E-discovery requests have growing

impact on data storage




Storage managers will continue to address e-discovery needs, despite dire

economic conditions, due to regulatory requirements and potentially
increasing levels of litigation.








Carol Sliwa, Features Writer

08 Apr 2009

Despite dire economic times, the electronic discovery (e-discovery) market is

predicted to swell next year. In a growing number of vertical industries,
regulatory requirements and increased levels of litigation are driving a need
for e-discovery strategies, and forcing storage managers to be proactive in
building alliances with corporate counsel and business stakeholders.

In a Dec. 2008 report, Stamford, Conn.-based Gartner Inc. predicted that

spending on e-discovery software technologies and service offerings will grow
between 25% and 35% through 2012. A SearchStorage.com survey
conducted this year showed that just 14% of the 657 respondents have
implemented or will implement e-discovery tools this year.
One key change that drew the attention of corporate legal counsel were the
2006 amendments to the Federal Rules of Civil Procedure (FRCP), which
govern civil actions in federal courts. For the first time, the rules spelled out
obligations for preserving electronically stored information (ESI).

The industry generally defines the steps of the e-discovery process using
the Electronic Discovery Reference Model (EDRM), released in 2006, thanks
to the pioneering work of attorneys George Socha Jr. and Tom Gelbmann.
Storage processes fall primarily into the left side of the model, where
information management, identification, preservation and destruction occur.
Those are processes companies are outsourcing less as budgets shrink and
data archives grow.

"Because the amount of electronic information has gone up, we're seeing a
big move to doing the front half of the EDRM in-house for cost savings," said
Debra Logan, a Gartner vice president. "So they do collection, identification,
preservation and some processing."

E-discovery technology can cut costs

Patrick Oot, director of electronic discovery and senior litigation counsel at

Verizon, said using Guidance Software Inc.'s EnCase eDiscovery technology
has meant significant savings in collecting all types of data. Because
information is now gathered over the network, for instance, Verizon's security
team no longer needs to travel to remote locations.

"Software is definitely replacing a lot of manual labor," Oot said.

Verizon's e-discovery team is making a case to save money on the right half
of the Electronic Discovery Reference Model. The group claimed it would save
$11 million in outsourced vendor fees over three years if Verizon switched to
an in-house system, which would include infrastructure and software for data
processing, hosting and review. The proposed litigation support application
would require 5 TB to 10 TB of fast networked storage to host most of
Verizon's document review needs.

"Obtaining capital expenses is very difficult in this climate," said Oot. "Our
business case right now is under analysis by the finance group, and we're
awaiting approval."

E-discovery's impact on data backup

E-discovery's impact on storage is primarily felt in the data backup

environment, according to Brian Babineau, a senior analyst at Enterprise
Strategy Group in Milford, Mass. Corporate counsel often issues a blanket
order for IT to save everything -- email, files or databases -- for a specific time
period, and most companies have traditionally used tape to preserve the data.

The problems begin when organizations save too much data for longer than
they need to keep it, and that data is inaccessible or very expensive to find on
tape. At that point, moving to disk-based backup is critical, Babineau said.

"Electronic discovery has provided another catalyst to go to disk-based

backup," Babineau observed.

E-discovery has also forced storage teams to build systems of record and,
more specifically, archived systems. Implementing an archive is important to
ensure that important ESI will be accessible online, easier to search and
easier to delete.

"They've had to segregate the backup and archive process as a result of this,"
Babineau said. "Most companies believe that archiving is saving old backup
tapes for long periods of time. And it's not.
"Ideally," he continued, "I would prefer to go to my archive if I get a discovery
request, as opposed to having to go sift through all of my backups."

Email archiving and e-discovery

The purchase of an email archiving system often represents the first

substantial foray into e-discovery for storage professionals because e-mail is
the most requested type of content from a litigation perspective. Even if they
buy a product for a purpose other than e-discovery, they soon find it's a
godsend in the EDRM's collection step.

