As the reliance on Apple products grows in many organizations, their IT and legal departments have a critical mission: avoid a Mactastrophe.
A Mactastrophe is a term we coined to describe what happens when an unwitting e-discovery novice attempts to review Mac data on a Windows-based platform. Besides the difficulty of reviewing the files, there is a chance for data corruption. This can introduce significant errors stemming from content being removed or unreviewable and/or metadata omission. You may end up with files that have altered dates and names, and some files may even go missing entirely. That means you’ll have a hard time establishing the chain of custody for the ESI, and you won’t be able to authenticate it and use in a courtroom. In short, you’ll have a colossal Mactastrophe!
The problem stems from the fact that Mac data is structurally different from Windows data. So, if an e-discovery project involves Mac data—and it likely will given the proliferation of Mac OS products in the workplace—you’ll need to identify, collect, and review the data using special procedures. Here are a few tips that can help prevent a Mactastrophe:
1. Find a Mac expert.
Genius Bar experience is not mandatory, but your IT personnel and e-discovery specialists must have Mac expertise to work on a Mac data e-discovery project. This skill is critical when handling password-protected and encrypted data on Apple products. Unlocking mobile devices like the iPhone 5, iPhone 4, and iPad mini has its own set of unique challenges. With each new release of an iOS version, Apple takes care to protect its security technology from malicious attacks, but this also stymies legitimate forensic techniques.
2. Separate and collect Mac data in its native format.
When identifying ESI for review, note whether the custodians use Mac computers, iPhones, or iPads. You’ll need to collect Mac data in its raw format and copy it onto HFS+ formatted drives or image it using Mac-specific forensic tools. Also, avoid inadvertently omitting data by searching for data from Mac-only applications, such as the iWorks suite, as well as files created in Windows-based programs, such as Microsoft Office. Don’t overlook data generated through virtualization, which occurs when users run Windows on their Macs.
3. Render with care.
Ideally, you would review Mac data in an exclusively Mac environment. But this is often cost-prohibitive, so the next potential solution is to format Mac files in PDF. This allows you to have the most accurate representation of the native data in a Windows-based review platform. This process must be properly done, however, to minimize the risk of losing or altering metadata in the conversion process.
Whatever approach you use, be sure to act early to ensure adequate time to handle the potential hurdles of managing an e-discovery project with this unique data.
About the Author