LEGAL VIEW: Backup tapes in electronic discovery

By W. Lawrence Wescott II

The Daily Record Newswire

If backup tapes were used by companies for the purpose for which they were intended, they would never be involved in e-discovery disputes.

Backup tapes were originally designed for the reconstruction of computers (usually file servers) when their hard drives crashed. Large amounts of data could be quickly written to relatively inexpensive media, usually tape. The order in which the files were written to the tape was irrelevant; to fully restore a hard drive, all of the files written to the tape had to be retrieved.

In active businesses, files are constantly being added, deleted or changed on the file systems. The older the backup, the greater the amount of data which is potentially lost.

Thus, when utilized purely for the purpose of disaster recovery, tapes can be recycled after a few days. (Theoretically, if backups worked perfectly 100 percent of the time, the same set of tapes could be reused every day.) If you restore a drive with a tape that's more than a few days old, you've lost a potentially significant volume of information.

Data archives

If used only for disaster recovery, backup tapes would have been recycled long before the dispute leading to discovery arose. However, in many organizations, backup tapes were not used just for disaster recovery. They were -- and frequently still are -- used for data archiving.

How many people have had the experience of deleting a file by mistake, and calling the IT department to restore the file? As a former IT manager, I was often asked to do this. If you could tell me the name of the file, and when it was deleted, I could find the right tape and have the file restored within about a half hour or so, assuming that the particular tape had not been moved offsite). However, if you didn't know the file name, you were out of luck.

Conventions were developed to capture snapshots of data at various points in time. One popular strategy is the "grandfather-father-son" tape rotation scheme.

* The "sons" are daily backups, Monday through Thursday, with the tapes being recycled every Monday.

* "Father" backups are made weekly. The Friday tapes are saved (week one through three or four) and recycled every "week one."

* "Grandfather" tapes are made monthly; the last weekly tape of the month becomes a monthly, or a "grandfather" tape. These might be saved and recycled after a number of years. In this way, a historical archive of company data can be developed.

It is these historical archives that become the subject of electronic discovery. For companies that have developed these types of archives using backup tapes, it is also important for counsel to understand what type of backup convention was used, and how they were used among company computers. This is a task which must be undertaken quickly; otherwise, counsel runs the risk that tapes containing relevant data could be recycled.

How are individual tapes used? If counsel is lucky enough to know the exact names of the desired files, recovery of those files can be relatively straightforward.

Unfortunately, that is seldom the case. In most instances, it is necessary to search inside the files to find the desired information. And the process that makes backup tapes ideal for disaster recovery makes them unsuited for searching that same information.

Data is written and stored on backup tapes in a highly compressed format and in sequence; in order to retrieve and search the data, for all practical purposes it is necessary to restore the tape contents.

To put it another way, backup tapes are like the music cassettes of yesteryear. Data cannot be accessed instantly, as it can on a CD track or an MP3 file; instead, the tape must be wound to the appropriate point.

This is why backup tape e-discovery is expensive. Although firms have developed indexing technology to greatly reduce the effort needed to find and retrieve data from backup tapes, getting information from backup tapes is still more difficult than getting that same information from a hard drive, CD or other random-access media.

Because of those characteristics, courts may classify data on backup tapes as "not reasonably accessible" for purposes of Federal Rule 26(b)(2)(B). See Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 320 (S.D.N.Y. 2003).

Under the Rule, "[a] party need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost."

The story does not end there, however. The Advisory Committee's notes accompanying the rule indicate that "[a] party's identification of sources of electronically stored information as not reasonably accessible does not relieve the party of its common-law or statutory duties to preserve evidence."

Rule 26 also provides that upon a motion to compel, it is the producing party's burden to show that information is not reasonably accessible because of undue burden or cost. In addition, even if the showing is made, the court may still order discovery if the requesting party demonstrates good cause.

What's ahead

Backup tapes have often been the subject of electronic discovery disputes. When producing parties fail to produce emails sought by requestors, the requesting parties frequently seek recourse to backup tapes to show that the incriminating documents did once exist.

The stakes can be high: if the data is found on the backup tapes, the result can be a spoliation sanction, which could result in an adverse inference instruction to the jury, or monetary assessments.

----------

W. Lawrence Wescott II, Esq., a former IT manager and database development manager, is an e-discovery consultant. He is currently chair of the Technology committee of the Maryland State Bar Association's Litigation Section. He can be reached at wescott_ediscovery@verizon.net.

Published: Wed, Oct 26, 2011

Comments

  1. No comments
Sign in to post a comment »