The buzz word "e-discovery" wasn't top of mind when DeKalb County
bought Symantec Corp.'s Enterprise Vault. Addressing the Georgia county
government's email management woes was. Still, the storage staff soon saw
requests that had taken eight hours or more to fulfill handled in minutes, and
the county realized a return on its Enterprise Vault investment in less than
year, according to Curtis Rawlings, the assistant chief information officer for
DeKalb County.

"A lot of times, you buy a product for one thing, and you find another use for
it," Rawlings said.

DeKalb County used to ferret out email from tapes, and if an employee had
deleted a message before the email was backed up, it was lost. Now that the
county has Enterprise Vault, management doesn't want IT to delete any
messages, Rawlings said.

Of course, this creates larger data stores. "The only problem is that I have to
buy more storage, but I don't have any problem retrieving it," Rawlings said.

DeKalb County now stores email on disk, but continues to back up the
messages on tape so it won't have to worry in the event of a disk failure.
Rawlings is pushing to establish retention policies in concert with the records
center, so IT will be able to delete messages that aren't needed for regulatory
purposes.

Bellevue, Wash., took its cue from the records management office and state-
driven mandates, according to Shayne Williams, a systems administrator for
the city. IT retains some content for seven years, some trial-related
information longer, and data generated by councilors and directors
permanently. The email-retention policy for ordinary employees is 90 days,
unless they designate messages as records and place them into special
folders, Williams said.

When the city of Bellevue purchased EMC Corp.'s EmailXtender archiving

product, the IT department was keenly interested in boosting the performance
of Microsoft Corp.'s Exchange Server and reducing the storage demands for
email.

Using EmailXtender and disk-based backup, IT was able to slash the

response to email requests from as many as four days to approximately two
hours, Williams noted.

Deletion policies key to e-discovery strategy

The first EDRM step, information management, applies to both retaining

content and deleting data that no longer has any business value or purpose in
meeting regulatory demands, stressed Brian Hill, a senior analyst at
Cambridge, Mass.-based Forrester Research Inc.

"There are so many organizations out there that take a 'save everything'
approach," Hill said. "That's dangerous from a legal risk-mitigation
perspective, and it ends up costing them quite a bit in total cost of ownership
by taking up additional storage that's not required and slowing down
application performance and searches."
Hill said organizations must recognize that all types of electronically stored
information, not simply email, are potentially relevant to e-discovery. Some
companies have dozens or hundreds of archives that vary depending on the
type of content.

"Historically, most of the archiving and retention systems have been deployed
in isolation from one another, so they have different classification schemes,
different retention policies, different storage strategies and so forth," Hill said.
"Simply finding that information, let alone disposing of it appropriately, is really
hard because most organizations have a really fragmented infrastructure."

Hill said he encourages organizations to seek out vendors that have the ability
to archive multiple content types and apply consistent retention and storage
policies.

Preserving data

The preservation step of the EDRM demands that companies be able to prove
to the court that relevant data has not been altered. Christine Taylor, an
analyst at Hopkinton, Mass-based Taneja Group, said users can put litigation
holds on the data in place or in a secure repository where users cannot
remove or delete it.

Jerry Karth, a systems administrator at Key Energy Services Inc., said the
Houston-based company opted for a document management system
and write once, read many (WORM)technology to prove that images had not
changed.

Michael Brooks, chief information officer at CVR Energy Inc., said he wants
avoid having to declare certain pieces of information as records and move
them to a separate records repository. The Sugar Land, Texas-based
company uses Autonomy Corp.'s eDiscovery technology to index and search
unstructured user data and EMC for disk-to-disk backup. The next step will be
nailing down retention policies and locking documents in place, Brooks said.

"I want to be able to find data wherever it is and manage it wherever it is,"
Brooks said.

Being able to preserve information in place would eliminate the need to make
extra copies of information. Single-instance storage technology is also
commanding interest in e-discovery circles.

"What everybody is trying to do is get this universe of discoverable data down

to manageable sizes," Taneja Group's Taylor said, "because it's enormously
expensive to review this data."