How To Design Defensible Keyword Searches

KEYWORDSEARCHDESIGN · AGUIDEFORUKLAWYERS How to Design Defensible Keyword Searches Terms, Syntax and the Method That Survives the Other Side's Scrutiny COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES SEARCH PROTOCOL DESIGN § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the list drafted from memory 03 Where terms come from: case theory and custodian vocabulary 04 Syntax that works: operators, wildcards and proximity 05 What keywords miss: the known failure modes 06 The negotiation: DRD tables, hit counts and refinement 07 Documentation: making the list defensible 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : TERMSCOMEFROMTHEDATA ' SOWNVOCABULARY , SYNTAXIS ENGINEEREDPERPLATFORM , ANDEVERYCHOICEISTESTEDANDDOCUMENTEDBEFORE ITISAGREED § 0 2 · FIRSTPRINCIPLES The problem in plain English: the list drafted from memory § 0 3 · THERAWMATERIAL Where terms come from: case theory and custodian vocabulary § 0 4 · THEENGINEERING Syntax that works: operators, wildcards and proximity § 0 5 · THEBLINDSPOTS What keywords miss: the known failure modes § 0 6 · THETABLESTAKES The negotiation: DRD tables, hit counts and refinement § 0 7 · THEPAPERTRAIL Documentation: making the list defensible § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives WHEN WIDER OCR & KEYWORDS TERMS / TEXT RETURN VARIANTS REPAIR PARTICIPANT STRUCTURED- ANALY TICS ADJACENT & DATE PULLS DATA QUERIES & TAR CHANNELS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECODENAMETHEPLEADINGSNEVERKNEW EXAMPLE2 · THEWILDCARDTHATATETHEBUDGET EXAMPLE3 · THENULLRETURNTHATWASANOCRPOSTURE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · SEARCHMETHODOLOGY PA R AG RAPHFORTHEDRD / PROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The search-design checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions How many search terms should a list have? The other side proposes terms hitting hundreds of thousands of documents. Must we accept? Our searches returned nothing on a central issue. Can we certify that? Do keyword searches work on WhatsApp and Teams data? Are keyword searches still acceptable now TAR exists? Who should draft the list: lawyers or the provider? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY