Chapter 6: Data Collection

Types of ESI for Data Collection

ESI encompasses a broad spectrum of digital data, each type presenting unique challenges and opportunities in the context of eDiscovery:

• Emails and Attachments: Often the most voluminous, emails can be repositories of crucial information, including embedded files.
• Documents and Files: Ranging from Word documents to PDFs, these files can contain vital evidence.
• Databases: These complex data structures require specialized handling to extract relevant information.
• Social Media Content: Increasingly relevant, social media data can be both informative and challenging to collect due to its dynamic nature.
• Cloud Storage Data: Data stored in cloud services like Google Drive or Dropbox adds another layer of complexity to ESI collection.
• Mobile Device Data: Text messages, call logs, and app data from smartphones and tablets are increasingly pertinent in legal cases.

Data Collection Strategy

Developing a robust data collection strategy is essential for ensuring the integrity and defensibility of the eDiscovery process:

1. Identify Relevant Data Sources: Begin by pinpointing where potentially relevant data resides. This step involves understanding the client’s data environment and identifying custodians of crucial information.
2. Determine Collection Scope: Based on the case requirements, define the scope of data collection. This includes deciding on date ranges, keywords, and other parameters that help narrow down the data universe.
3. Choose Appropriate Collection Tools and Methods: Select tools and methodologies that align with the types of ESI identified. This choice depends on factors like data volume, format, and the complexity of the data environment.
4. Document the Collection Process: Maintain detailed records of the collection process. This documentation should include information about data sources, collection methods, and any challenges encountered during the process.
5. Ensure Compliance with Legal Requirements: Adhere to legal and regulatory guidelines throughout the collection process. This compliance is crucial for maintaining the legality and defensibility of the collected data.
6. Plan for Data Storage and Transfer: Securely store and transfer collected data. This step involves ensuring data integrity and protecting sensitive information from unauthorized access.
7. Prepare for Data Processing and Review: Finally, organize the collected data in a manner that facilitates efficient processing and review. This organization might involve preliminary data culling or categorization.

Data Collection Checklists

A well-structured data collection checklist ensures a thorough and defensible eDiscovery process. Here are key components to include in your checklist:

1. Define Criteria for Collection Method: Decide whether to use logical copy, forensic image, etc., based on the case’s specifics.
2. Assign Roles and Responsibilities: Clearly delineate tasks for legal and IT personnel involved in the collection process.
3. Standardize Request Processes: Develop a standardized procedure for legal teams to request data collection from IT.
4. Assess Internal Collection Capabilities: Evaluate your organization’s capacity to perform collections, considering factors like data types and volumes.
5. Document Third-Party Engagement Procedures: If using external resources for collection, establish and document the procedures for their engagement.
6. Establish a Preferred Vendor List: Create a list of preferred vendors for situations requiring external expertise.
7. Utilize Targeted Collection Capabilities: Employ targeted collection strategies such as specific date ranges and keywords.
8. Document Chain of Custody: Maintain a clear and detailed chain of custody throughout the collection process.
9. Develop a Tracking Process: Implement a system to track collections progress between IT and legal teams.
10. Create Standard Processing Specifications: Ensure consistency in collection and processing by developing standard specifications.
11. Develop Completeness Verification Reports: Prepare reports to verify the completeness and integrity of the collection and processing activities.

Collection Methodologies

The volume of data involved in an eDiscovery process can significantly influence the choice of collection methodology. When dealing with large volumes of data, it’s essential to select a method that can handle the scale efficiently without compromising the integrity of the data.

High-volume data collections often require more robust and automated tools to ensure a swift and accurate process. Conversely, smaller data sets might allow for more manual, targeted collection methods, which can be more cost-effective and less complex.

1. Tailoring to Data Types and Sources

Different types of data and their sources necessitate specific collection tools or techniques. For instance, collecting emails might require different tools compared to extracting information from social media platforms or cloud storage. Understanding the nature of the data – whether structured or unstructured, stored on-premises or cloud, or in a proprietary format – is crucial in selecting the appropriate collection methodology. This tailored approach not only ensures efficiency but also helps in maintaining the fidelity of the data collected.

