EDRM Metrics Glossary

Processing Phase

Reducing the volume of ESI and converting it, if necessary, to forms more suitable for review and analysis. 13 Corresponds to UTBMS Code L630-L639. ESI Stage, Preparation and Process, Scanning - Hard Copy, Foreign Language Translation, Exception Handling, Quality Assurance and Control.

Metrics DB: File Type Culling

Refers to a processing method by which specific data is either selected or removed from a larger set solely based on the format. Though it can be manipulated, a user can often identify the kind of data stored in a file through the filename extension (e.g. .pdf, .ppt, .docx).

Time

Refers to the measurable hours involved in each identifiable task, activity or action. Time is also a variable element of Cost and Volume.

Metrics DB: File Count Pre-Processing

Represents the number of files going into processing. This process will typically count the number of container files but not number of files extracted from containers.

Metrics DB: Individual Count Post-Culling

Represents the number of files including parents and children remaining after culling methods have been applied.

Metrics DB: Family Count Post-Deduplication

Represents the number of parent or family files remaining after deduplication process has been applied.

Metrics DB: Family Count Post-Culling

Represents the number of parent or family files that remain after various filtering and culling methods have been applied.

Volume

Volume is the principal variable of Metrics. Volume is the amount of data that is part of the eDiscovery collection. Volume will set the estimate for Cost and Time. For example, a large data Volume will cause an increase in the Time required to complete the Phases for Processing, Review and Production, thus increasing the Cost of the project. If the volume of data decreases, Time & Cost will also likely decrease.

Metrics DB: Dedupe Method

(1) Global/Case. (2) Custodian.

Status

A common element within each e-discovery Phase which refers to the activities, tasks and methods undertaken in relation to a defined objective within a Phase. In Project Management, benchmarking of current work against expressed, intended or expected outcome, and reporting on same.

Custodian

A common element within each e-discovery Phase which refers to the individual(s) responsible for data types or repositories for a given entity. Individuals in possession of data that is potentially relevant to a case.

UTBMS: Near-Native Forms

A near-native format describes an electronic document that has been altered or converted from its original form in order to provide enhanced content control to a producing party while maintaining a level of usability consistent with its original format (e.g. conversion of a word document to a TIFF image with OCR to support redactions).

Load File

A load file is used to import images or coding (the bibliographic information about a document (e.g., To, From, CC, BCC, and Subject fields within an email) into a database. It sets out links between the records in a database and the document image files to which each record pertains. This is a critical deliverable of any processing, scanning, or coding job. Without a correctly structured load file, documents will not properly link to their respective database records.

Activity

A common element within each e-discovery Phase which refers to measurable tasks and actions working directly with the ESI.

L600 Code Series

A UTBMS Code Set exclusively for e-discovery purposes created by the LEDES Oversight Committee ("LOC") Board.

System

A common element within each e-discovery Phase which refers to computer storage devices, active applications for the storage or use of data or ESI; or to work processes designed to achieve a specified result.

QA & Control

A common element within each e-discovery Phase which refers to defined steps, procedures and methods taken to ensure that work is done completely, accurately and in a manner which is consistent with expectations, instructions and best practices.

Metrics DB: Keyword Culling

A culling method by which specific data is either selected or removed from a larger set based on whether said data contains a certain term, string of characters, or combination thereof. Keyword culling methodologies often leverage Boolean connectors.

Metrics DB: Date Culling

A culling method by which specific data is either selected or removed from a larger set solely based on criteria related to date or time. Such criteria include the specific date on which a document was created, modified, or accessed, or, the case of email, the date on which a message was sent or received. Typically, a date culling methodology leverages a range of dates within which documents match specific criteria.

Metrics DB: Custodial Culling

A culling method by which specific data is either selected or removed from a larger set solely based on whether said data is stored and/or maintained by a particular individual on a repository within their administrative control.

Metrics DB: Data Source Culling

A culling method by which specific data is either selected or removed from a larger set solely based on whether said data originates from or is stored within a particular repository or on certain media.

UTBMS: Data Steward

A data steward is someone that is responsible for maintaining and managing the data assets of a particular organization. The role of data steward can be contrasted from a data custodian in that, though they both may share certain responsibilities with regards to data, a data custodian, in the e-discovery context, is often used to describe the individual responsible for the day-to-day control of a certain data set (i.e. an individual is the data custodian for their email inbox, an IT manager is the data custodian for file shares on a network server).

UTBMS: Defensibility

A highly prized Information Governance (IG) solution attribute today and in the foreseeable future is Defensibility. CE-discovery and archiving vendors tout this concept, especially as it relates to an entity's litigation or regulatory activities and its ability to produce, in a timely fashion, written documents or ESI. However, in practice, defensibility is a much broader concept.

UTBMS: Legal Hold

A legal hold is a communication issued as a result of current or anticipated litigation, audit, government investigation or other such matter that suspends the normal disposition or processing of records. Legal holds can encompass business procedures affecting active data, including, but not limited to, backup tape recycling. The specific communication to business or IT organizations may also be called a "hold," "preservation order," "suspension order," "freeze notice," or "hold notice." 20

UTBMS: Privilege Log

A record of the responsive and/or relevant documents that are being withheld from production on a claim that they either contain attorney-client communication or are attorney work-product. Though there is not standard rule describing the necessary content for a privilege log, the Federal Rules of Civil Procedure contain a general requirement that a privilege log "describe the nature" of the privileged document in a manner that "will enable other parties to assess the claim." Fed. R. Civ. P. 26(b)(5)(A). A list of a set of documents that a Producing Party did not produce on account of Privilege such as Attorney-Client Privilege. 26

UTBMS: Privilege Review

A review of the documents identified as responsive or relevant in a particular legal proceeding for the additional legal classification of privilege whether as attorney-client communication or under the work-product doctrine. The law permits a disclosing party to withhold production of documents on the grounds of legal privilege. Usually, a Privilege Log is generated in conjunction with the Privilege Review. See also Privilege Log.

UTBMS: Data Recovery

The process of restoring data that has been "deleted" from a storage device or retrieving data from a device that has failed, been corrupted, is damaged, or considered inaccessible.

Targeted Collection Strategies

A targeted collection strategy is one that is specifically designed to avoid over collection of data that is known to be irrelevant or potentially irrelevant. A non-targeted strategy is designed to collect all the data from a particular storage device or repository in a comprehensive manner. Culling and filtering protocols are subsequently applied to the data corpus to either eliminate non-responsive data or isolate responsive data. A targeted strategy takes into consideration culling and filtering protocols at the point of collection (e.g. only collecting a custodian's email inbox as opposed to imaging their entire hard drive).

UTBMS: Preservation Order

Also called a "legal hold," "hold," "hold order," "hold notice," "suspension order," or "freeze notice". A Preservation Order is a communication issued as a result of pending or reasonably anticipated litigation or government investigation or action directing the suspension of the normal disposition or processing of records, including electronically stored information.

UTBMS: ESI Inventory

An ESI inventory is a systematic process for identifying all of the records and non-record information in an organization, who creates, uses, or receives the information, and where users store it. A completed inventory provides a complete picture of the information environment. This picture is very helpful for assessing the needs of your RIM program. 18

Metrics DB: Threading Culling

An email thread is a file that contains an original email along with the subsequent replies to and/or forwards of that original email. Threading culling allows users to review all of the individual replies and forwarded messages relating to an original email as one inclusive record or grouped set of records. Users can review emails according to conversations as opposed to viewing fragmented and duplicative emails messages contained within a thread in isolation.

Early Case Assessment

An industry-specific term generally used to describe a variety of tools or methods for investigating and quickly learning about a Document Collection for the purposes of estimating the risk(s) and cost(s) of pursuing a particular legal course of action. 4 A widely abused term in which corporate data is sifted and categorised with a view to determining an organisation's exposure in the context of a dispute. The best ECA systems allow the sifting to take place within a corporation's own data store and can be used to drill down rapidly to identify the most pertinent evidentiary material and to facilitate decisions whether to litigate or settle. 5

UTBMS: ESI Processing

Any action taken on data using technology to reduce a data corpus based on specific criteria, organize data according to certain parameters, or convert data to another format more suitable for review and analysis.

Metrics DB: Other Culling

Any other culling method by which certain criteria is used to either select or remove certain data from a larger corpus. Examples include: date range, file type or custodian/source.

