Page 1
EDISCOVERY PROCESSING · A GUIDE FOR UK LAWYERS What Happens During e Discovery Processing? The Black Box Between Collection and Review, Opened for Lawyers COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES EDRM PROCESSING PRACTICE EXCEPTION & RECONCILIATION REPORTING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the stage nobody watches 03 The pipeline: from collected data to reviewable documents 04 The decisions that matter: exceptions, de NISTing and filters 05 Reconciliation: making the numbers add up 06 Special formats: mobile data, chat, cloud exports and structured sources 07 Processing disputes: challenging and defending the counts 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PROCESSINGTURNSDATAINTODOCUMENTSTHROUGHRECORDED DECISIONS: THERECORDISWHATMAKESYOURDISCLOSUREDEFENSIBLE
§ 02 · FIRST PRINCIPLES The problem in plain English: the stage nobody watches
§ 03 · THEPIPELINE The pipeline: from collected data to reviewable documents
Page 2
§ 04 · THEDECISIONS The decisions that matter: exceptions, de NISTing and filters
§ 05 · THEARITHMETIC Reconciliation: making the numbers add up
§ 06 · THEAWKWARDINPUTS Special formats: mobile data, chat, cloud exports and structured sources
§ 07 · WHENCOUNTSARECONTESTED Processing disputes: challenging and defending the counts
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EXCEPTION SOURCE RE- COUNTERPART CREDENTIALS T YPE PULL COPIES & KEYS OTHER VERSIONS / BACKUPS NET RESULT RENDERS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEEXCEPTIONTHATWASTHECASE EXAMPLE2 · THE400GBTHATBECAME41, 000DOCUMENTS, DEFENSIBLY EXAMPLE3 · THEFAMILIESTHATCAMEAPART
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · PROCESSING PA R AG RAPHFORTHEDISCLOSUREPROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The processing checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why did 400 GB of data become only 40,000 documents? What actually happens to files that cannot be processed? Is it safe to remove "system files" from the review set? Our opponent's production has emails whose attachments are missing. Innocent? Can we change processing decisions after review has started? Does processing alter the underlying evidence?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, What Happens During EDiscovery Processing, Computer Forensics Lab, https://e-discovery.uk/library/what-happens-during-ediscovery-processing/pdf.