FORDHAM FORENSICS When It Really Matters770-777-2090
Metadata Molds E-Discovery Practices
Gregory L Fordham
February 2009
Metadata is a recurring topic of discussion in the field of electronic discovery. While the discussion usually centers on its definition, a more interesting facet is how it is shaping the practice of cyber litigation.
In the early days, electronic discovery followed the more traditional paper based discovery model despite the considerable inadequacies of such an approach.
Decisions like Williams v Sprint/United Management Co., 230 F.R.D. 640 D.Kansas (2005), however, made that fallacy more obvious because of the forgotten metadata. The result was an increasing interest and transition toward native format documents.
If the decision in Sprint can be analogized to the first breaks in the dam, another recent case illustrates just how much that breach has widened.
Aguilar v Immigration and Customs Enforcement Division, 2008 WL 5062700 (S.D.N.Y. 2008) does not set new trends. Rather, it is more like a primer on metadata in which four key elements are covered.
The first key element is the usual review of metadata and its definitions. As discussed, metadata is data about data.
In addition, there are two types of metadata. There is application metadata and system metadata. Application metadata provides attributes about the document itself and are contained within the document.
Application metadata are created and placed within the document by the software application used to manage the document such Microsoft Word or Excel.
Application metadata is then further divided into two types; embedded and substantive metadata. Embedded metadata are attributes such as the author, create date, organization, cell formulas in worksheets, etc. The decision states embedded metadata is generally discoverable.
The other kind of application metadata, which is substantive metadata, reflects modifications to the document such as prior edits or editorial comments. It can also include document display instructions such as fonting and spacing. Substantive metadata need not be routinely produced unless there is good cause.
The other kind of metadata, system metadata, reflects information created by the user or by the information system itself. It is not embedded in the document but can be easily retrieved. The case cites other decisions claiming that system metadata lacks evidentiary value.
The second key element discussed is the rule governing discovery, particularly Rule 34. The decision recites how metadata is discoverable if it has probative value and is not overly burdensome. The decision also reviews one’s ability to specify the form of requested data and the requirements if no form is specified.
The final key element reflected in the decision is the consequence of metadata’s evolving importance. More specifically, it mentions the changes that were made to the Sedona Conference’s best practices in recognition of changing practices in e-discovery.
Originally, Principle 12 limited the preservation and production of metadata to an agreement of the parties. The revised Principle omits this limitation in recognition of the growing preference for production of documents in native format.
Although the decision is instructive and illustrates just how far things have come, it also identifies several remaining weaknesses.
For example, the decision’s conclusion, that system metadata lacks evidentiary value, is simply ignorant. System metadata helps with authenticity. In addition, it can alert and prove instances of spoliation. In cases like trade secrets, bankruptcy and family law it can betray data hiding efforts.
The case analysis of discovery rules and whether metadata is producible if probative and not overly burdensome also reflects anachronistic thinking.
Native format is the most logical container for digital evidence. It is already in its normally maintained state. In addition, it is already in a usable form, assuming a standard and widely used format, and it already contains whatever metadata exists.
The conversion to image format is unnecessarily expensive as is extraction of metadata and searchable text. The real question, therefore, is whether anything other than native format is overly burdensome under Rule 26(b)(2)(c).
These and other metadata deficiencies are significant. So, look for more changes.