How to Avoid a Mactastrophe

November 19, 2013 conduentblogs

As the reliance on Apple products grows in many organizations, their IT and legal departments have a critical mission: avoid a Mactastrophe.

A Mactastrophe is a term we coined to describe what happens when an unwitting e-discovery novice attempts to review Mac data on a Windows-based platform. Besides the difficulty of reviewing the files, there is a chance for data corruption. This can introduce significant errors stemming from content being removed or unreviewable and/or metadata omission. You may end up with files that have altered dates and names, and some files may even go missing entirely. That means you’ll have a hard time establishing the chain of custody for the ESI, and you won’t be able to authenticate it and use in a courtroom. In short, you’ll have a colossal Mactastrophe!

The problem stems from the fact that Mac data is structurally different from Windows data. So, if an e-discovery project involves Mac data—and it likely will given the proliferation of Mac OS products in the workplace—you’ll need to identify, collect, and review the data using special procedures. Here are a few tips that can help prevent a Mactastrophe:

1.      Find a Mac expert. 

Genius Bar experience is not mandatory, but your IT personnel and e-discovery specialists must have Mac expertise to work on a Mac data e-discovery project. This skill is critical when handling password-protected and encrypted data on Apple products. Unlocking mobile devices like the iPhone 5, iPhone 4, and iPad mini has its own set of unique challenges. With each new release of an iOS version, Apple takes care to protect its security technology from malicious attacks, but this also stymies legitimate forensic techniques.

2.      Separate and collect Mac data in its native format.

When identifying ESI for review, note whether the custodians use Mac computers, iPhones, or iPads. You’ll need to collect Mac data in its raw format and copy it onto HFS+ formatted drives or image it using Mac-specific forensic tools. Also, avoid inadvertently omitting data by searching for data from Mac-only applications, such as the iWorks suite, as well as files created in Windows-based programs, such as Microsoft Office. Don’t overlook data generated through virtualization, which occurs when users run Windows on their Macs.

3.      Render with care.

Ideally, you would review Mac data in an exclusively Mac environment. But this is often cost-prohibitive, so the next potential solution is to format Mac files in PDF.  This allows you to have the most accurate representation of the native data in a Windows-based review platform.  This process must be properly done, however, to minimize the risk of losing or altering metadata in the conversion process.

Whatever approach you use, be sure to act early to ensure adequate time to handle the potential hurdles of managing an e-discovery project with this unique data.

Charles Lavallee is a director at Lateral Data, a Conduent company. He can be reached at info@conduent.com.

About the Author

Biography

Previous Article
E-Discovery Word of the Year: “Proportionality”

“Selfie” may be the word of the year with a reported 17,000% increase in usage in 2013, according to the pu...

Next Article
The Next Regulatory Challenge: The Dodd-Frank Act

Although lobbyists are working to expand exemption thresholds, CIOs, compliance managers, general counsel, ...