Blog

Mac E-Discovery in a Windows World: Apples to Apples?

Over the last year I have worked on several matters involving data collected from Macs with a trusted partner, BlackBag Technologies. BlackBag is an industry leader in providing Mac-based forensic and e-discovery data solutions.  I co-authored this post with Paul Jordan, BlackBag’s VP of Corporate Development, who helped me significantly advance my understanding of why Mac e-discovery should be handled differently than Windows e-discovery.

Macs in Corporations

Historically, the use of Macs in the corporate enterprise was occasional, and limited to small groups. Most of us think of the creative types in marketing and graphic design as the most common examples of Mac users.

But use of Macs is no longer so rare. CTOs are relaxing their policies to allow the use of Macs (which use the Mac OS X operating system), as well as iPhones and iPads (which use the iOS operating system). More and more employees – sales teams and engineering groups in particular – have embraced this flexibility and increasingly choose Macs as the working platform of choice. C-level employees have become especially high users of Mac and iOS devices. This growing corporate use of Apple devices has major ramifications in the e-discovery context, where data from these devices must be preserved, collected, processed, reviewed, and produced.

Mac Data and E-Discovery on Macs

For years, Apple’s marketing campaigns revolved around the simple slogan “Think Different.”  When it comes to dealing with e-discovery from custodians using Macs, it is wise to take that slogan to heart.  Mac data is inherently different from Windows data. Mac data uses a different file system (Mac uses HFS and HFS+ while Windows uses FAT / NTFS) and different file types and structures.

Mac vs. Windows Data Difference

One significant example of a Mac v. Windows data difference is the “bundled” file format, a file type unique to Macs that is used by certain (although not all) versions of Apple applications such as Keynote. When loaded into a Windows environment, the system awkwardly interprets a bundled file as a series of files and folders; in a Mac environment, the system properly interprets the file as a single document. Complicating matters further is the flexibility Mac hardware offers; users can run Mac OS X or Windows – or both concurrently – on their Mac hardware. Even the files generated in Windows-based programs, such as Microsoft Office applications, are stored differently when found in a Mac operating system.

Because of these differences, Mac data must be handled differently from Windows data when putting the data through collection, processing and review. It is not possible to collect, process and review Mac data using a Windows system and still maintain a true “native” review, which is considered to be best practice.  Rather, because a Windows system is forced to interpret the Mac data, the review will be non-native – and, quite often, the processed data set will be riddled with errors and omissions.

The reality, however, is that logistics and cost considerations make it difficult in most instances for e-discovery of Mac data to be conducted entirely in a Mac environment.  But even in the absence of a native Mac collection and processing system, there are some ways to mitigate the risks of working with Mac data:

  1. Collect natively. Avoid copying data onto NTFS or FAT formatted drives and avoid using proprietary image formats (L01). Using these methods may alter metadata such as dates, file names, type and creator codes, data and resource forks, and file paths.  Instead, collect data using raw formats such as .dd or .dmg, and copy the data onto HFS+ formatted drives.
  2. Perform early case assessment on a Mac. This may not be possible if you did not retain the original files in a raw format on HFS+ formatted drives. But if you did, you should review the data natively in a Mac environment for your early case assessment.  Be careful, however, to take the appropriate precautions to protect the integrity of the files (locking, mounting read-only, etc.).
  3. Render the Mac data in a format that retains the most accurate representation of the native data. The ideal format will maintain the critical metadata for each file, but will integrate well into Windows-based review solutions. PDF is an optimal format for Mac data in the absence of a native Mac review platform.
  4. Avoid using “standard” file-type processing lists, which typically are Windows-centric.   Files from applications such as the iWork suite (the Microsoft Office equivalent on the Mac), Omni products such as Graffle and Outliner, and other Mac-only applications may all contain important data.  If you use a “standard” file type list that does not include these files, you may inadvertently omit key data from processing.

Macs and the data found on them are different from Windows-based PCs, and they should be treated as such. As their presence grows in the enterprise, it is important for legal professionals handling e-discovery – both in the corporate in-house legal department and in law firms – to understand these differences and accurately assess how best to collect and process Mac data.  And Macs are only the beginning.  In the coming years, iPhones and iPads – with their equally unique iOS operating system – will contain a flood of potentially responsive data that should be treated with similarly nuanced understanding and care.

Maureen O'Neill