Document Management Systems In Disclosure

DMSEVIDENCE · AGUIDEFORUKLAWYERS Document Management Systems in Disclosure iManage, NetDocuments and the Version History That Decides Professional Disputes COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ACCESS-HISTORY ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the drafting record as witness 03 DMS anatomy: workspaces, profiles, versions and filed email 04 Histories: versions, access logs and activity trails 05 Collection: extracting matters without flattening them 06 Privilege and third-party complications 07 Departing fee earners and DMS exfiltration 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : THEDMSKEEPSEVERYVERSIONANDLOGSEVERYTOUCH : COLLECTITSOBOTHSURVIVE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the drafting record as witness § 0 3 · THESYSTEM DMS anatomy: workspaces, profiles, versions and filed email § 0 4 · THEHISTORIES Histories: versions, access logs and activity trails § 0 5 · GETTINGITOUT Collection: extracting matters without flattening them § 0 6 · WHOSEPRIVILEGE Privilege and third-party complications § 0 7 · THELEAVINGPARTNER Departing fee earners and DMS exfiltration § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE SYNC CO-ADVISER DMS EMAIL BACKUPS / DELETED / (NATIVE) ESTATE ARCHIVES RECOVERABLE DEVICE / CLIENT & CACHES COPIES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECLAUSETHATVANISHEDBETWEENVERSIONS EXAMPLE2 · THEPARTNERWHOREADNINETYFILESINAWEEK EXAMPLE3 · THEFLATTENEDPRODUCTION , UNFLATTENED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · DMSLIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The DMS checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is a former client entitled to the firm's DMS versions, or only the final file? Can the DMS prove who actually made a disputed edit? The firm migrated DMS three years ago and history "starts" there. Suspicious? What can be proved about a fee earner who "just looked" at files before leaving? Our opponent's DMS is cloud-hosted. Does that change anything? Are saved document comparisons really that important? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY