As an attorney, you're fluent in legalese, but many of the folks you work with during e-discovery seem to only speak "IT."  This second entry in the EDD Dictionary is set up just like the first (found here); each common, EDD-related word is followed by its definition, the "attorney equivalent," and an example sentence.

locally (LOH-kuh-lee)

-adverb: regarding an action that takes place on a specific device without other devices getting involved; the opposite of "remotely"

Attorney equivalent:  on their computer; on that server (context-dependent)

Examples:

     1. You should search the custodian's hard drive; those user-created files are usually saved locally. (meaning they are saved on the custodian's hard drive)

     2. Once that computer receives the data, it's all processed locally. (meaning the data is processed on that computer alone)

PST file (pee-ess-TEE fil)

-noun: also known as a personal storage folder, this file stores e-mail messages, contacts, and calendar appointments from a Microsoft Outlook user's profile and is usually located on a user's hard drive.  (Note: whether or not a user will have a PST file depends on how Outlook is set up.)

Attorney equivalent: Outlook mailbox; Outlook messages, contacts, and calendar

Examples:

     1. The company wasn't using an Exchange Server; were you able to find a PST file on the custodian's hard drive so we can extract the mail items?

machine (muh-SHEEN)

-noun: synonymous with "computer;" an electronic device that performs mathematical and logical calculations and which stores digital data

Attorney equivalent: computer

Examples:

     1. That machine always seems to give me problems.

ESI (spoken as individual letters)

-acronym: short for "Electronically Stored Information;" any information that is digitally created, manipulated, communicated, or stored

Attorney equivalent: computer data

Examples:

     1. This is the attorney who will be directing the ESI collection in Denver next week.

Check out the first entry in the EDD Dictionary, where we cover "acquisition," "dupe," "image," and "user-created files."

Welcome to the first post from JD&A's "EDD Dictionary."  I've created a short list of words that I hear used in certain EDD situations which attorneys might not be familiar with.  This entry is set up like an excerpt from a dictionary.  Each word is followed by its definition, "attorney equivalent," and examples of the word being used in everyday language.

We'll be adding to the EDD Dictionary in future posts.  (If you'd like, you can stay updated with our RSS feed!)

acquisition (ak-wuh-ZISH-uhn)

-noun: the act of gaining possession of the data that is stored on an electronic medium

Attorney equivalent: collection

Examples:

     1. Tom did not answer his phone because he was in Texas on an acquisition.

dupe (doop)

Primary use:

-verb:  to create a duplicate copy of an electronic medium

-noun: a duplicate copy of an electronic medium

Attorney equivalent: bit-stream copy, bit-for-bit copy

Examples:

     1. We need to dupe Mr. Craig's laptop before 2pm. (verb)
     2. Here is the dupe we made of Ms. Johnson's external drive. (noun)

Alternative use:

-noun: a duplicate copy of a file

Attorney equivalent: duplicate, copy

Examples:

     1. I'll bet more than half of these emails are dupes.

 image (IM-ij)

see "dupe" (primary use)

user-created files (YOO-zur  kree-EYT-ed  filz)

-noun: files, usually selected by file type, that are typically created by a user instead of by the operating system or an automated process

Attorney equivalent: files created by a custodian (Word documents, Excel documents, PDFs, etc.)

Examples:

     1. I gave the attorney a list of the user-created files that were on the system.

Check out the second entry in the EDD Dictionary, where we define "locally," "PST file," "machine," and "ESI."

In a recent article by Jessica Mintz, Guidance Software gets blasted for botching an internal E-Discovery request.  It is not uncommon for companies to make mistakes when providing Electronically Stored Information (ESI) for an E-Discovery request.  It is a relatively new concept, and companies are struggling to adapt.  This issue is ironically highlighted when is happens to the developers of EnCase, which is one of the most widely used computer forensics software packages.

Guidance Software has been around since 1997, and is a leader in the computer forensic software market.  Its flagship product, EnCase Forensic Edition, is probably the most widely used piece of software by computer forensic specialists. The main use of the software is recovering and reviewing data found on digital media.  Guidance has apparently failed to produce emails relevant to the wrongful-termination case of ex-marketing director Cassondra Todd.  After several months of searching, Guidance has reportedly been unable to locate the emails in question.  So what happened to the emails in question?  Here are 4 hypothetical scenarios that may explain the absent emails:

• EnCase software failed to find the relevant documents. This is very unlikely as EnCase is recognized as an industry standard and used by computer forensics specialist worldwide.
• Guidance employees are withholding the relevant emails. Again this scenario is also highly unlikely as failing to do so could result in dire consequences (just ask Qualcomm).
• Guidance Employees lack the talent to identify and pull the data with the right tools. Also highly unlikely; Guidance developed the tool. It's safe to say they know how to put it to good use.
• Guidance lacks a proper data retention policy, and the emails have been inadvertently lost or destroyed. While hopefully not the case, it has the potential of being the most realistic scenario of the four (speculative) possibilities; in our experience, many companies lack an adequate data retention policy.

