Google Vault In Litigation

GOOGLEVAULT · AGUIDEFORUKLAWYERS Google Vault in Litigation Capabilities, Limits and the Boundary with Independent Forensic Collection COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM INDEPENDENT VERIFICATION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the excellent tool and the quiet narrowing 03 What Vault does well: holds, retention, search, export 04 Where Vault stops: reach, fidelity and the operator 05 The three questions: trust, structures, downstream 06 Hybrid patterns: Vault plus independence 07 Vault in correspondence: what to ask and what to offer 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : VAULTISTHEESTATE ' SPRESERVATIONBACKBONEANDA BOUNDEDCOLLECTOR : KNOWWHICHJOBYOUAREGIVINGIT § 0 2 · FIRSTPRINCIPLES The problem in plain English: the excellent tool and the quiet narrowing § 0 3 · THESTRENGTHS What Vault does well: holds, retention, search, export § 0 4 · THEBOUNDARIES Where Vault stops: reach, fidelity and the operator § 0 5 · THEFRAMEWORK The three questions: trust, structures, downstream § 0 6 · WORKINGTOGETHER Hybrid patterns: Vault plus independence § 0 7 · THECORRESPONDENCE Vault in correspondence: what to ask and what to offer § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE (HOLDS + STRUCTURAL MIRRORS / VAULT API / DEVICE EXPORT) ROUTE CACHES ADMIN COUNTERPARTS DELETED / REPORTS + BACKUPS RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESNAPSHOTEXPORTANDTHEVANISHEDAUTHORSHIP EXAMPLE2 · THEFINANCEDIRECTOR ' SOWNEXPORT EXAMPLE3 · THEOPERATIONSLOGTHATDATEDTHESTRATEGY § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · ROUTE - AND -VERIFIC AT IONCLAUSEFORTHEDISCLOSURE PROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The Vault checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is a Vault export defensible disclosure on its own? When do we genuinely need collection beyond Vault? Can Vault exports be manipulated by the operator? The opponent says the content expired under retention before any hold. What is the sequence? How does Vault compare with Purview for a firm running both ecosystems? What single Vault artefact should we secure first in any new matter? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY