All posts in Product Tips

Using Cellebrite in Mobile Phone Investigations

What happens when your company is facing probable litigation and key evidence is located on a smart phone? Demand for mobile device data is increasing in litigation and investigations and it presents a complex, new playing field for legal professionals and computer forensics experts.

New Tools Specifically for Cell Phone Forensics

Drilling into a phone’s memory requires a certain level of process and technology expertise and if the technology product Cellebrite is not currently on your radar, it will likely surface soon. Cellebrite is a widely used mobile device forensics tool for data extraction and analysis. The combination of Cellebrite software and hardware helps the investigator delve into the messages, phones calls, voicemails, images, browsing history and more contained on a smart phone chip.

KrolLDiscovery on the ILTA Blog

KrolLDiscovery computer forensic expert Jason Bergerson recently explained how Cellebrite assists in mobile device examinations. Appearing on the International Legal Technology Association (ILTA) blog, Mobile Phone Forensics: Understanding Cellebrite Extraction Reports answers these questions:

  • What processes and tools are used to investigate mobile devices?
  • What limitations exist when extracting data from a mobile device?
  • What are the common reports generated by Cellebrite?
  • How are these reports leveraged by a forensic investigator?

To shine light on mobile device discovery and view a sample Cellebrite report, read Jason Bergerson’s ILTA blog post: Mobile Phone Forensics: Understanding Cellebrite Extraction Reports.

Relativity Certifications—Helping You Learn the Lingo

For Relativity gurus, making sense of kCura’s certification system is likely no sweat. However, for ediscovery outsiders or legal/IT professionals new to Relativity, all of the classes, tests and designations are a bit overwhelming. While kCura’s certification system is not overly complicated, it takes some time to learn the lingo. To speed up your learning curve, take five minutes to familiarize yourself with the Relativity certification structure.


Why Get a Relativity Certification?

If you work for a corporation, law firm or service provider utilizing Relativity for ediscovery, there is no better way to learn new Relativity features and provide more value to your organization than to get certified. The Relativity certification programs are for individuals looking to validate their knowledge and expertise in the software.

What Relativity Certifications Are Available?

kCura offers eight certifications for Relativity:

  • Relativity Certified Administrator (RCA) – The keystone certification, targeted at case administrators working day-to-day in Relativity.
  • Relativity Analytics Specialist – For individuals working extensively with Relativity Analytics.
  • Relativity Infrastructure Specialist – For individuals responsible for setting up, running and troubleshooting a Relativity environment.
  • Relativity Certified User – For individuals conducting document review within Relativity.
  • Relativity Assisted Review Specialist – For individuals with expertise in predictive coding within Relativity.
  • Relativity Processing Specialist – For individuals operating the processing engine in Relativity.
  • Relativity Project Management Specialist – For individuals troubleshooting case workflows using Relativity.
  • Relativity Certified Sales Professional (RCSP) – For individuals demonstrating Relativity in a sales setting.
  • Expert – For RCAs who hold two or three specialist certifications concurrently.
  • Master – For RCAs who hold four or more specialist certifications concurrently.

How Does the Certification Process Work?

Don’t expect these certifications to come easy. It is generally known that kCura’s exams are not a stroll through the park. Expect to invest plenty of time studying to prepare yourself. Further, in order to sit for one of the exams, candidates have to possess specific experience as a prerequisite. After you pass, you have to keep your certification up to date by earning Relativity Continuing Education (RCE) credits.

Hear What Some RCAs Have to Say

At Kroll Ontrack, many of our team members are ramping up their Relativity expertise. In fact, currently 53 colleagues hold the RCA designation, with several also certified in one or more specialist areas. Of those certified, nine in Kroll Ontrack’s crew have reached the Relativity Expert designation and one hard-working individual at Kroll Ontrack is certified as a Relativity Master.

If you are thinking about earning a Relativity certification, watch this short video to hear how some of Kroll Ontrack’s folks prepared themselves and achieved these important Relativity designations. Then, if you are intrigued to pursue such a certification, set aside time to read the wealth of information available on kCura’s website. As anyone working in ediscovery knows, given the amount of change in the law and technology, continued professional development goes a long way to a prosperous career in ediscovery.

A Light in the Dark: Protecting PII in Ediscovery

65% of ediscovery projects contain at least one document with the XXX-XX-XXXX number format. Accidentally disclosing Personally Identifiable Information (PII) could lead to a messy discovery process and costly penalties. Do you know how to best protect PII in ediscovery?  Check out this new PII infographic to learn more.

What is PII?

Personally Identifiable Information (PII) is any information about an individual maintained by an organization that can distinguish, trace or link to that individual.  This can include anything as benign as a person’s full name to confidential medical, educational, financial and employment information or a social security number.

What’s at Risk in Ediscovery?

While the threat of identity theft looms over individuals who fail to safeguard their personal information, litigation teams are in a unique position. They must be the safeguard that ensures opposing counsel doesn’t accidentally receive confidential medical records, social security numbers or other PII during the discovery process. In a perfect scenario, all PII would be redacted prior to production, but with exponentially increasing volumes of data, PII becomes increasingly at risk of being unintentionally compromised in litigation. If an inadvertent disclosure occurs, a legal team may face sanctions.

Assisted Redaction: A Sophisticated Solution

At a basic level, the manual redaction process completely removes targeted content from an electronic document, making it irretrievable and unavailable for view, print, search or copy.  Building beyond manual redaction, ediscovery platforms can utilize an automated approach to identifying, verifying and applying user-defined redactions to maximize efficiency in a process known as “assisted redaction.” The assisted redaction application, featured in Kroll Ontrack’s Relativity offering, provides users with full control to review, approve or reject each applied redaction across an entire data collection workspace or subset of data. Assisted redaction streamlines the manual redaction process, reducing the risk of inadvertent disclosure while allowing counsel to quickly and correctly apply user-defined redactions throughout the data.

A Light in the Dark

The ediscovery process may put PII at risk when not carefully managed, but much of that risk can be alleviated when paired with a strong legal team and savvy technology. Shine some light on PII  protection in ediscovery before watching Kroll Ontrack’s new video to learn more about assisted redaction and other new capabilities within Kroll Ontrack’s Relativity offering.

Take a “Quick Peek”— 2014 HSR Annual Report

A few weeks ago, the FTC and DOJ released their annual HSR Report. Like any report card, this annual assessment allows us to see the developments of the last year when it comes to premerger notification and merger enforcement.

Before sitting down to do some serious studying of the full report, take a quick peek at a few of the numbers, then read Kroll Ontrack’s analysis, “Top 10 Takeaways: 2014 HSR Annual Report.”

Mergers are up

  • In 2014, merger filings increased by more than 25% from 2013.
  • 1,663 transactions were reported under the HSR Act in 2014.

Considerable emphasis on consumer market competition

  • Consumer Goods & Services comprised 30.8% of the HSR transactions in 2014, more than any other industry.

Growth in multi-million dollar mergers

  • 4% of reported transactions had a value of over $500 million.

Second Request volumes steady with previous years

  • Second Requests were issued in 51 merger investigations – 30 by the FTC, 21 by the DOJ.
  • The number of Second Requests issued in 2014 increased 8.5% over 2013.
  • Second Requests were issued in 3.2% of total HSR transactions, down from 3.7% in 2013.
  • More than 80% of Second Request investigations occurred in transaction ranges of $300 million or greater.

With ample antitrust and Second Request experience under our belts, Kroll Ontrack is uniquely equipped to help manage your document productions to the FTC, DOJ and other global competition bureaus. To learn more about Kroll Ontrack’s expertise, be sure to check out our Second Request Services.

Document Preservation: Know When to Hold ‘Em (and When to Fold ‘Em)

The cut-throat, high stakes environment of a nail-biting poker tournament is oddly similar to the world of document preservation in litigation, investigations and regulatory events. Though the former tends to take place in a smoke-filled, lowly lit room, and the latter on computers (with less smoke, but perhaps the same amount of nail-biting), both pastimes involve the same motto. In litigation and poker, a savvy professional must know when to hold ‘em and when to fold ‘em.

Two seasoned ediscovery professionals, Cathleen Peterson from Kroll Ontrack and Brian Corbin from JP Morgan Chase, recently collaborated to publish an informative article in the ACC Docket, Document Preservation: Know When to Hold ‘Em. As continuing advances in technology have caused a massive shift to digital document retention and preservation, legal departments need to create clear policies when it comes to document preservation in order to keep abreast of (or ahead of) the curve.

Tip #1: Be Proactive

The duty to initiate preservation efforts arises when a litigation or regulatory event is reasonably foreseeable. For many corporations, this may mean that legal departments must issue legal holds quite frequently. Being proactive in issuing legal holds is necessary, as courts have little patience for preservation corner-cutting and are now more likely to impose costly alternatives or sanctions on parties that lose or alter information as a result of less sophisticated, or remissive, legal hold policies.

Tip #2: Know When to Take Action, and When Not to Take Action

ESI has a transient nature, so waiting until litigation has commenced can result in the inadvertent destruction of relevant emails or other documents. Recovery of these lost documents can be extremely costly or impossible. Thus, deciding when to issue an initial legal hold or when to refresh an existing hold should be done with the entire process in mind.

Tip #3: Leave a Good Paper Trail

Having a well-documented paper trail is the best way to avoid the pitfalls of a potential spoliation charge. With proper documentation, even if the relevant information is lost, documentation that shows right actions were taken at the right time could serve as a shield to prevent the imposition of sanctions.

Tip #4: Follow Up and Be a Team Player

Effective counsels take affirmative steps to periodically remind relevant parties of the ongoing nature of legal holds, and works with the IT department to ensure that regularly scheduled data purges do not occur. Legal teams must work with IT to ensure that IT understands that the duty to preserve extends beyond the length of employment, meaning that the company laptops or computers should not be wiped when a relevant employee leaves the company.

Tip #5: Repeat, Repeat, Repeat. Stop.

A key element of any successful legal hold and retention policy is its repeatability and consistency of implementation. Repeatability and consistency can clear confusion about the legal hold policies and automation of data, making compliance much easier to follow in the long run. However, just as legal holds come from a reasonable foreseeability of litigation, holds can end with when litigation is brought to a close (including expiration of an appeals period, if applicable), or when the  reasonably foreseeable threat of litigation has gone away. Failure to release holds and apply normal retention policies in a timely manner is a risky proposition as the retained data remains in the organization’s custody and control, therefore subject to discovery in future matters.

The Takeaway  

Companies need to know that technology has evolved to a point where legal departments of any size can handle legal holds of any scope, so long as steps are taken to communicate with other key players in the process, including relevant custodians, IT departments, and executive teams. If the proper steps are not taken, or procedures are not followed according to the documented plan, litigation can result in high costs and sanctions.

The next time you face a legal hold, think of yourself as the consummate poker player and remember, “if you wanna play the game…you gotta play it right.” With these tips, you’ll be sure to play the game right to the end. Continue reading →

LTNY 2014 Survival Guide: Kroll Ontrack Sessions

Product demos, vining, bit coin, John Henry, predictive coding, tweeting, the silk road, video montages, disruptive technology, live blogging, big data, multi-matter management, search, and of course, electronic discovery—yes this amalgamation of somewhat related topics could only spell one thing: LegalTech 2014 is almost upon us.

It’s no surprise that several substantive resources already exist that give attendees a taste of what to expect in New York this year, like this series of expert interviews conducted by Josh Gilliland from  But before you finalize your trek through LegalTech, we want to call your attention to a few sessions on Wednesday, February 5th, that you won’t want to miss:

Have we Reached a “John Henry” Moment in Evidentiary Search? (10:30-11:45am February 5th)

To kick things off, Eric Robinson will be moderating a discussion between Ralph Losey, Jason R. Baron, and Cliff Dutton on the future of predictive coding. Will this technology remove humans from the labor-intensive practice of law in a similar way the steam power hammer triumphed over John Henry, the steel driving man? While we can’t promise that Ralph will be donning an acoustic guitar, we can assure you that this esteemed panel will leave no tea leaves unread.

The Ediscovery Pulse: Metrics You Need to Know (2:00-3:15pm February 5th)

Another session well worth your while directs attendees’ attention to a new resource for comparing ediscovery benchmarks and forecasting performance.  Knowing how many custodians you produced from your last case makes for a nice anecdote. Knowing the average number of custodians organizations produced from across thousands of matters handled by the leading provider, however, makes for compelling arguments both in conference rooms and in court. Dean Hager, President and CEO of Kroll Ontrack will be hosting this panel where ediscovery experts Wendy Curtis, Emily Cobb, Eli Nelson, and Lynn Looby will weigh the impact of six new metrics available at

Multi-Matter Management: An Ediscovery “Lifestyle Change” (3:45-5:00pm February 5th)

The final session on Wednesday will focus on the transition from case-centric ediscovery project management to a more comprehensive, multi-matter approach. Moderated by Kamal Gadelhak, this discussion will focus on practical advice about embracing a more holistic approach to litigation response as offered by speakers  Allison Berres, Rachel Rubenson, and Josh Zylbershlag. This panel will leverage an interactive simulation to demonstrate what cost-savings can be gained from adopting modern technology to effectuate proactive, multi-matter management.

Also, don’t forget to stop by Kroll Ontrack’s Welcome Cocktail Reception on February 4th at 5:00pm to kick off what will surely be an amazing week! For the most up-to-date information about what Kroll Ontrack will be doing this year (regarding prizes, parties, exhibit hours), our LTNY 2014 landing page is the place to go.

Unify. Clarify. Simplify. Manage Your Entire Ediscovery Portfolio.

Since ediscovery began, data has been collected, reviewed and produced individually, disconnected from any other ediscovery projects. Ironically, many ediscovery projects would benefit from leveraging other projects’ work and data collection. But when it comes to vetting the viability of emerging IT-Law solutions that promise to cut through the clutter, sometimes showing is better than telling. Check out the video clip below to see our friend Josh Gilliland’s (the legal mind behind first impression of Manage:

Beyond proving that distance never stands in the way of two lawyers who want to geek out about ediscovery, the clip offers a great crash course into exactly what can be gained by a adopting a new, holistic approach to managing your entire ediscovery portfolio. Manage offers:

  • Transparency into the entire ediscovery portfolio— Manage provides full insight into granular project details like project and custodian data volumes
  • Real-time financials— organizations can explore, compare, and contrast ediscovery spend data across all cases in their portfolios
  • Structured and efficient collaboration—leveraging the power of social media, Manage centralizes all case communication in one project wall, providing instant access to project status and developments for the entire team

For a deeper dive into multi-matter management, see the ESI Report’s latest podcast, “Reduce, Reuse, Recycle: Effectively Managing E-Discovery Portfolios.” Also, check out this Ediscovery Manage Demo to see just how transparent ediscovery can be.

Ediscovery Collections for Left-Side of the EDRM

Ediscovery Collections

Predictive coding is the hottest ediscovery technology today to save money and time.  However, even the best Technology Assisted Review (TAR) protocol on the right-side of the Electronic Discovery Reference Model (EDRM) will falter if the left-side of the EDRM is ignored.  From information management to preservation and collection, the early stages of the EDRM are the easiest place for mistakes to spawn an investigation, regulatory request, or litigation.  For example, if your organization over-preserves, costs skyrocket for data you don’t need.  If you under-collect, your organization could face penalties for missing critical documents.  If you have no plans and limited technology resources, billable hours will escalate beyond imagination simply to gather and identify targeted data.

Your organization needs in-house tools and procedures to empower its ediscovery collections efforts. Today’s tools are leaps above those of a decade ago. They are capable of metadata preservation and can search, recover, explore and export data from many types of data sets. One such software is Ontrack PowerControls 7.0.

Ontrack PowerControls focuses on extracting data from two of the most highly used programs by companies today: Microsoft® Exchange and Microsoft® SharePoint®. Ontrack PowerControls not only ensures that IT professionals within those companies can do their job of maintaining those systems, it can also be used to copy existing content to new servers while preserving metadata using a unique migration path.

