How To Build A Defensible EDisclosure Strategy At The Start Of A Case

EDISCLOSURESTRATEGY · AGUIDEFORUKLAWYERS How to Build a Defensible eDisclosure Strategy at the Start of a Case From Pleadings and Issues to Collection and Review Protocols COMPUTERFORENSICSLAB DISCOVERY . U K § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: strategy or improvisation 03 Why the first weeks matter legally 04 The workflow at a glance 05 Step 1 · Pleadings to issues: the issue-source matrix 06 Step 2 · Day-one preservation 07 Step 3 · Identification: the data map 08 Step 4 · Custodian selection and tiering 09 Step 5 · Control analysis and third parties 10 Step 6 · Forensic triage 11 Step 7 · Early data assessment 12 Step 8 · Search design 13 Step 9 · The procedural position: DRD, Models, budget 14 Step 10 · Collection plan and review protocol 15 The strategy document and its governance 16 Common mistakes and technical limitations 17 Questions to ask · Suggested wording for instructions 18 Checklist and red flags · When to involve a digital forensic expert 19 Frequently asked questions 20 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : WHATMAKESASTRATEGYDEFENSIBLE § 0 2 · FIRSTPRINCIPLES The problem in plain English: strategy or improvisation § 0 3 · WHYITMATTERSLEGALLY Why the first weeks matter legally § 0 4 · THEMAP The workflow at a glance TRIAGE DESIGN BUDGET REVIEW PROTOCOLS WHEN WHAT IS DONE WHAT EXISTS AT THE END § 0 5 · STEP1 Pleadings to issues: the issue-source matrix § 0 6 · STEP2 Day-one preservation § 0 7 · STEP3 Identification: the data map § 0 8 · STEP4 Custodian selection and tiering § 0 9 · STEP5 Control analysis and third parties § 1 0 · STEP6 Forensic triage § 1 1 · STEP7 Early data assessment § 1 2 · STEP8 Search design § 1 3 · STEP9 The procedural position: DRD, Models, budget CMC. § 1 4 · STEP10 Collection plan and review protocol § 1 5 · THEARTEFACT The strategy document and its governance SECTION CONTENTS (THE STEP OUTPUTS, FILED ONCE) 1 · Issues Working Issues for Disclosure; the issue-source matrix; date anchors 2 · Preservation Hold notice and register; suspensions; third-party and leaver notices; client 3 · Sources Data map (versioned); questionnaire returns; cross-check results 4 · Custodians Tiered list with rationales; identity tables; system owners; interview records 5 · Control Control schedule; requests and notices with responses; third-party route plan 6 · Forensic Triage record; acquisition logs; the escalation protocol; examination scopes 7 · Assessment The assessment report and scenario models 8 · Search Search protocol; term proposals and hit reports; validation plan 9 · Procedure DRD / EDQ drafts and annexes; budget alignment; negotiation brief 10 · Execution Collection plan; review protocol; production specification; provider instructions § 1 6 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 7 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording for instructions Ask your client, on day one Ask your opponent, through the process Ask an eDiscovery / forensic provider, at engagement SUGGESTEDWORDING · ENG AG EMENTINSTRUCTIONTOAPR OV IDER ( CORE PA R AG RAPHS ) ANDCASEPLAN ) § 1 8 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The strategy checklist Red flags When to involve a digital forensic expert § 1 9 · COMMONQUESTIONS Frequently asked questions What makes an eDisclosure strategy "defensible"? How early is early? The dispute has only just surfaced. 3 to 6 belong in the first fortnight even pre-action: preservation duties are live, pre-action protocols reward Our client already collected data themselves. Is the strategy compromised? Does a small case need all ten steps? What happens to the strategy when the case changes? Who should build the strategy: the firm, the client or the provider? § 2 0 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY