Preservation and collection of electronically stored information (“ESI”) is commonplace in today’s litigation landscape. Emails, spreadsheets, presentations, memos and even videos or pictures can all be potentially responsive data sources. The challenge with this information is that it is often stored in myriad systems, and each system has its own preservation and collection nuances.
To minimize issues and costs associated with downstream review of documents from these data sources, it’s important to develop a solid preservation and collection plan.
Scoping Potentially Relevant Data Sources
Most projects start with scoping. Previously, scoping was a relatively simple discussion regarding the use of one desktop or laptop computer. Now, with the explosion in the number and type of personal devices and online services, the digital footprint of custodians is much more complex. Litigation teams face an ever-increasing variety of data sources, each of which can present its own challenges for collecting and preserving potentially responsive content.
One school of thought for preservation and collection is to create a forensic image of a device that contains potentially responsive information. A forensic image is a bit-by-bit capture of the device’s entire data storage drive. While this can be an appropriate methodology for preservation and collection, one should consider the types of data being preserved. When a forensic image is created, a copy of everything, including active and deleted files, is retained. When should a forensic image be completed? If malfeasance or misfeasance is an issue with a particular case or custodian, a forensic image of a device could be considered necessary. While the cost to forensically image a device is similar to that of a forensic collection of only active files, there are downstream effects depending on the decision. For example, a forensic image creates a potentially unnecessary increase in data volume, and search and review costs are driven by volume. Also, deleted documents may or may not be viewable in a review tool, and there is potential for corruption when a deleted document is recovered. A possible balance could be to tier the custodians into categories – Tier 1 custodians (the most critical) have their devices forensically imaged while Tier 2 custodians have only their active data collected in a forensically sound manner.
Mobile devices are particularly challenging. On top of the various models and uses, there are privacy concerns. How can one respect privacy while preserving business records in a mixed-use device? This is compounded by Bring Your Own Device (“BYOD”), which often results in private ownership but heavy business use, and a greater variety of devices within a single group of custodians. Long ago, collections involving mobile devices would be limited to one or, at most, two mobile device types – often that old standby of mobile technology, the BlackBerry. Today, a legal team scoping a collection will have to be prepared to preserve content from a wide variety of devices, each with its own challenges. Be sure to consider that a mobile device is essentially a portal to other data sources and not necessarily the system of record for all data sources. For example, the system of record for email is not typically a mobile device – it’s the email server. A possible balance could be to collect only specific data sources that contain business records from mobile devices, such as text messages and instant messages.
Similarly, cloud computing has had its own impact. With the increase in popularity of outsourcing and software-as-a-service (“SaaS”), a growing percentage of a company’s data may be stored with third parties. Preserving and collecting from, or with the cooperation of, third parties presents another wrinkle. The right approach to cloud storage device collections should be to develop a solid scope of the types of data to be collected and understand the fastest data transfer processes to and from the cloud application. A wrong approach could shift the collection time for a particular custodian from hours to days.
Mobile devices and cloud computing are but two of the many challenges faced by litigation teams tasked with collecting and preserving potentially responsive content. A natural tension has evolved between the costs associated with maintaining the capability to collect these diverse data sets and increasing pricing pressure applied by law firms and corporations seeking value in an evermore competitive marketplace. Our team at iDS strives to resolve this tension by creating pragmatic collection strategies for each data source.
Pragmatic Collection Strategy
Pragmatic collection strategies are driven by the case team’s needs, taking into consideration the contours of the case, budget, timeframe required, and privacy and security requirements of the client. A pragmatic collection strategy should be efficient, accomplishing its goals in the smallest amount of time with the least interruption to business possible. The process also needs to be repeatable and verifiable (repeatable denotes completing a task in a way that does not alter content; verifiable signifies that the means of preserving data is known and documented). At iDS, our team of experts can engage with counsel to understand the scope of potentially relevant data and devise a project plan that balances all of the business’s needs with those of the litigation team – a critical component when creating the scope for a collection.
Increasingly, developing the right strategy for a given case involves the preliminary step of organizing and executing effective custodial interviews at the outset. In the not-too-distant past, interviewing custodians was done less frequently, most often in conjunction with internal investigations or criminal matters. Today, interviews are seen as an important step even in the smallest cases. A well-focused list of questions for each potential custodian can be forwarded via email and reviewed by the attorneys well in advance of the data collection. Follow-up phone calls can add detail or cover any open questions. The record of custodial witness interviews is essential to identifying the scope of a data collection. It also can be very valuable later in a case to offer an explanation as to why a particular course was taken on a specific data source in the months or years proceeding.
Another significant aspect of a pragmatic collection strategy is memorializing the key decisions the case team makes over time. For our iDS team, this memo would detail the choices made as the case progresses, providing a vital explanation of the numerous decisions on data sources over the life of the case.
Flexibility is another essential element of a pragmatic collection strategy. It is invaluable in today’s technological environment, because the facts identified during the collection process may not match what a custodian describes in an interview. For example, the number and location of devices, the connectivity options to said devices, and details, such as their operating systems, may be unknown to the custodian – which results in the need to design a collection protocol on the fly. The project scope should accommodate for this, and the collection team should be prepared for reasonable activity outside of the agreed upon scope, both in terms of the number and nature of items to be collected.
Pragmatic Collection Examples
A pragmatic collection strategy may be implemented in a variety of ways. One method is to use a client’s existing technology. Many companies now employ email archiving or early case assessment tools. Popular email platforms, like Microsoft Exchange, now incorporate litigation hold features. Companies may also implement technologies with built-in commands for collection. In a recent case involving multiple remote custodians, our iDS team leveraged the built-in commands for mobile devices to create backups of those devices, then performed remote collection of the backups. This approach saved the client travel costs associated with collection activities and business costs resulting from interruption of worker productivity. Using your client’s current technology and leveraging the existing infrastructure and staff can prove to be both efficient and effective.
A second pragmatic collection strategy is known as “preserve in place.” Preserve in place refers to, as its name implies, leaving responsive content where it is. This can be an effective strategy for larger data sets derived from structured data sources. For example, many organizations use enterprise applications that rely on large databases to perform functions. These types of enterprise applications may include functionality to preserve database records within the system. Keeping the data there reduces the cost and time associated with creating forensic copies of the database records.
The above examples of pragmatic data preservation strategies are frequently requested by sophisticated clients, and iDS has the knowledge and expertise to develop and implement solutions tailored to each situation. Litigation teams that plan reasonable, repeatable, well-documented and flexible projects will be able to reduce risk for their clients and provide the value today’s market demands.
Published May 1, 2015.
