What Happens During EDiscovery Processing

EDISCOVERYPROCESSING · AGUIDEFORUKLAWYERS What Happens During eDiscovery Processing? The Black Box Between Collection and Review, Opened for Lawyers COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES EDRM PROCESSING PRACTICE EXCEPTION & RECONCILIATION REPORTING CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the stage nobody watches 03 The pipeline: from collected data to reviewable documents 04 The decisions that matter: exceptions, deNISTing and filters 05 Reconciliation: making the numbers add up 06 Special formats: mobile data, chat, cloud exports and structured sources 07 Processing disputes: challenging and defending the counts 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : PROCESSINGTURNSDATAINTODOCUMENTSTHROUGHRECORDED DECISIONS : THERECORDISWHATMAKESYOURDISCLOSUREDEFENSIBLE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the stage nobody watches § 0 3 · THEPIPELINE The pipeline: from collected data to reviewable documents § 0 4 · THEDECISIONS The decisions that matter: exceptions, deNISTing and filters § 0 5 · THEARITHMETIC Reconciliation: making the numbers add up § 0 6 · THEAWKWARDINPUTS Special formats: mobile data, chat, cloud exports and structured sources § 0 7 · WHENCOUNTSARECONTESTED Processing disputes: challenging and defending the counts § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EXCEPTION SOURCE RE- COUNTERPART CREDENTIALS T YPE PULL COPIES & KEYS OTHER VERSIONS / BACKUPS NET RESULT RENDERS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEEXCEPTIONTHATWASTHECASE EXAMPLE2 · THE400GBTHATBECAME41 , 000DOCUMENTS , DEFENSIBLY EXAMPLE3 · THEFAMILIESTHATCAMEAPART § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · PROCESSING PA R AG RAPHFORTHEDISCLOSUREPROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The processing checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Why did 400 GB of data become only 40,000 documents? What actually happens to files that cannot be processed? Is it safe to remove "system files" from the review set? Our opponent's production has emails whose attachments are missing. Innocent? Can we change processing decisions after review has started? Does processing alter the underlying evidence? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY