I just recently wrote an issue paper on the adventures of dealing with e-discovery and the impact of the amended Federal Rules of Civil Procedure (FRCP). The FRCP defines the rules of engagement for litigants in civil cases and as of last year the rules have been amended to extend the definition of discovery to include any electronically stored information (ESI). Much of ESI discovery is focused on either finding the smoking gun email ("you want to do what with me? To keep my job?") or the smoking life ring email ("Please send me your business plan, we have no interest in expanding into your proposed market"). Unfortunately, in many cases the smoking gun or life ring are long gone by the time of e-discovery due to intentional, corporate retention, or accidental action.

What I find fascinating about ESI is that it's not just the native data but also the metadata - the data about the data - that may be dragged into a court case. The reason for the interest is because most IT systems store much of the metadata separate from the actual data itself. For example, in an email archive solution there are the actual data stores for the emails and then there are various logs and journals associated with the creation, manipulation, transport, storage and eventual deletion of the email. Just as gun shot residue (GSR) can lead to a conviction in the absence of a gun, the metadata of ESI can be incriminating (or exonerating) in the absence of an email.

So, how does one process the metadata? There are turnkey solutions on the market that will index and search through ESI: metadata and native data. These solutions are expensive and pre-set - and thus limited - in the types of metadata that may be indexed and searched in an e-discovery. A more flexible, extensible and certainly less expensive method is to apply IT Search tools to the metadata correlation and e-discovery process. With this approach, there is no limit to the types of meta-data that may be included in the search and there is less need to pre-plan email and database archive solutions around e-discovery. As long as the log and journal files are retained, the smoke may be searched even after the gun is long gone. DN0337