Finally, Ontrack PowerControls address the legal and technical complexities associated with forensics collections. IT administrators can use it to identify, preserve and collect potentially relevant metadata from live and backup environments with minimal disruption. The data can then be exported in useable formats.

We’ve come a long way from the headache-inducing early years of the left stages of the EDRM. Now, with the right tools, data extraction can even be, dare we say it, pleasant.

For a deeper dive on this topic, tune in to the September 10th Kroll Ontrack webinar, EDRM: Does Your Left-Side Know What Your Right-Side is Doing?  presented by industry expert, Troy Ronning.

Document Review – Creating and Modifying Annotations in Ontrack Inview

Document Review - Creating and Modifying Annotations in Ontrack Inview

One of the most useful functionalities of Ontrack Inview is the ability to compare documents side-by-side during document review. The annotations tab shows redactions, highlights, and sticky notes of two near-duplicate documents.

Creating Annotations

You can create redactions, highlights, and sticky notes using the Document Viewer Toolbar. Annotations are shared by all duplicate documents throughout the database. (Important: You cannot annotate documents in the Native or Text tabs. You can annotate documents in the Tiff tab only.)

Modifying Annotations

After you create an annotation, you can go back and modify it at any time. You can also modify an annotation created by another reviewer, as long as your security level is equal to or greater than the annotation’s security level. The default security level of an annotation is “Low – 10.”

To edit the text in a sticky note

  1. On the Tiff tab, double-click the sticky note you want to modify. The text becomes available for editing.
  2. Edit the text as desired and click outside the note.

To edit the name of a redaction code

  1. On the Tiff tab, double-click the redaction you want to modify. The Modify Text dialog box appears.
  2. Edit the text as desired and click OK.

To delete an annotation

  1. On the Tiff tab, select the annotation you want to delete.
  2. Press Delete. For sticky notes and redactions, the Comments dialog box appears, asking you if you would like to edit your comments.
  3. Enter comments, if desired, and click OK.

Keyword Highlighting in Ontrack Inview

Keyword Highlighting in Ontrack Inview

Much of the magic in leveraging Ontrack Inview is your ability to search through a vast system of documents in a blink of an eye. When viewing documents in a search folder, you can locate keyword hits quickly by using either the “Previous Hit” button or the “Next Hit” button on the Document Viewer Toolbar. Search hits appear in all three tabs in the document viewer.

By default, the search terms found in your search results are highlighted. Each reviewer can select additional types of terms to highlight throughout the system, not just within search results. You can also highlight Filter Terms (keyword filter terms that were used during processing) and Privilege Terms (terms from your Privilege keyword list).

To view additional highlighting, on the View tab of the ribbon, click Filter Terms, Privilege Terms, or both. Once set, click these buttons again to toggle the highlighting on or off as needed.

Keep in mind the following considerations when looking at highlighted terms.

  • Filter term highlighting occurs on a Control Number (individual document) basis. For example, a document with Control #2, Duplicate ID #2 for custodian “Smith, Jane” hit on the processing filter term trading. This term appears highlighted in yellow. Another document with Control #1000, Duplicate ID #2 for custodian “Smith, John” went through a different filter in processing and hit on the term stock. Even though Control #1000 is a duplicate of Control #2, it hit on a different processing filter term. As a result, Control #1000 highlights stock in yellow (not trading).
  • Keyword highlights appear on the Tiff, Native, and Text tabs. Scanned paper documents and other specific document types have highlighting only in the Text tab.
  • Only those words that match the search term exactly are highlighted. Therefore, if your search term is AB&C, many words may take search hits, but only the exact matches of AB&C will be highlighted in the documents returned in a search.
  • If your search term contains a wild card (*) or expander (!), all variants of the term are found and highlighted. The exception is those terms containing punctuation.
  • If your search term contains a root expander (+), all variants of the term are found and highlighted.
  • If your search term is also on a privilege keyword list or was a filter term and your Highlighter is set to display both, you may see multiple colors: privilege (red), search (teal), and filter (yellow). If there are overlapping terms, they are highlighted in dark blue.