentage, but because of the continued escalation of cyberattacks, more and more companies are realizing the importance of hiring experts to boost their cybersecurity posture.