All posts in Product Tips

Using Cellebrite in Mobile Phone Investigations

What happens when your company is facing probable litigation and key evidence is located on a smart phone? Demand for mobile device data is increasing in litigation and investigations and it presents a complex, new playing field for legal professionals and computer forensics experts.

New Tools Specifically for Cell Phone Forensics

Drilling into a phone’s memory requires a certain level of process and technology expertise and if the technology product Cellebrite is not currently on your radar, it will likely surface soon. Cellebrite is a widely used mobile device forensics tool for data extraction and analysis. The combination of Cellebrite software and hardware helps the investigator delve into the messages, phones calls, voicemails, images, browsing history and more contained on a smart phone chip.

KrolLDiscovery on the ILTA Blog

KrolLDiscovery computer forensic expert Jason Bergerson recently explained how Cellebrite assists in mobile device examinations. Appearing on the International Legal Technology Association (ILTA) blog, Mobile Phone Forensics: Understanding Cellebrite Extraction Reports answers these questions:

  • What processes and tools are used to investigate mobile devices?
  • What limitations exist when extracting data from a mobile device?
  • What are the common reports generated by Cellebrite?
  • How are these reports leveraged by a forensic investigator?

To shine light on mobile device discovery and view a sample Cellebrite report, read Jason Bergerson’s ILTA blog post: Mobile Phone Forensics: Understanding Cellebrite Extraction Reports.

Relativity Certifications—Helping You Learn the Lingo

For Relativity gurus, making sense of kCura’s certification system is likely no sweat. However, for ediscovery outsiders or legal/IT professionals new to Relativity, all of the classes, tests and designations are a bit overwhelming. While kCura’s certification system is not overly complicated, it takes some time to learn the lingo. To speed up your learning curve, take five minutes to familiarize yourself with the Relativity certification structure.

Why Get a Relativity Certification?

If you work for a corporation, law firm or service provider utilizing Relativity for ediscovery, there is no better way to learn new Relativity features and provide more value to your organization than to get certified. The Relativity certification programs are for individuals looking to validate their knowledge and expertise in the software.

What Relativity Certifications Are Available?

kCura offers eight certifications for Relativity:

  • Relativity Certified Administrator (RCA) – The keystone certification, targeted at case administrators working day-to-day in Relativity.
  • Relativity Analytics Specialist – For individuals working extensively with Relativity Analytics.
  • Relativity Infrastructure Specialist – For individuals responsible for setting up, running and troubleshooting a Relativity environment.
  • Relativity Certified User – For individuals conducting document review within Relativity.
  • Relativity Assisted Review Specialist – For individuals with expertise in predictive coding within Relativity.
  • Relativity Processing Specialist – For individuals operating the processing engine in Relativity.
  • Relativity Project Management Specialist – For individuals troubleshooting case workflows using Relativity.
  • Relativity Certified Sales Professional (RCSP) – For individuals demonstrating Relativity in a sales setting.
  • Expert – For RCAs who hold two or three specialist certifications concurrently.
  • Master – For RCAs who hold four or more specialist certifications concurrently.

How Does the Certification Process Work?

Don’t expect these certifications to come easy. It is generally known that kCura’s exams are not a stroll through the park. Expect to invest plenty of time studying to prepare yourself. Further, in order to sit for one of the exams, candidates have to possess specific experience as a prerequisite. After you pass, you have to keep your certification up to date by earning Relativity Continuing Education (RCE) credits.

Hear What Some RCAs Have to Say

At Kroll Ontrack, many of our team members are ramping up their Relativity expertise. In fact, currently 53 colleagues hold the RCA designation, with several also certified in one or more specialist areas. Of those certified, nine in Kroll Ontrack’s crew have reached the Relativity Expert designation and one hard-working individual at Kroll Ontrack is certified as a Relativity Master.

If you are intrigued to pursue such a certification, set aside time to read the wealth of information available on kCura’s website. As anyone working in ediscovery knows, given the amount of change in the law and technology, continued professional development goes a long way to a prosperous career in ediscovery.

