Page 1
KEYWORDSEARCHDESIGN · A GUIDE FOR UK LAWYERS How to Design Defensible Keyword Searches Terms, Syntax and the Method That Survives the Other Side's Scrutiny COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES SEARCH PROTOCOL DESIGN
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the list drafted from memory 03 Where terms come from: case theory and custodian vocabulary 04 Syntax that works: operators, wildcards and proximity 05 What keywords miss: the known failure modes 06 The negotiation: DRD tables, hit counts and refinement 07 Documentation: making the list defensible 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: TERMSCOMEFROMTHEDATA ' SOWNVOCABULARY, SYNTAXIS ENGINEEREDPERPLATFORM, ANDEVERYCHOICEISTESTEDANDDOCUMENTEDBEFORE IT IS AGREED
§ 02 · FIRST PRINCIPLES The problem in plain English: the list drafted from memory
§ 03 · THERAWMATERIAL Where terms come from: case theory and custodian vocabulary
Page 2
§ 04 · THEENGINEERING Syntax that works: operators, wildcards and proximity
§ 05 · THEBLINDSPOTS What keywords miss: the known failure modes
§ 06 · THETABLESTAKES The negotiation: DRD tables, hit counts and refinement
§ 07 · THEPAPERTRAIL Documentation: making the list defensible
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives WHEN WIDER OCR & KEYWORDS TERMS / TEXT RETURN VARIANTS REPAIR PARTICIPANT STRUCTURED- ANALY TICS ADJACENT & DATE PULLS DATA QUERIES & TAR CHANNELS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECODENAMETHEPLEADINGSNEVERKNEW EXAMPLE2 · THEWILDCARDTHATATETHEBUDGET EXAMPLE3 · THENULLRETURNTHATWASANOCRPOSTURE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · SEARCH METHODOLOGY PA R AG RAPHFORTHEDRD / PROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The search-design checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions How many search terms should a list have? The other side proposes terms hitting hundreds of thousands of documents. Must we accept? Our searches returned nothing on a central issue. Can we certify that? Do keyword searches work on Whats App and Teams data? Are keyword searches still acceptable now TAR exists? Who should draft the list: lawyers or the provider?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, How To Design Defensible Keyword Searches, Computer Forensics Lab, https://e-discovery.uk/library/how-to-design-defensible-keyword-searches/pdf.