UTBMS: Off-Line Storage

Any storage medium that is not immediately available, and must be inserted into a storage drive by a person before it can be accessed by the computer system. Examples include CD/DVD optical media, USB memory sticks, and tape cartridges. Offline storage is also called removable storage. 25

UTBMS: Secondary Line Storage

Computer storage, as on disk or tape, supplemental to and slower than main storage, and not under the direct control of the CPU and generally contained outside it. 30

Metrics DB: Container Files

Container files store one or more files in a compressed form (e.g. RAR or ZIP format).

Project Management Phase

Corresponds to UTBMS Code L690. Activities or actions to associated with supervising or managing specific activities or actions throughout the EDRM continuum such as conducting meetings and team calls, developing work plans, budgets, forecasts, reports and other meaningful activities or for general project management not associated with a particular "L" code.

Cost

Cost refers to the measurable dollars associated with each identifiable task, activity or action. Cost is also a variable element of Time and Volume. Cost may also include discrete elements that may be independent of Time or Volume.

UTBMS: ESI Data Map

Data mapping finds or suggests associations between files within a large body of data, which may not be apparent using other techniques. 17

UTBMS: Non-Custodial Data

Data or records that are not created or maintained by an individual user, or whose physical storage and protection during the retention cycle are maintained by a system custodian and not end-users. Examples of non-custodial data may include data in certain structured systems, or access control or similar logs. It may not be possible to attribute authorship to non-custodial data. In contrast to Custodial Data.

UTBMS: ESI Staging

Data staging is the process by which original ESI files are copied, isolated, and stored in a forensically sound manner for future use.

Production Phase

Delivering ESI to others in appropriate forms and using appropriate delivery mechanisms. 14 Corresponds to UTBMS Codes L670-L679. Conversion of ESI to Production Format, Quality Assurance and Control.

Presentation Phase

Displaying ESI before audiences (at depositions, hearings, trials, etc.), especially in native and near-native forms, to elicit further information, validate existing facts or positions, or persuade and audience. 11 Corresponds to UTBMS Code L680. Activities and actions to prepare and display ESI before audiences (at depositions, hearings, trials, etc.), especially in native and near-native forms, to elicit further information, validate existing facts or positions, or persuade an audience.

Phases (Stages)

Distinct segments of the e-discovery process which contain measurable activities that can be tracked according to volume, cost and time. These segments correspond to the L600 codes for: Identification (L600), Preservation (L610), Collection (L620), Processing (L630), Review (L650), Analysis (L660), Production (L670), Presentation (L680) and Project Management (L690).

EDRM

EDRM is an organization that creates practical resources to improve e-discovery and information governance. Since 2005 the e-discovery community has relied on EDRM for leadership, standards, best practices, tools, guides and test data sets to improve electronic discovery and information governance. Member individuals, law firms, corporations and government organizations actively contribute to the direction of EDRM.

UTBMS: Native Format

Electronic documents have an associated file structure defined by the original creating application. This file structure is referred to as the "native format" of the document. Because viewing or searching documents in the native format may require the original application (i.e., viewing a Microsoft Word document may require the Microsoft Word application), documents are often converted to a standard file format (i.e., tiff) as part of electronic document processing. 21

Preservation Phase

Ensuring that ESI is protected against inappropriate alteration or destruction. 12 Corresponds to UTBMS Codes L610-L619. Preservation Order, Legal Hold, Quality Assurance and Control.

Analysis Phase

Evaluating ESI for content and context, including key patterns, topics, people and discussion. 1 Corresponds to UTBMS Code L660. Activities and actions required by litigation teams to be able to make informed decisions about strategy and scope through reliable methods based on verified data.

Review Phase

Evaluating ESI for relevance and privilege. 15 Corresponds to UTBMS Code L650-L659. Hosting Costs, Review Planning and Training, Objective and Subjective Coding, First Pass Document Review, Second Pass Document Review, Privilege Review, Redaction, Quality Assurance and Control.