A Light in the Dark: Protecting PII in Ediscovery

65% of ediscovery projects contain at least one document with the XXX-XX-XXXX number format. Accidentally disclosing Personally Identifiable Information (PII) could lead to a messy discovery process and costly penalties. Do you know how to best protect PII in ediscovery?

What is PII?

Personally Identifiable Information (PII) is any information about an individual maintained by an organization that can distinguish, trace or link to that individual.  This can include anything as benign as a person’s full name to confidential medical, educational, financial and employment information or a social security number.

What’s at Risk in Ediscovery?

While the threat of identity theft looms over individuals who fail to safeguard their personal information, litigation teams are in a unique position. They must be the safeguard that ensures opposing counsel doesn’t accidentally receive confidential medical records, social security numbers or other PII during the discovery process. In a perfect scenario, all PII would be redacted prior to production, but with exponentially increasing volumes of data, PII becomes increasingly at risk of being unintentionally compromised in litigation. If an inadvertent disclosure occurs, a legal team may face sanctions.

Assisted Redaction: A Sophisticated Solution

At a basic level, the manual redaction process completely removes targeted content from an electronic document, making it irretrievable and unavailable for view, print, search or copy.  Building beyond manual redaction, ediscovery platforms can utilize an automated approach to identifying, verifying and applying user-defined redactions to maximize efficiency in a process known as “assisted redaction.” The assisted redaction application, featured in Kroll Ontrack’s Relativity offering, provides users with full control to review, approve or reject each applied redaction across an entire data collection workspace or subset of data. Assisted redaction streamlines the manual redaction process, reducing the risk of inadvertent disclosure while allowing counsel to quickly and correctly apply user-defined redactions throughout the data.

A Light in the Dark

The ediscovery process may put PII at risk when not carefully managed, but much of that risk can be alleviated when paired with a strong legal team and savvy technology. Shine some light on PII  protection in ediscovery before watching Kroll Ontrack’s new video to learn more about assisted redaction and other new capabilities within Kroll Ontrack’s Relativity offering.

Take a “Quick Peek” — 2014 HSR Annual Report

A few weeks ago, the FTC and DOJ released their annual HSR Report. Like any report card, this annual assessment allows us to see the developments of the last year when it comes to premerger notification and merger enforcement.

Mergers are up

  • In 2014, merger filings increased by more than 25% from 2013.
  • 1,663 transactions were reported under the HSR Act in 2014.

Considerable emphasis on consumer market competition

  • Consumer Goods & Services comprised 30.8% of the HSR transactions in 2014, more than any other industry.

Growth in multi-million dollar mergers

  • 4% of reported transactions had a value of over $500 million.

Second Request volumes steady with previous years

  • Second Requests were issued in 51 merger investigations – 30 by the FTC, 21 by the DOJ.
  • The number of Second Requests issued in 2014 increased 8.5% over 2013.
  • Second Requests were issued in 3.2% of total HSR transactions, down from 3.7% in 2013.
  • More than 80% of Second Request investigations occurred in transaction ranges of $300 million or greater.

With ample antitrust and Second Request experience under our belts, Kroll Ontrack is uniquely equipped to help manage your document productions to the FTC, DOJ and other global competition bureaus. To learn more about Kroll Ontrack’s expertise, be sure to check out our Second Request Services.

Document Preservation: Know When to Hold ‘Em (and When to Fold ‘Em)

The cut-throat, high stakes environment of a nail-biting poker tournament is oddly similar to the world of document preservation in litigation, investigations and regulatory events. Though the former tends to take place in a smoke-filled, lowly lit room, and the latter on computers (with less smoke, but perhaps the same amount of nail-biting), both pastimes involve the same motto. In litigation and poker, a savvy professional must know when to hold ‘em and when to fold ‘em.

