Storage/Business Continuity
The challenges of e-discovery
Disk-based storage can provide needed searchability and authentication features.
by Gary Watson
Recent changes in federal law require organizations to present electronically stored data in a timely fashion during the discovery phase of federal legal proceedings. This process is called "e-discovery." Legislation such as the Sarbanes-Oxley Act mandates all organizations must be able to recover evidence from every piece of digitally recorded data created over a period of time, stretching out for years and even decades.
This legal requirement has developed into an important storage issue. All data that has been created, received or possessed by an organization must be fully available and fully tamper-proof. Much of this data is considered fixed content. The Enterprise Strategy Group predicts fixed content archival information is growing at a compound annual rate of 65 percent, due in major part to e-discovery requirements. Because of this, e-discovery should not only be viewed from the legal perspective, but from a storage perspective, as well.
The IT department should be empowered with the right tools to keep an organization in compliance and free from liabilities. The correct technology will likely require new purchases and updated policies.
The inability to provide required information at the discovery phase in a legal process can mean the difference between winning and losing a lawsuit. When the court demands records in a secure and timely fashion, these three questions need to be answered.
Answering "no" to any one of these questions can lead to a range of penalties: fines, legal liability, revoked licenses, business closure and even jail time for executives. With data growing exponentially across all sizes of business, the ability to answer "yes" to these questions is getting more complex, more demanding and more important than ever.
Do I still possess the called-for file? Though locking away data onto tape seems like the best and cheapest way to preserve it for a long time, organizations face a large tradeoff of timely searchability and availability. In the event of e-discovery, a disk-based system can provide the searchability and authentication features required to ensure the file being requested is available and that it can be accessed quickly. As an additional benefit, a disk-based archive allows for both safe, accurate archiving and fast retrieval when old files are needed for regular business purposes.
Not all disk-based archive solutions are created equal, however. For e-discovery, an important capability is automated file health checking and healing. The capability to self-audit a file ensures that a file is accessible, has not been altered and is readable.
Self-healing fixes a file that has been corrupted, damaged, altered or tampered with. These capabilities can guarantee a file will still be readable even decades later. It will confirm that a file is available and accessible, and maybe most importantly, that the organization can prove authenticity and that nothing is missing.
Can I quickly find one file out of millions, possibly billions? Disk-based solutions offer a way to find the proverbial needle in a haystack. There are several key capabilities an organization's disk-based archive systems should have.
The first is a metadata-searchable database, which can speed up file searching. Metadata is data about data, which enables in-depth file searching.
The second is the capability to search for keywords and/or objects within individual files. With this, organizations can easily find all e-mails mentioning a specific partner, for example, that may be involved in a legal compliant.
In the event of file loss or disaster, can the authenticity and chain of custody of recovered files be guaranteed? Is the data to be submitted in court unadulterated? Has it been tampered with? Second, has it passed only through safe hands on its way to court? Proof of an appropriate chain of custody is a must with legal e-discovery. Businesses should be able to document to the court that a file has been handled in a scrupulously careful manner to avoid allegations of tampering or misconduct.
An archive with continuous backup for every archived file is needed-a system that immediately backs up every file outside of the main system. Combine this external archive solution with a self-auditing and self-healing capability, even in the case of file loss, and the archive solution will know which files are lost and, through the audits, recover them.
For a secure chain of custody, write once/read many (WORM) technology is important. WORM protects files and provides file immutability; immutability eliminates the ability to tamper with a file. WORM protects against viruses as well as accidental or unauthorized deletions.
Gary Watson is chief technology officer for Nexsan Technologies, Thousand Oaks, Calif.
For more information
(click here)