UTBMS: Exception Handling

Exception handling is the process of responding to the occurrence, during computation, of exceptions - anomalous or exceptional events requiring special processing - often changing the normal flow of program execution. It is provided by specialized programming language constructs or computer hardware mechanisms. Exceptions also occur when doing a review, for example.|In general, an exception is handled (resolved) by saving the current state of execution in a predefined place and switching the execution to a specific subroutine known as an exception handler. If the exception state permits continuation, the handler may later resume the execution at the original state using the saved information. For example, a floating point divide by zero exception will typically, by default, allow the program to be resumed, while an out of memory condition might not be resolvable transparently.|Alternative approaches to exception handling in software are error checking, which maintains normal program flow with subsequent explicit checks for contingencies reported, using special return values or some auxiliary global variable such as C's errno or floating point status flags; or input validation to preemptively filter exceptional cases. 19

UTBMS: Forensic Analysis Activity

Forensic analysis is the use of controlled and documented analytical and investigative techniques to identify, collect, examine, and preserve digital information. Recognizing the fragile nature of digital data, and the legal and regulatory requirements to properly preserve electronically stored information (ESI) during forensic investigations.

Collection Phase

Gathering ESI for further use in the e-discovery process (from EDRM Stages web page). 2 Corresponds to UTBMS Code L620-L629. Collection/Recovery, Media Costs, Media/ESI Transfer, Receipt, Inventory, Quality Assurance and Control.

Metrics DB: Deduplication

In the context of e-discovery, deduplication refers to the reduction of duplicate files based on identical file finger prints or a combination of file finger prints and metadata attributes. Deduplication is used in legal review to reduce the amount of data required for review. Exact duplicates are identified by comparing the hash values of two or more documents. A hash value is a unique identifier associated with a particular document generated by a specific mathematical algorithm based on a document's content and attributes. MD5, SHA-1, and SHA-180 are examples of different hashing algorithms. Deduplication is applied to data sets in different ways including globally (i.e. to an entire data set across custodians - often referred to as "horizontal deduplication"), by custodian (i.e. within each custodian's documents - often referred to as "vertical deduplication"). A near duplicate is a document that is materially similar to another but is different on a bit-level. It is important to note that near deduplication is based on the content of a document, not the hash value, and can be impacted but such factors as standard language, document headers and footers (e.g. email signatures or disclaimers), and OCR quality. Finally, the definition of deduplication within the context of e-discovery is slightly different than that used within data storage management. Storage management often leverages deduplication to store a single instance of a file.

Identification Phase

Locating potential sources of ESI and determining its scope, breadth and depth. 7 Corresponds to UTBMS Codes L600-L609. Discovery Planning, Interviews, Quality Assurance and Control.

UTBMS: Near-Line Storage

Near-line storage is used as an inexpensive, scalable way to store large volumes of data. Near-line storage devices can include DAT and DLT tapes, optical storage, and standard also slower P-ATA and SATA hard disk drives. Near-Line implies that the storage is not immediately available, but can be made online quickly without human intervention. Near-line can be slower, but generally, the type of data stored in near-line systems does not require instant access. 22

UTBMS: On-Line Storage

Online storage is fully accessible and immediately available. This includes DRAM memory, solid-state drives (SSD), and always-on spinning disk, regardless of rotational speed. In contrast to near-line storage and off-line storage.

UTBMS: ESI Preparation

Preparing ESI (electronically stored information) for processing and presentation.

UTBMS: ESI Presentation

Presenting ESI (electronically stored information) to the desired viewer, whether it be in depositions, production, trial, etc. ESI may be presented in native format, near native format, or in some other form acceptable to the parties.

Metrics DB: Culling Methods

Procedures used to select a particular set of documents from a larger corpus based on specifically-define criteria. Culling methods are most commonly used as a means to eliminate non-responsive material from a document collection in order to narrow the scope of potentially responsive materials requiring attorney review. Common culling methods include custodial culling, data source culling, date culling, file type culling, domain culling, keyword culling, and deduplication.

UTBMS: Project Management

Project management is the discipline of planning, organizing, motivating, and controlling resources to achieve specific goals. 27 A project is a temporary endeavor with a defined beginning and end, undertaken to meet specific goals and objectives and can be distinguished from operations (business as usual). The primary objective of project management is to deliver the project goals while managing the constraints on project delivery. The primary constraints are scope, time, quality and budget. 28 The secondary challenges are to optimize the allocation of necessary inputs and integrate them to meet pre-defined objectives. 29 Project management principles apply to e-discovery, and most e-discovery activities are projects.

EDRM framework

See EDRM diagram|EDRM framework guides|The EDRM framework guides are a series of practical guides developed for each stage of the e-discovery process as depicted in the EDRM framework.

UTBMS: Structured Data

Structured Data is data that is organized. The most common type is database content. It refers to any type of data organized such as Internet data or other types of data that has been indexed. Data that resides in a fixed field within a record or file is called structured data. This includes data contained in relational databases and spreadsheets. 31

UTBMS: Redaction

The processing of editing the content of a document, usually by obscuring or removing certain sensitive, confidential or privileged information, prior to its production from one party to another.

EDRM diagram

The EDRM diagram is conceptual, non-linear, iterative model of the e-discovery process.|It represents a conceptual view of the e-discovery process, not a literal, linear or waterfall model. One may engage in some but not all of the steps outlined in the diagram, or one may elect to carry out the steps in a different order than shown here.|The diagram also portrays an iterative process. One might repeat the same step numerous times, honing in on a more precise set of results. One might also cycle back to earlier steps, refining one's approach as a better understanding of the data emerges or as the nature of the matter changes. 6

EDRM Phases

The Electronic Discovery Reference Model, also referred to as EDRM or the EDRM diagram, outlines the key processes and stages of the e-discovery process in the form of nine interrelated phases: Information Governance, Identification, Preservation, Collection, Processing, Review, Analysis, Production, and Presentation. Each phase represents a core stage of the e-discovery process. By breaking the e-discovery process into phases, practitioners can leverage core resources (i.e. people, technology, and processes) in a more organized fashion to achieve desired results.

UTBMS: Subjective Coding

The Subjective Coding of a document involves linking a legal interpretation to an individual document. In direct opposition to objective coding, in which bibliographic data about the document is recorded. Subjective Coding types include the classification of documents as privileged and responsive, and the categorization of documents by legal issue ("issue coding"). Entering information from a document that requires the coder to exercise judgment, such as subject or issue codes. This field is often left blank for the law firm's paralegals or associates to fill in. 32 The coding of a document using legal interpretation as the data that fills a field. Performed by paralegals or other trained legal personnel. 33 Categorizing documents by their responsiveness to specific case issues or topics.

In the parlance of the IG space, defensibility can apply to:

The ability to demonstrate that appropriate, achievable, consistent policies governing the management of physical and electronic records have been developed and implemented and that employees have been informed and educated on those policies as well as offered ongoing training and updates. The ability to demonstrate repeatable processes that support a firm's need to comply with legal or regulatory requirements. The ability to respond to legal or regulatory ediscovery requests in a timely fashion to thwart questionable litigations or potential fines that could be levied due to inability to produce ESI. The implementation of solutions that offer predictability whether it be to support compliance with retention policies, the ability to capture all appropriate ESI or the ability to scale as more content is managed electronically with assurance that all needed ESI is captured and preserved. The creation of an information security strategy that limits both external and internal risks and breaches when they occur. A risk management strategy that identifies potential liabilities, improves disaster preparedness and protects corporate and personal assets.

Metrics DB: Data Volume Pre-Processing

The amount of data collected from various sources prior to the application of any culling methodologies or manipulation or conversion of files in their native format.

Metrics DB: Data Volume Post-Processing

The amount of data in a data set after the extraction of data from contained files and resultant expansion, the application of culling filters and other data reduction methodologies, text extraction and optical character recognition, and other manipulation of native data.

Metrics DB: Data Volume Post-Deduplication

The amount of data remaining in a data set after duplicate files have been removed.

UTBMS: Hosting Costs

The cost to host data on a database or review platform; traditionally, the hosting phase occurs after data is collected, processed, and loaded to the review tool. Cost of hosting is typically by GB per month.

UTBMS: Production Format

The format in which various documents are delivered from one party to another during the course of a legal proceeding. Available formats for document production are native, near or quasi-native, image (e.g. TIFF or PDF images), and paper. Rule 26(f) sets an expectation that the method and format by which ESI is to be produced should be considered and negotiated by the parties early in the discovery process. FRCP 34(b)(1)(E)(ii) states that "if a request does not specify a form for producing ESI, a party must produce it in a form or forms in which it is ordinarily maintained or in a reasonably usable form or forms." A key question regarding production formats is whether to include associated metadata. See also: native, near-native, image, and paper.