Two seasoned ediscovery professionals, Cathleen Peterson and Brian Corbin from JP Morgan Chase, recently collaborated to publish an informative article in the ACC Docket, Document Preservation: Know When to Hold ‘Em. As continuing advances in technology have caused a massive shift to digital document retention and preservation, legal departments need to create clear policies when it comes to document preservation in order to keep abreast of (or ahead of) the curve.

Tip #1: Be Proactive

The duty to initiate preservation efforts arises when a litigation or regulatory event is reasonably foreseeable. For many corporations, this may mean that legal departments must issue legal holds quite frequently. Being proactive in issuing legal holds is necessary, as courts have little patience for preservation corner-cutting and are now more likely to impose costly alternatives or sanctions on parties that lose or alter information as a result of less sophisticated, or remissive, legal hold policies.

Tip #2: Know When to Take Action, and When Not to Take Action

ESI has a transient nature, so waiting until litigation has commenced can result in the inadvertent destruction of relevant emails or other documents. Recovery of these lost documents can be extremely costly or impossible. Thus, deciding when to issue an initial legal hold or when to refresh an existing hold should be done with the entire process in mind.

Tip #3: Leave a Good Paper Trail

Having a well-documented paper trail is the best way to avoid the pitfalls of a potential spoliation charge. With proper documentation, even if the relevant information is lost, documentation that shows right actions were taken at the right time could serve as a shield to prevent the imposition of sanctions.

Tip #4: Follow Up and Be a Team Player

Effective counsels take affirmative steps to periodically remind relevant parties of the ongoing nature of legal holds, and works with the IT department to ensure that regularly scheduled data purges do not occur. Legal teams must work with IT to ensure that IT understands that the duty to preserve extends beyond the length of employment, meaning that the company laptops or computers should not be wiped when a relevant employee leaves the company.

Tip #5: Repeat, Repeat, Repeat. Stop.

A key element of any successful legal hold and retention policy is its repeatability and consistency of implementation. Repeatability and consistency can clear confusion about the legal hold policies and automation of data, making compliance much easier to follow in the long run. However, just as legal holds come from a reasonable foreseeability of litigation, holds can end with when litigation is brought to a close (including expiration of an appeals period, if applicable), or when the  reasonably foreseeable threat of litigation has gone away. Failure to release holds and apply normal retention policies in a timely manner is a risky proposition as the retained data remains in the organization’s custody and control, therefore subject to discovery in future matters.

The Takeaway  

Companies need to know that technology has evolved to a point where legal departments of any size can handle legal holds of any scope, so long as steps are taken to communicate with other key players in the process, including relevant custodians, IT departments, and executive teams. If the proper steps are not taken, or procedures are not followed according to the documented plan, litigation can result in high costs and sanctions.

The next time you face a legal hold, think of yourself as the consummate poker player and remember, “if you wanna play the game…you gotta play it right.” With these tips, you’ll be sure to play the game right to the end.

LTNY 2014 Survival Guide: Kroll Ontrack Sessions

Product demos, vining, bit coin, John Henry, predictive coding, tweeting, the silk road, video montages, disruptive technology, live blogging, big data, multi-matter management, search, and of course, electronic discovery—yes this amalgamation of somewhat related topics could only spell one thing: LegalTech 2014 is almost upon us.

It’s no surprise that several substantive resources already exist that give attendees a taste of what to expect in New York this year, like this series of expert interviews conducted by Josh Gilliland from  But before you finalize your trek through LegalTech, we want to call your attention to a few sessions on Wednesday, February 5th, that you won’t want to miss:

Have we Reached a “John Henry” Moment in Evidentiary Search? (10:30-11:45am February 5th)

To kick things off, Eric Robinson will be moderating a discussion between Ralph Losey, Jason R. Baron, and Cliff Dutton on the future of predictive coding. Will this technology remove humans from the labor-intensive practice of law in a similar way the steam power hammer triumphed over John Henry, the steel driving man? While we can’t promise that Ralph will be donning an acoustic guitar, we can assure you that this esteemed panel will leave no tea leaves unread.

The Ediscovery Pulse: Metrics You Need to Know (2:00-3:15pm February 5th)

Another session well worth your while directs attendees’ attention to a new resource for comparing ediscovery benchmarks and forecasting performance.  Knowing how many custodians you produced from your last case makes for a nice anecdote. Knowing the average number of custodians organizations produced from across thousands of matters handled by the leading provider, however, makes for compelling arguments both in conference rooms and in court. Dean Hager, President and CEO of Kroll Ontrack will be hosting this panel where ediscovery experts Wendy Curtis, Emily Cobb, Eli Nelson, and Lynn Looby will weigh the impact of six new metrics available at

Multi-Matter Management: An Ediscovery “Lifestyle Change” (3:45-5:00pm February 5th)

The final session on Wednesday will focus on the transition from case-centric ediscovery project management to a more comprehensive, multi-matter approach. Moderated by Kamal Gadelhak, this discussion will focus on practical advice about embracing a more holistic approach to litigation response as offered by speakers  Allison Berres, Rachel Rubenson, and Josh Zylbershlag. This panel will leverage an interactive simulation to demonstrate what cost-savings can be gained from adopting modern technology to effectuate proactive, multi-matter management.

Also, don’t forget to stop by Kroll Ontrack’s Welcome Cocktail Reception on February 4th at 5:00pm to kick off what will surely be an amazing week! For the most up-to-date information about what Kroll Ontrack will be doing this year (regarding prizes, parties, exhibit hours), our LTNY 2014 landing page is the place to go.

Unify. Clarify. Simplify. Manage Your Entire Ediscovery Portfolio.

Since ediscovery began, data has been collected, reviewed and produced individually, disconnected from any other ediscovery projects. Ironically, many ediscovery projects would benefit from leveraging other projects’ work and data collection. But when it comes to vetting the viability of emerging IT-Law solutions that promise to cut through the clutter, sometimes showing is better than telling. Check out the video clip below to see our friend Josh Gilliland’s (the legal mind behind first impression of Manage:

Beyond proving that distance never stands in the way of two lawyers who want to geek out about ediscovery, the clip offers a great crash course into exactly what can be gained by a adopting a new, holistic approach to managing your entire ediscovery portfolio. Manage offers:

  • Transparency into the entire ediscovery portfolio— Manage provides full insight into granular project details like project and custodian data volumes
  • Real-time financials— organizations can explore, compare, and contrast ediscovery spend data across all cases in their portfolios
  • Structured and efficient collaboration—leveraging the power of social media, Manage centralizes all case communication in one project wall, providing instant access to project status and developments for the entire team

For a deeper dive into multi-matter management, see the ESI Report’s latest podcast, “Reduce, Reuse, Recycle: Effectively Managing E-Discovery Portfolios.” Also, check out this Ediscovery Manage Demo to see just how transparent ediscovery can be.

Ediscovery Collections for Left-Side of the EDRM

Ediscovery Collections

Predictive coding is the hottest ediscovery technology today to save money and time.  However, even the best Technology Assisted Review (TAR) protocol on the right-side of the Electronic Discovery Reference Model (EDRM) will falter if the left-side of the EDRM is ignored.  From information management to preservation and collection, the early stages of the EDRM are the easiest place for mistakes to spawn an investigation, regulatory request, or litigation.  For example, if your organization over-preserves, costs skyrocket for data you don’t need.  If you under-collect, your organization could face penalties for missing critical documents.  If you have no plans and limited technology resources, billable hours will escalate beyond imagination simply to gather and identify targeted data.

Your organization needs in-house tools and procedures to empower its ediscovery collections efforts. Today’s tools are leaps above those of a decade ago. They are capable of metadata preservation and can search, recover, explore and export data from many types of data sets. One such software is Ontrack PowerControls 7.0.

Ontrack PowerControls focuses on extracting data from two of the most highly used programs by companies today: Microsoft® Exchange and Microsoft® SharePoint®. Ontrack PowerControls not only ensures that IT professionals within those companies can do their job of maintaining those systems, it can also be used to copy existing content to new servers while preserving metadata using a unique migration path.