2. Adhering to Legal and Compliance Requirements

Compliance with legal and regulatory standards is non-negotiable in eDiscovery. The chosen collection methodology must align with these requirements to ensure the admissibility and defensibility of the evidence. This includes considerations like maintaining the chain of custody, ensuring data privacy, and adhering to specific jurisdictional rules regarding data handling. Failure to comply with these standards can lead to legal challenges and potentially compromise the case.

3. Balancing Cost and Resource Constraints

Cost and available resources are critical factors in deciding on a collection methodology. The goal is to achieve a balance between the needs of the eDiscovery process and the constraints of budget and resources. This might involve deciding whether to use in-house tools and capabilities or outsource to specialized vendors.

It’s important to evaluate the cost implications of different methodologies, not just in terms of immediate expenses but also considering the potential long-term costs associated with data storage, processing, and review.

4. Addressing Potential Data Tampering

The collection methodology needs to be particularly rigorous in situations where there is a suspicion of data tampering. Forensic imaging is often the method of choice in these scenarios, as it creates a complete and unaltered copy of the data. This method ensures that even if the original data is tampered with or destroyed, a comprehensive and exact replica is available for examination. Forensic collection is essential in maintaining the integrity of the evidence in cases where data authenticity is in question.

How to Validate or Quality Check the Collected ESI

Validating and quality-checking the collected ESI is a critical step in ensuring the integrity of the eDiscovery process. Here are key practices:

1. Cross-Verification: Cross-check the collected data against the original sources to ensure accuracy and completeness.
2. Metadata Analysis: Examine the metadata of collected ESI for consistency and integrity.
3. Sampling: Conduct random sampling of the collected data to check for errors or omissions.
4. Use of E-Discovery Tools: Leverage specialized eDiscovery tools for automated validation and quality checks.
5. Document Review: Perform an initial review of a subset of documents to assess the overall quality of the collection.
6. Audit Trails: Maintain detailed audit trails of the collection process to track and verify each step.

Metadata in Data Collection

Understanding the role of metadata in eDiscovery is crucial. Metadata, often referred to as ‘data about data’ or the ‘envelope’, includes details like the creation date, modification date, and file location.

This embedded context is vital in eDiscovery for several reasons:

• Filtering and Searching: Metadata helps in filtering and searching for relevant ESI during review.
• Preserving Context: It provides context to the ESI, crucial for understanding the data’s relevance and authenticity.
• Legal Compliance: Proper handling of metadata ensures compliance with legal standards.

Methods for extracting and preserving metadata include:

• Forensic Imaging: This method captures all metadata, ensuring no alteration during the collection process.
• Logical Copying: While less comprehensive than forensic imaging, logical copying can still preserve essential metadata.
• Use of Specialized Tools: Tools like the Knovos Discovery end-to-end eDiscovery software suite can help with extracting and maintaining metadata integrity.

Defensible Collection

Defensible collection in eDiscovery refers to a legally sound process that can withstand court scrutiny.

Key strategies to ensure defensibility include:

• Adherence to Legal Standards: Ensure all collection processes comply with relevant legal and regulatory requirements.
• Documentation: Maintain detailed records of the collection process, including methods implemented and decisions made.
• Chain of Custody: Keep a clear chain of custody for all collected ESI to track its movement and handling.
• Use of Reliable Tools and Methods: Employ tools and methods that are widely accepted in the legal community.
• Training and Expertise: Ensure that personnel involved in the collection are adequately trained and knowledgeable.

Conclusion

In conclusion, effective data collection in eDiscovery is a multifaceted process that demands careful planning, execution, and understanding of various components like ESI types, collection strategies, metadata, and defensibility.

Key takeaways include:

• Importance of a Structured Approach: A systematic approach to data collection ensures efficiency and legal compliance.
• Role of Metadata: Metadata plays a critical role in the context and authenticity of ESI.
• Defensible Collection: Ensuring the defensibility of the collection process is paramount to avoid legal challenges.

Effective data collection in eDiscovery is not just a technical necessity but a strategic one that can significantly impact the pathway and outcome of legal proceedings.