The preservation and collection phases of the Electronic Discovery Reference Model are potentially the most critical parts of a case involving digital evidence. If electronically stored information (ESI) is not collected using proper and defensible methods, it can lead to changes in metadata, rendering it spoiled.
Simple mistakes made to minor yet relevant details have significant consequences. For example, accidentally changing the creation date to the date of collection or the author’s name to the person performing the collection are common mistakes that ruin the integrity of the digital investigation. Following collection, ESI must also be transferred in a way that preserves the metadata.
Whether the data is large or small, all steps taken during the preservation and collection stages should use defensible, industry-recognized methods that can be cited if challenged in court or by opposing council.
The following best practices for preserving and collecting ESI should be used to ensure defensible evidence that will hold up in court.
Create an encrypted file during preservation
At the beginning of the preservation phase, immediately create an encrypted archive file (such as a ZIP file) upon collection of ESI. This can also be done using tools like Robocopy to securely transfer ESI to an encrypted external drive.
An outsourced forensics team can preserve metadata through a streamlined process that immediately moves the data into processing after collection.
Gather necessary info at processing outset
Asking the right questions before the processing phase helps frame the case. As a lawyer, paralegal, or litigation support professional, it is important to get information, including document scope and ESI production specifications, as early as possible.
Furthermore, obtaining keyword or privilege search terms before processing can be especially helpful in reducing overall processing time. Some search terms, including terms with special characters or certain words that search engines do not normally index, may require special handling, which affects processing settings.
Getting this information early will reduce “sitting” time, when data is on hold inside the processing tool awaiting more information to proceed. Circulating this information among the client, eDiscovery partner, case team, and any other important parties will help keep everyone aligned and make it easier to formulate a plan of action.
Use file culling for large data sets
During processing, file culling methods such as deduplication and ‘DeNISTing,’ reducing the number of documents subject to review, greatly minimizes the volume of ESI in a case and are almost always recommended for large data sets.
LOGICFORCE regularly uses both methods during processing. We have seen significant reductions in ESI volume from these methods alone, which creates a considerable amount of cost savings on hosting charges.
Tweak search terms for better results
The first iteration of keyword or privilege terms may not always return expected results. If the number of documents returned is higher or lower than expected, slightly tweaking the terms or date filter can sometimes make a huge difference.
In some cases, it may make sense to be over-inclusive with keyword terms or under-inclusive with privilege terms before loading the documents to the review workspace to ensure no relevant documents are missed. Once in the review workspace, it may be easier to distinguish which documents are being returned off keyword or privilege terms and adjust from there so no relevant or privileged documents are missed.
Hire the right partner
Having the knowledge and information is only half the equation. Choosing the right eDiscovery partner for your processing needs will help ensure data is preserved, collected and transferred in defensible manners. Hiring a forensic professional to preserve, collect, and transfer ESI can be an important investment to ensure a smooth process from start to finish.
Our eDiscovery and forensic professionals have the experience and skillset to assist with your case. LOGICFORCE specializes in carefully examining digital assets for case-relevant data. Our team of investigators understand both technology and the legal process and will find and preserve data in a defensible manner. For more information on properly discovering and preserving data pertinent to your case, or to learn about LOGICFORCE’s comprehensive eDiscovery offering, contact us.
Onish Jain is a Senior eDiscovery Analyst at LOGICFORCE. He is a certified Nuix Workstation Data Discovery Master and a Relativity Certified Administrator with over 7 years of experience specializing in ESI preservation, processing, review, analysis, and production.