In July 2014, CYFOR were instructed by the company of a Ukrainian industrialist and political figure involved in a multi-million-pound litigation being fought in the English courts.

Background to the eDisclosure Case Study

CYFOR were asked to conduct a large-scale and complex eDisclosure investigation involving 2.5 terabytes of data held on a variety of data sources, and multiple companies in the litigation.

The commercial dispute centred around agreements made – or not made – between the parties. The alleged breach of contract and breach of trust necessitated CYFOR identifying Electronically Stored Information (ESI) relevant to the case and running keyword analysis on 450 concurrent keywords across a multitude of electronic documents relevant to the case.

CYFOR’s eDisclosure investigation team were dispatched to the client’s headquarters in the Ukrainian capital, Kiev – at the client’s request, the entire digital forensic investigation was to be conducted at its location – wherein the team set up a laboratory which conformed to the high standards needed of a forensically sound process. Then, over 4 phases totalling 33 days, the investigation of the documentary evidence was initiated.

John Young, lead investigator on the case commented:

“It is not unusual – as is the case here – that a client requires that the evidence remain on its premises. We could not bring the evidence back to our laboratories in the UK, so we were first challenged to create the environment we needed whilst on site. At the time my investigation team were ensconced on the project while Kiev was being convulsed by political turmoil.  We were able to fly our kit over – responding to this kind of requests would drain the resources of many other eDisclosure providers – within a politically charged environment, something my experienced investigators are well used to handling.”

CYFOR used the Nuix technology platform to process and search the data stored in emails, documents, SMS text messages, weblogs and other electronic artefacts. This phase took a total of 6 days to complete.

Keyword Search

In total, 1.7 million items were found to respond to the keyword search. By applying advanced searching and automated technologies, we eliminated irrelevant documents, enabling us to focus on a more manageable fraction of the ESI that was germane to the matter. The end export totalled 40 thousand relevant items.

John Young, added:

“To add a layer of sophistication to the project, the documents we were tasked to analyse were in English, Ukrainian, Polish and Russian – a common issue facing international organisations.  As anyone who knows Russian will tell you, translating into English is no easy task; there are 12 different word endings alone that are not present in the English language, Ukrainian has 16!”

Cost-Effective eDisclosure

John Young concluded:

“Invariably the most expensive part of the litigation process is eDisclosure, but it is also often hugely disruptive.  Not only must digital forensics investigators have the resources to react to challenging client requests like maintaining confidentiality and privilege in cross-border and multi-jurisdictional matters, they provide a cost-effective solution when managing vast amounts of electronic documents.”

Summary of Benefits

• eDisclosure experts dispatched from the UK to Ukraine
• Forensically sound laboratory set up on the client’s site
• Analysis of multilingual documents was undertaken
• Collection of large volume, complex data across many systems
• The use of Nuix enabled the eDisclosure team to work quickly under tight deadlines.
• Reduced the amount of data for review by over 97%