FORDHAM FORENSICS When It Really Matters770-777-2090
ESI Data Storage: When Will It Bite You?
The volume of Electronically Stored Information (ESI) has confronted litigators with numerous challenges. Generally, the issue has been how to process the data. Perhaps another unrecognized issue is how to store it, particularly the inactive data.
When the case is on-going the storage problem may not be obvious, since it is needed for day-to-day activities. The dilemma becomes more obvious, however, when the case goes into sleep mode while waiting for some kind of disposition like a decision on summary judgment motions or even for a final decision.
Actually, there are two basic categories of data that factor into the storage equation. One is the produced discovery data. The other is the unproduced data such as preserved but never processed data.
During discovery and for trial the produced data has likely been stored on servers for ease of access. When the case goes into sleep mode the data could stay there. If that is the plan, it will not take long before a number of cases and their data consumes terabytes of server space.
Since disk storage has become so inexpensive, it is certainly possible to let the data continue to accumulate there. There is a cost associated with keeping it there, however.
For example, it is not just the cost of hard drives but the machines and processors needed to push it. By the time the volume exceeds a few terrabytes, the storage system is likely moving off a server and on to larger disk arrays, whose costs easily get into the tens of thousands of dollars.
As the overall system becomes larger and more complex so do the costs for management, maintenance and security of the active system. So, the increased costs are not just limited to storage.
Even the backup plan becomes complicated in the ESI environment. Again, there are two complicating factors for the backup plan.
The first is again related to volume. Those holding ESI data can easily exceed the volumes normally held by organizations. Consequently, the backup systems must become much more sophisticated in order to perform the backups quickly and with minimal performance degradation to the rest of the organization’s activities.
Some of the increased sophistication can include robotic tape libraries to manage the large numbers of tape that will be required to capture the huge data volumes. Since tape is so slow it may be necessary to use a staged disk-to-disk that is then followed by tape backup of the redundant disk data. Or perhaps even a data replication followed by backup to tape. All of these approaches significantly increase the system investment, complexity and sophistication level needed to maintain it, however.
The backup plan for ESI has other significant limitations than for other organizations. For example, if the case settles it will likely be necessary to provide certifications that the data has been destroyed.
Deleting the data is not so simple once it has been captured on tape. The data on tape cannot be selectively deleted. Rather, the entire tape must be destroyed or its contents overwritten.
Intuitively reducing the backup horizon is one means to reduce the destruction problem but that option can come at significant risk. The best answer may then be to use project rather than media based backups but that, too, increases the complexity, sophistication and investment in the system.
All of the above only considers the active data. If the preservation was done using forensic processes and include forensic images, where are those being stored and retained? If they are on the server as well then the volume of stored data could be considerably more significant than if it were just produced data. Naturally, such an approach only compounds the data storage problem on the server.
Storing data on hard drives rather than on an active server also has its issues. For example, recent studies have shown that the life of a hard drive is two to three years. The actual usage during that period of time seems to make little difference. Rather, the mere passage of time is the most telling indicator.
The kinds of problems that can occur during the two to three year period are several. There can be a failure of the entire device or of the device’s storage media.
If the drive is operating, they usually have onboard logic that detects the impending media failure and moves the data to other available sectors on the drive. If it is simply sitting in storage then this safeguard is not operating.
Even tape storage is problematic. About twenty percent of backup tapes will not restore properly because the data has become corrupted or it experienced a problem during the capture.
So, ESI storage issues can provide numerous challenges. Each solution has a price which must be factored in the firm’s fee structure.