Finally, Ontrack PowerControls address the legal and technical complexities associated with forensics collections. IT administrators can use it to identify, preserve and collect potentially relevant metadata from live and backup environments with minimal disruption. The data can then be exported in useable formats.

We’ve come a long way from the headache-inducing early years of the left stages of the EDRM. Now, with the right tools, data extraction can even be, dare we say it, pleasant.

For a deeper dive on this topic, tune in to the September 10th Kroll Ontrack webinar, EDRM: Does Your Left-Side Know What Your Right-Side is Doing?  presented by industry expert, Troy Ronning.

Asynchronous Search? Increase Your Flexibility

Asynchronous Search? Increase Your Flexibility

Running a search in a large data set and expecting a ton of results? Rather than waiting for results to generate, in Ontrack Inview, Ontrack Advanceview, Verve EDA and Verve Review you can opt to run a search in the background while you do additional work in the application—granting you greater flexibility while the asynchronous search culls your data set.

To run a search in the background, use the Search Wizard by following these steps:

  1. On the Home tab, click Search to start a new search
  2. Specify your search criteria in the Query tab
    1. Enter a name for the search
    2. Determine whether you’re searching text, metadata, or both
    3. Enter your search terms in the Terms and Connectors section
  3. Select Run search in background to run an asynchronous search.
  4. Click Search to begin

You can continue working in the application once your search criteria is analyzed and the search is ready to begin. Once your search has been analyzed, it will appear under the Searches folder in the Document Reviewers pane. Once your asynchronous search begins running, you will be able to tell whether your search was complete by checking for one of two icons in front of the specified search folder:

Description: C:\Users\mthompson\Desktop\Capture.JPG

While your search is running in the background, you will not be able to view results until the search is complete. To update the status of an “in progress” folder, simply right click it to refresh the status of your search folder.Once your search is completed, you will have full access to all results and reports on the search.

Next time you need to cull down data with a broad keyword search, consider running an asynchronous search to cut out the wait and maximize your efficiency.

For additional help, see your User Guide or contact your Case Manager at 1-800-347-6105.

“Ditto”: Copying Categorizations between Documents

“Ditto”: Copying Categorizations between Documents

Whittling down a data set in document review can be an overwhelming task, and anything that speeds up that process is worth storing in your tool belt. In the Ontrack Inview and Verve Review platforms the “Ditto” function is a viable option for expediting first-pass review.

The Ditto function allows reviewers to copy and apply review decisions from the previously viewed document to the “target” document, overwriting or removing existing review categories on that document. Here are two basic examples of the Ditto function in action:

  “Source” Document A “Target ” Document B “Target” Document AFTER Using Ditto Function
Example #1 Document A is categorized as “responsive” Document B has no categorizations Document B is categorized as “responsive”
Example #2 Document A is categorized as “responsive” Document B is currently categorized as “non-responsive” “Non-responsive” category is replaced; Document B is categorized as “responsive”

Based on system permissions in Ontrack Inview and Verve Review, the visibility of existing document categories may be restricted to certain reviewers. The Ditto function maintains category security by disabling its use when it would mean overwriting a hidden category. Additionally, privilege comments and administrator categories are never copied. Here are two more detailed examples of the Ditto function in action:

  “Source” Document A “Target ” Document B “Target” Document AFTER Using Ditto Function
Example #3 Document A is categorized as “privileged” but also has a review category of “confidential” that is hidden to the reviewer Document B has no categorizations Document B is categorized as “privileged,” but not “confidential” because of category security
Example #4 Document A is categorized as “privileged” but also has a review category of “confidential” that is hidden to the reviewer Document B is currently categorized as “non-responsive” “Non-responsive” category is replaced with “privileged,” but not “confidential” because of category security

The Ditto function warrants consideration in your next review to reduce the number of clicks between documents, which can significantly speed up review. For more information on the Ditto function, see the Ontrack Inview and Verve Review help documentation or contact your Kroll Ontrack Case Manager at 1-800-347-6105.