UTBMS: Conversion to Production Format

The process of restoring data that has been "deleted" from a storage device or retrieving data from a device that has failed, been corrupted, is damaged, or considered inaccessible.

Aspect

The major elements common to each e-discovery Phase around which identifiable metrics activity aggregates: Custodians, Systems, Media, Status, Format, QA & Control, and Activities.

Media

The physical material used to store electronic data. Media includes hard drives, backup tapes, computer disks, CDs, DVDs, PDAs, memory, etc. 8 9 Any external data store format, such as CDs, Jaz drives, DLT tapes, DVDs, or diskettes received from clients containing source data. 10 The material (disk drive, tape, floppy disk, paper, etc.) on which electronic documents have been recorded.

E-Discovery

The process of identifying, preserving, collecting, processing, searching, reviewing and producing Electronically Stored Information that may be Relevant to a civil, criminal, or regulatory matter. 3

UTBMS: Objective Coding

The recording of basic data such as date, author, or document type, from documents into a database. 23 Extracting information from electronic documents such as date created, author recipient, CC and linking each image to the information in pre-defined objective fields. In direct opposition to Subjective coding where legal interpretations of data in a document are linked to individual documents. Also called bibliographic coding. 24 Extracting various segments of information from a document such as its author, recipient, mailing date, or other fields, etc. Objective Coding is usually done from the document text or image because metadata or searchable text may be unavailable (e.g. a handwritten document that has been scanned), or the document may contain inaccurate metadata (e.g. metadata associated with a document written and signed by a partner might reflect the administrative assistant as the author where the document was originally typed on the assistant's computer).

Metrics DB: Data Volume Produced

The total amount of data either delivered to or received from a third party in the context of a legal proceeding. Typically, any amount of data delivered to an opposing or third party has been reviewed for responsiveness, confidentiality and privilege as a precondition of production.

Metrics DB: Data Volume Reviewed

The total amount of data examined by counsel and classified as responsive to certain claims or issues, as attorney-client communication or privileged work product, confidential, or some other designation prior to it being produced to any third party. A reviewed data volume may also include data that has been classified through the use of advanced analytics technologies according to a defined assisted review process.

Metrics DB: Family Count Reviewed

The total count of parent or family files that have been reviewed.

Metrics DB: Total Hours Reviewed

The total number of hours spent on review by all reviewers (combined). This should include both attorney and litigation support team (paralegal, review specialist, etc) hours. This should not include time spent on processing or culling the data in preparation for review, or the establishment of batches or groups of records for review.

Metrics DB: Data Volume Post-Culling

The volume of data remaining after specific culling methods have been applied to a larger data set.

Metrics DB: Individual Count Produced

Total count of all files produced including parents and children, counted separately.

Metrics DB: Individual Count Reviewed

Total count of all files reviewed including parents and children, counted separately.

Metrics DB: Family Count Produced

Total count of parent or family files produced.

Metrics DB: Family Count Post-Processing

Typically, this is the first step in preparing data for further filtering and culling. Refers to the total pre-deduplication count of parent or family files/documents after containers and embeddings are extracted. Does not include the original container files (e.g. .zip, .rar, .jar, .tar,etc.), in the file count.

UTBMS: Unstructured Data

Unstructured Data is the majority of data created today. It is the opposite of "structured data" such as indexed data found in a database because it is not pre-organized or pre-defined. Examples of unstructured data include Microsoft Word and other word processing documents; spreadsheets; email; Web pages; images; videos; and text.

UTBMS: First Pass Document Review

Where a document review is organized in stages, the first pass document review is the first look at the documents that were identified as potentially responsive or relevant from the initial document collection. Typically, a first pass reviewer analyzes the documents for relevance or responsiveness and codes or marks them as such. Often, the reviewer will code for confidentiality and make an initial privilege determination during the first pass review.

UTBMS: Second Pass Document Review

Where a document review is organized in stages, the second-pass document review is the second, more detailed review of documents that were identified as potentially responsive or relevant in the first-pass review. Second-pass review can consist of a detailed review of documents to determine what documents should be withheld production on the grounds of privilege, relevance or other factors and which documents should be redacted. Second-pass review can also be used to quality-check (QC) the first-pass review. Second-pass review is frequently performed by more senior attorneys. In contrast to first-pass review. See also: Document Review.