I can hardly believe it’s taken this long to get back to blogging.  It’s been a whirlwind of new matters and teaching of late, such that I looked up from my computers to find I’d mislaid January.

This is a short post about two invaluable files often missed when parties consider what to collect and process for discovery.  If you’re not preserving, collecting and processing IPD and OST files, you may be missing some pretty important stuff.  And, if your vendor doesn’t know how to process them, you’re certainly missing something.

An IPD file is the synchronization container file created when a user backs up a BlackBerry device, and it’s a real humdinger when it comes to holding data you can’t find anywhere else.  Stuff like SMS messaging, tons of e-mail, phone call logs, photos, memos, contacts and task lists.  Whatever role the BlackBerry device played in the user’s life, the IPD has an elephant’s memory for the details.  Better yet (leastwise “better” for people who value finding relevant information) each IPD from each synchronization event hangs around beyond the next synch, so it’s not uncommon to have years of IPDs showing up on a machine, each a time tunnel to information long gone from the phone.

Does collecting and processing an IPD file fall in the realm of computer forensics or e-discovery?  More to the point, are the contents of an IPD reasonably accessible or not?  My take is that IPD files on in-service desktops and laptops are readily accessible and don’t fall off the discovery table just because a user characterizes them as a backup.  IPD file contents are frequently relevant, unique and material.  Moreover, they aren’t difficult to access, and their contents can be exported to routine productivity formats using low cost tools.  Frankly, I marvel that these files have been overlooked for so long!

The second oft-missed file type is one that really gets my goat because it’s so, so important.  If you’ve been around e-discovery for more than ten minutes, chances are you know that, by default, the Microsoft Outlook mail client stores Outlook messaging, calendars, contacts, etc. in a file or files with the extension .PST.  But it’s surprising how often I come across e-discovery acolytes who don’t know that, when Microsoft Outlook connects to a Microsoft Exchange Server (as occurs in most companies bigger than a breadbox), the Outlook messaging and other content tends to be stored in a file with the extension .OST, not PST.

If you are preserving or collecting a custodian’s local message stores and you’re not also looking for OST container files, you could very well be missing the e-mail altogether.  Now, I expect some readers are saying, “NO ONE in charge of collecting e-mail could be so remiss.”  (Okay, maybe “remiss” wasn’t your first choice).  But, to this day, some five years after the “new” EDD rules, I still get blank looks when I mention OSTs to e-discovery counsel or chat with vendors who say, “Our tool doesn’t handle OSTs, but it’s on the development road map.”  Put away the map, fellas; you shouldn’t be driving.

So, next time you’re thinking about files that warrant preservation, collection and processing for e-discovery, be careful not to overlook OSTs and IPDs when their contents may be relevant.  And be sure they aren’t ignored by your e-discovery service provider or processed by tools that can’t dig out their tasty contents.

While we’re on the subject, iPhones generate synch files, too (through iTunes).  These can fairly brim with data not found elsewhere.

Advertisements