As we have noted before, the increase in the number of Mac’s in the legal field continues to grow. Increasingly we are encountering Macs on behalf of our clients in corporations and law firms and we have to include them in any eDiscovery requests. This in turn is requiring an increase in the number of experts needed to deal with eDiscovery challenges which can be unique to the Apple environment. While there are certainly similarities between an eDiscovery approach between the Windows and Apple environments, there are some differences that only “Macsperts”, those experienced with the unique features of Apple, can properly identify.
In the early phases of litigation, lawyers focus on the identification phase of the EDRM model. In particular, they attempt to focus on potential custodians and client IT contacts to gain a preliminary understanding of the case, particularly the electronic data, both the location and forms of potential data and which client personnel will be key in locating the data. The goal is to define where and how data is stored, how it can best be forensically gathered and ultimately the determination of whether it is responsive.
While the steps are the same for uncovering and identifying Windows and Mac data during discovery, Mac data requires some different handling to properly locate electronic material. This difference is primarily due to differences in how the operating systems differ, particularly in more recent versions of the operating systems.
Home Folders
In the Mac, the Home Folder is usually the default storage location for both user files and where the operating system will likely place user system preferences, internet cache files, cookies, pictures and multimedia files. Additionally the operating system creates other key folders within the Home Folder such as desktop, user documents and library (which contains system preferences). Home Folders often contain user-created documents since this is the default location for these files, making them extremely likely candidates to contain relevant material for review. In Windows, these types of files are typically located in the tree structure under headings such as My Documents, My Pictures and My Music folders.
Smart Folders
Mac’s use a system of “dynamic” folders that can contain file lists that match a specific search criteria executed by the user. Dynamic folders don’t actually have files stored in them; rather they contain file name pointers to the actual files which are located in other file locations. Dynamic folders assist users organize and locate similar documents that may be located throughout the operating system on the hard disk, without the need to copy them to a specific location. A user would use the Smart Folder concept to easily locate files that meet a certain search critieria, rather than remembering and executing a search protocol each time they needed to find relevant documents. Windows does not utilize this type of search/foldering option and in fact would require the user to execute a search each time they needed to find a document.
Aliases
Dynamic folders work because the pointer file or “alias” links to files, folders or external storage devices. Essentially, there can be many aliases pointing to a single file, based on the potential contents of the file and how the user thinks about that content. This allows a Mac user to quickly open frequently accessed files withoug going through a complicated search. An alias is similar to a “shortcut” in Windows, but it is considered to be more sophisticated since an alias tracks a file even if the user moves its location.
Both Smart Folders and Aliases are sophisticated organizational options that allow users to easily access underlying files, regardless of the location of that file. Files are physically located in one location but may have a number of aliases in different Smart Folders. In the Mac world, the eDiscovery focus should be on the physical file location rather than the pointers. That is why the primary focus should be on the Home Folders.
Backup Utilities
More recent Mac operating systems use an integrated backup utility called Time Machine which stores data on an external hard drive. The default setting on Time Machine automatically backs up all files on a computer. If selected without setting changes, there are likely to be backup copies of every file on the computer, with multiple complete copies available. This should be considered when eDiscovery plans are put into place or when responses are being prepared for the opposition. Determining the type of backups in place and responding accordingly will go a long way towards eliminating eDiscovery fights.
Summary
Theses are a few of the differences that must be considered by lawyers based on the computer systems used by their clients or the opposition. Making sure that your eDiscovery consultant is familiar with these and other Mac differences will help assure that your eDiscovery process is complete and does not result in any unwanted surprises.
