Identifying The Right Custodians In Electronic Disclosure

CUSTODIANIDENTIFICATION · AGUIDEFORUKLAWYERS Identifying the Right Custodians in Electronic Disclosure People, Shared Sources and Organisational Data COMPUTERFORENSICSLAB DISCOVERY . U K § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 What is a custodian? The concept in plain English 03 Custodial and non-custodial sources: the distinction that organises everything 04 Selecting custodians: from issues to people 05 The tiering decision tree 06 Shared mailboxes 07 Departmental repositories 08 Service accounts and automated data 09 Former employees 10 Organisational data: CRM, ERP and the systems with no custodian 11 Edge cases: delegates, contractors, directors and group identities 12 The custodian interview: question set and method 13 Common mistakes and technical limitations 14 Questions for the opponent and the provider 15 Suggested wording for instructions 16 Checklist and red flags · When to involve a digital forensic expert 17 Frequently asked questions 18 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEANSWER : WHATISACUSTODIAN ? § 0 2 · FIRSTPRINCIPLES What is a custodian? The concept in plain English FORTHEPRACTITIONER ONE CUSTODIAN: "A. PATEL, COMMERCIAL DIRECTOR" T YPICALLY BUNDLES § 0 3 · THEDISTINCTION Custodial and non-custodial sources: the distinction that organises everything CUSTODIAL SOURCES NON-CUSTODIAL SOURCES § 0 4 · METHOD Selecting custodians: from issues to people DECISIONS TEST § 0 5 · THEDECISION The tiering decision tree QUESTION1 YESNO QUESTION2 QUESTION3 QUESTION4 EXCLUDE , WITHREASONSBUTRE - RUNONCHANGE § 0 6 · DIFFICULTCATEGORIES Shared mailboxes IDENTIFICATIONQUESTIONSTHATFINDTHEM § 0 7 · DIFFICULTCATEGORIES Departmental repositories § 0 8 · DIFFICULTCATEGORIES Service accounts and automated data § 0 9 · DIFFICULTCATEGORIES Former employees 2 · Inventory what survives. Per leaver: mailbox (live, archived, or exported before deletion), OneDrive and • 3 · Assess control and cooperation. Company-held data is squarely in the client's control. Data on the • § 1 0 · DIFFICULTCATEGORIES Organisational data: CRM, ERP and the systems with no custodian § 1 1 · EDGECASES Delegates, contractors, directors and group identities CATEGORY THE ISSUE THE HANDLING § 1 2 · THEINSTRUMENT The custodian interview: question set and method ROLEANDIN VO LV EMENT 3 · Who held your role before and after you? Who covered your absences? • IDENTITIESANDCHANNELS 5 · Every messaging channel used for anything work-related: WhatsApp, SMS or iMessage, Signal, Telegram, • STOR AG EANDSYSTEMS 10 · Any personal cloud storage, personal devices or home equipment used for work in the period? • 11 · Any spreadsheets, trackers or informal databases you maintained that others relied on? • DEVICESANDEVENTS 13 · Since [the dispute arose], have you deleted, exported, moved or tidied anything potentially relevant, or • CLOSINGTHERECORD 15 · Read-back and confirmation: the custodian reviews the noted answers, corrects, and signs or confirms by • § 1 3 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 4 · INTERROGATORIES Questions for the opponent and the provider Ask your opponent (DRD / EDQ / correspondence) Ask an eDiscovery / forensic provider § 1 5 · DRAFTINGAIDS Suggested wording for instructions SYSTEMOWNERNOMIN AT ION ( INTERNALINSTRUCTION ) § 1 6 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The custodian checklist Red flags When to involve a digital forensic expert § 1 7 · COMMONQUESTIONS Frequently asked questions What is a custodian? How many custodians is normal? Is a shared mailbox a custodian? Do former employees count as custodians? Is the CEO automatically a custodian? Can we add or remove custodians after the DRD? § 1 8 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY