This is an excellent article by Bobby Malhotra from Law.com on developing an E-Discovery plan for Mac Computer evidence.
Law Technology News - August 9, 2011
Don't Confuse Oranges With Apples: E-Discovery on Macintosh Systems
As if dealing with electronic data discovery in a predominately Microsoft Windows world is not difficult enough, Apple's Macintosh computer systems are increasingly finding their way into corporate environments and present unique discovery challenges. Lawyers who assume they can simply use a standard Windows discovery approach when dealing with Macs may be committing an error in logical reasoning — similar to comparing apples to oranges.
During the identification stage lawyers typically reach out to relevant custodians and the client's IT contacts to gain an understanding of key issues, and the systems and electronically stored information that may come into play.
At this stage, the litigation team is defining what data may be potentially responsive, where and how it is stored, and how it can be efficiently and effectively harvested — often with an eye toward review and production. Standard Windows practices at this stage may prove inadequate to handle the differences between the Microsoft and Apple operating systems.
To successfully handle Macs, lawyers need an understanding about the locations that are likely to contain potentially discoverable user data and the unique Mac features that may affect their discovery plan. Here are a few tips, but caveat: many apply only to recent Mac operating systems.
The home folder may be the most important storage location for Mac users. It is usually the place where users store most files and where the OS or applications will likely house the user's system preferences, internet caches, browser cookies, pictures, and multimedia files.
By default the home folder has several folders within it that are created by the operating system, including desktop, documents, library, movies, music, and pictures. (The library folder houses user-specific information such as system preferences.)Home folders in the Mac world are similar (in terms of importance and underlying directory structure) to the "My Documents," "My Pictures," and "My Music" folders on Windows. Home folders are likely to contain user-created documents because many users target them as default storage repository. Likewise, many programs, e.g., iTunes and iMovie, use it as the default repository for saving or opening a file. The home folder is fertile ground for locating potentially responsive documents, and a good topic to discuss with custodians.
Smart Foldersare dynamic folders that contain a list of files that meet a specific search criteria. These folders do not store files, they simply contain pointers to other files that meet selected criterion. Smart Folders help users organize and find similar documents that may be scattered across various locations on the hard disk.
For example, a custodian in a mortgage-backed security litigation, whose job is to revise loan underwriting guidelines, might use a smart folder that displays all Microsoft Word documents created in the last two months that have the term "HELOC" (home equity line of credit) in the title. The custodian could use that Smart Folder each time he or she wants to display files that meet the selected search criteria — instead of rebuilding the search from scratch each time.
An alias is a pointer file that links to other files, folders, or storage devices. It helps users open frequently accessed files regardless of where the files are stored. An alias is similar to a shortcut in the Windows world, but is more sophisticated because the links typically do not break when you rename or move the underlying referenced files.
Both Smart Folders and aliases are organizational tools that help users access files from various locations, without creating multiple copies of the underlying files. Each actual file exists in only one physical location — even though it may be referenced in many Smart Folders or by several different aliases.
Lawyers should focus on identifying physical file locations and not be sidetracked by the logical pointers used by Smart Folders and aliases.
Macs include an integrated backup utility called Time Machine that stores backup data to an external hard drive. Time Machine automatically backs up the entire Mac machine so if users activiate this backup utility there is a strong possibility that there are backup copies — from different points in time — of every file on their Mac system.
As a result, Time Machine backups should be a topic of discussion when talking to Mac custodians. Lawyers may need to adjust their e-discovery plan as necessary to ensure that potentially relevant backup information is being preserved.
Macs come with the FileVault utility that helps users encrypt information located in their home folder. When a user turns on FileVault, a master password is set and the data in their home folder is locked and secured. FileVault uses Advanced Encryption Standard (AES) with a 128-bit encryption technique. The secured data cannot be accessed without the user login or master password — even if it is responsive to a discovery request.