It is very important for companies to have an up to date data retention policy in place, since even the best piece of forensic software will not be able to recover an email if it no longer exists within a companies' infrastructure.  A study (How Much Information? 2003) done in 2002 showed that 92 percent of the  new information created that year was stored on magnetic media such as hard drives and tapes.  ESI is playing a growing part in both civil and criminal cases, so it is crucial for a company to preserve new information it creates.  A solid retention policy helps to keep track of and preserve the 90 plus percent of information stored electronically.  Data retention is especially important when it comes to legal holds, at which point any user created documents such as emails and Word documents should not be deleted.

In the end, having the proper software and hardware is only half the battle. The best forensic software is only helpful if used properly by well-qualified individuals and, if the underlying data is maintained pursuant to an up to date document retention policy.

Many cases hinge entirely around the contents of e-mail and attachments.  Because of this it's important to have a basic understanding of the structure of the most common enterprise e-mail applications.

Types of E-Mail Servers
     Microsoft Exchange
     IBM Lotus Notes
     Novell GroupWise
E-Mail is Boxes within Boxes
Where is the E-Mail Located?
     Server-Based
          Microsoft Exchange with Outlook
          IBM Lotus Notes
          Novell GroupWise
     Webmail
     Webmail through Outlook
     Outlook Express
     Windows Mail
Other Strange Sources of E-Mail
     E-Mail Backups May Be Your Friend
     E-Mail Appliances
 

Types of E-Mail Servers

In most environments, there are three types of e-mail or messaging server commonly in use.  Typically these are Microsoft Exchange, IBM Lotus Notes or Novell GroupWise.  It is not unusual in large enterprise environments to have any combination of these e-mail servers in use.  This is particularly common in situations where a company has acquired many smaller companies over a period of years.

• Microsoft Exchange - Microsoft Exchange is the most commonly encountered mail server in most corporate environments. Extraction of individual user mailboxes, referred to as PST files, from a Microsoft Exchange server is easily accomplished with a Microsoft provided tool called EXmerge.
• IBM Lotus Notes - Lotus Notes is the second most commonly encountered mail server. Extraction of individual user mailboxes, referred to as NSF files, is easily accomplished.
• Novell GroupWise - Novell GroupWise is an older mail server package no longer found is commonly in most environments. Novell GroupWise is known for its reliability and ease of maintenance, which keeps it from being replaced by newer systems. Extraction of individual user mailboxes, referred to as simply mailboxes, is notoriously difficult. Extraction of GroupWise mailboxes requires network access to the GroupWise server, GroupWise administrator permissions and expensive third-party software.

The bottom line on mail servers is, Microsoft Exchange and Lotus Notes are easy, Novell GroupWise is hard.

E-Mail Is Boxes within Boxes 

Modern e-mail servers and e-mail clients such as Microsoft Outlook and Exchange do not store e-mail on hard drives and in simple formats like text.  Modern e-mail systems store e-mail in a proprietary database within other proprietary databases, the box within a box.  For example: Microsoft Outlook stores e-mail in a PST or OST file, which are actually containers for the e-mail messages and attachments.

In short, without the proper viewer (in this case, Microsoft Outlook) we cannot actually view the contents of a PST or OST file.  If we were to attempt to open an individual's PST file without the proper viewer it would simply look like machine garble.

To make matters more complicated, individual user mailboxes are stored in yet another database on the server.  In the case of Microsoft Exchange, user mailboxes are stored in an Exchange Database file called an EDB file.  To complete our box within a box analogy; a users e-mail is stored in a Microsoft Outlook PST file that is the first box, which is then stored in a Microsoft Exchange Database file, which is the second box.

There are a number of E-Discovery ramifications to the storage of e-mail databases within databases:

• The server e-mail database may actually be several databases, none of which can be copied or forensically acquired while the mail server is running.
• Some mail servers do not store all of the users e-mail on either the server or on a user's computer; rather some of the users e-mail is stored in both locations.
• Some e-mail systems utilize complicated security structures to protect user's mailboxes. This security can make the acquisition of e-mail for authorized E-Discovery purposes very difficult.
• In some environments, System Administrators make extensive use of mailbox encryption and compression features. Encrypted mailboxes require additional processing time, while the mailboxes are decrypted or passwords recovered. Compressed mailboxes may result in unrealistic collection expectations as the amount of e-mail, a compressed mailbox may be up to 10 times the size of the compressed mailbox.

Where Is the E-Mail Located?

Depending on which e-mail solution is used, and individual users e-mail can reside only on their local computer, only on the e-mail server or a combination of both.  By default, each e-mail solution has its own way of handling individual user e-mail storage; however, it is important to keep in mind that an e-mail administrator can configure user e-mail storage however he likes.  E-mail is usually stored as follows:

Server-Based: 

• Microsoft Exchange with Outlook - Current Microsoft Exchange e-mail can always be acquired directly from Microsoft Exchange server. In most environments users also have an Outlook PST file on their computer that may contain more information than what is stored on the Microsoft Exchange server. Microsoft Outlook users also frequently have OST files on a computer. OST files, also known as Off-Line Folder files. The OST file makes it possible for the user to work within Outlook while disconnected from a Microsoft exchange server and then synchronize next time their online. Because PST files and OST files may contain differing information is important to acquire both. It is also quite common for users to archive old e-mail by creating additional PST files. This means on a user's computer there could be several PST files and OST files that may all contain different relevant e-mail information. The default location of a PST file in Windows XP is C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Outlook. For Windows Vista, it is C:\Users\user\AppData\Local\Microsoft\Outlook. (Replace user with the user name specific to the computer)
• IBM Lotus Notes - Lotus Notes e-mail is stored in NSF files on the user's local system, as well as on the Lotus Notes or Domino server. Processing of Lotus Notes e-mail may also require the names.NSF and user.ID files from the user's computer. These two additional files contain security information that may be required to properly process the e-mail. Frequently, Lotus Notes and NSF files are simply converted to Outlook PST files to make them easier to process. The default location of a NSF file in Windows XP is C:\Documents and Settings\user\Local Settings\Application Data\Lotus\Notes\Data. For Windows Vista, it is C:\Users\user\AppData\Local\Lotus\Notes\Data. (Replace user with the user name specific to the computer)
• Novell GroupWise - Novell GroupWise e-mail is stored in a series, typically five, database files on the Novell GroupWise server. Expensive third-party software must be used with administrator rights to extract user mailboxes from Novell GroupWise servers. Once acquired, Novell GroupWise mailboxes are also typically converted to Outlook PST files to make them easier to process. GroupWise does not create any storage on a users machine unless the user initiates it. In this case the user specifies where the file is saved and it receives and MLM extension.

Webmail:

Webmail is a type of e-mail that is hosted on an outside company's website and accessed through an internet connection.  The most common webmail providers are Yahoo, Google (gmail), AOL, and MSN (hotmail).  Although webmail is more commonly used as a personal e-mail account, it is not uncommon for employees to use it for business as well, especially for smaller companies that don't have the need for an e-mail server.

In its rawest form, all e-mail is stored on the provider's server (i.e. Yahoo mail is stored on a Yahoo server).  The only trace of the e-mail that will be found on the user's computer will be in their temporary internet files.  While it is possible to sometimes see full messages in these temporary files, they are typically only crumbs compared to the full content of their mailbox.  If discovery requires access to all of the mail from a webmail account, the webmail provider will usually release it with a proper subpoena.

Webmail through Outlook:

It is possible for a user to setup Outlook to download webmail so that it can be accessed without using the web interface and can be viewed while offline.  By default, Outlook will only download the titles of the e-mail.  Once the user clicks an e-mail to view it, it will download the content.  Any downloaded information is stored in a local PST file.  This PST file and its contents are easily accessible for discovery off of the user's machine but it will only contain the mail that has been accessed through Outlook.

Outlook Express:

Outlook Express is similar to Outlook but it has less features.  It is usually more common for personal use as it comes preinstalled on most computers.  Outlook Express stores the e-mails in separate, folder-named DBX files such as Inbox.dbx.  Usually DBX files need to be converted to PST in order to be processed.  The default location of DBX files on Windows XP is C:\Documents and Settings\user\Local Settings\Application Data\Identities\{###}\Microsoft\Outlook Express. (Replace user with the user name specific to the computer and ### will be a long string of random letters and numbers.)

Windows Mail:

Windows Mail is the Vista replacement for Outlook Express.  It has now been replaced by Windows Live Mail.  Unlike Outlook Express, both versions of Windows Mail use individual files to save your e-mail messages instead of container files.  Mail items are saved as EML files.  The default location for EML files in Windows Vista is C:\Users\user\Local Settings\Microsoft\Windows Mail\Local Folders.  (Replace user with the user name specific to the computer)

Other Strange Sources of E-Mail

E-Mail Backups May Be Your Friend:

The availability of e-mail is considered to be business-critical in most environments.  Because of this most IT departments make regular backups of user mailboxes and mail server databases.  It is important to find out how e-mail is backed up, and how often e-mail is backed up.  Some IT departments will regularly backup individual user mailboxes, while others simply pack up the entire mail server database.  In either case, it may be preferable to acquire a copy of a recent e-mail backup rather than interrupt a business-critical system.

Another advantage of e-mail databases and user mailboxes recovered from backups such as magnetic tape is that the backups may contain older e-mails that are no longer available on either the mail server or the individual user's computer.  This can be a very important distinction as many IT departments enforce strict mailbox size and age limits on "live" e-mail (email still on servers) that would not apply to backups. 

E-Mail Appliances:

In most large enterprise environments local delivery of e-mail to users is handled by an e-mail server such as Microsoft Outlook or IBM Lotus Notes.  Incoming and outgoing organizational e-mail will often pass through a high-performance e-mail appliance and commonly a spam/antivirus filtering appliance.  These appliances are sometimes known as mail gateways or Mail Transfer Agents (MTA).  E-mail appliances are purpose built computers designed to handle e-mail at speeds and volumes that a normal computer could not handle.  E-mail appliances do not usually keep copies of incoming or outgoing e-mails, but they do often log the sender and destination e-mail addresses.  This may be helpful in cases where the knowledge of the communication is more important than the content.