Electronic Discovery: Dates

Dates, Dates, Dates.

This is a subject that has been covered on this site on numerous occasions, and will be covered again. No apologies are made for this, because of the sheer importance of the subject.

Lawyers, vendors, and groups such as LiST, all  recognize the important of dates, but are the “right” dates being produced, reviewed, or understood?

Different people, different tools, different companies have different interpretations of what the right date is.  They can’t all be right. In fact if there are 4 differnet companies showing their opinion on the correct date, and there are 6 dates available, then at best at least 3 companies are going to be “wrong” at worst all 4 are wrong. Alternatively, as you will see below all four could be right.

Firstly we need to indentify the problem. There are lots of dates for a file, created date, modified date, accessed date, file system dates, metadata dates, printed dates, etc. Dates with strange names like “MFT entry dates” or “registry dates”. There are  even dates in other files that tell you about the file you’re looking at, but they are not included in the review. Then there is the whole discussion about what is meant by “created” or “modified”. Does “created” mean the first time the file was created, or the first time it was created on the custodians computer, or the first time it was received by the custodian?

A Common Division

Some companies chose to show a particular date in a review platform, they chose the “file system” dates for a document. We will call these companies, Company A.

This means that the created date for a file will be the day the file is “created” on that computer they are processing data from. For example a file is created on 1st Jan 2009, it is then emailed to a user on 31st July  2009 who then saves it on the computer the next day. Therefore the created date for that file is 1st August 2009. That information is stored in the file system, and it is this information that is pulled out and displayed in the review platform.  Therefore when a lawyer reviews the date of the document and looks for the “created” date of a file they will see 1st August 2009.

“Ahh, but wait, that’s wrong” cries Company B. Company B believe that the true date is the 1st January 2009, this is stored in the metadata of the word document. So Company B shows their clients 1st January 2009.

This means that for the same document two companies will show different dates for the same file

Company Date Created
Company A 1st August 2009
Company B 1st January 2009

They can’t both be “right” for a single definition of the created date. The difference here is just 6 months, but it could easily be years. If dates are being used as filtering criteria it is easy to see how critical files can be filtered out by date filtering

Company C

Company C steps in, and says “Look your both wrong. LiST states that you need to put in date shown on the document”. So, Company C manually opens the document and looks at the front of the word document, which is a report. The report states “Account Report 2008”. The coding is put down as 1/1/2008.

The dates available to the client in the different review platforms are now:

Company Date Created
Company A 1st August 2009
Company B 1st January 2009
Company C 1st January 2008

It’s the Email. Stupid

Company D, looking on sagely states, “Your clearly all wrong. The date you want is the date the file is emailed, and that was 31st July 2009. That’s the ‘created’ date because that is when the file was actually received, and that’s what the client wants to know”

Now, a client, if they chose to shop around has a variety of dates.

Company Date Created
Company A 1st August 2009
Company B 1st January 2009
Company C 1st January 2008
Company D 31st July 2009

Use ‘em all

Company E, has been watching this with hindsight, and decides that the best thing for the client is to show all of the dates and a selection of different modified dates as well. Just to cover all of the bases.

File Name File System  Created Date Metadata Created Date Email Date Coded Date File System Modified Date Metadata Modified Date
Word Document 1st August 2009 1st January 2009 31st July 2009 1st January 2008 28th August 2009 28th August 2009

As the word document file was spell checked by the custodian, on the computer being processed, on 28th August 2009, the file was last modified on this date.


If this array of dates is provided to a review team they are unlikely to understand the staggering amount of information available to them, or they may make false assumptions. For example files can be moved between drives (e.g .thumb drives and desktops) without the created date changing or sometimes the date can change. The modified date can be before the created date, that always causes questions.

Just providing a huge range of dates can be problematic, despite its attempts to be helpful. Equally, not providing these dates will mean that filtering, searching, and sorting will cause problems.

The problem is very quickly multiplied as the volumes of data increases. In the example shown just one file has been processed and 6 dates produced. If there are 200,000 files, that’s a total of 1.2 million dates. That’s a lot of dates.

Is there a solution?

There is no single solution. There is no review platform that has the perfect solution that the author is aware of; if somebody thinks there is please contact this site, and we will put up the article/information.

For every argument for a “correct” date, there is one against it. E.g. not every file has a metadata date; text files for instance don’t. Equally the file system date is easily altered and not always relevant.

A remedy put forward by some people is to produce all of the dates (there actually more than the just the 6 shown) consult with the client and then show the dates required and hide the rest. When the project scope changes or more detailed information is required about a given file those dates can then be shown as necessary. It’s not perfect, but it’s a method that can help with the quagmire of dates.

What does not help is insisting that there is one correct date, or that that one method is right. All dates are important, it just depends on what question is being asked.


One Response to “Electronic Discovery: Dates”

  1. Setting up dates for lawyers « Chris Dale Lawyer Support Says:

    […] of posts which support my view that it is a valuable resource on technical matters. Two posts, Electronic Discovery: Dates and Electronic Discovery: Dates and Questions address the difficulties which can arise due to […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: