With the rise of remote work, employees are communicating online in more ways than ever before. This means companies have a lot of places to look for data during a collection.
In our latest two Tuesday Tip articles, I’ve shared the three methods of data collection and the benefits of performing a targeted collection. In today’s blog, I’ll be sharing where to find the data you need to successfully complete a collection. We’ll go over the most popular data sources, as well as address important factors to consider when collecting from each medium.
Network Data
Network Data is the large data share on a company’s network. It can be the most common place to start your data collection since most users have access to and store data somewhere on the network. You may want to collect everything, then narrow in on specific folders to process or you may perform a more targeted collection. This depends on a variety of factors including the scope of your matter, internal resources and the information already known.
Network data is usually the simplest medium to self-collect and the easiest to perform a targeted collection on, depending on how the data has been organized. It’s important to note not every user will have access to the same shares. You may want to utilize Custodian Questionnaires to find out what shares your users actually use to ensure you collect all the data you need.
User Machines
Even if you collect all the network data, individual users may have additional relevant material on their laptop/computer. You may want to have this data collected by a forensic professional, but if you’re going to collect it yourself be sure to check out this previous Tuesday Tip on How to Find User Data on Windows Operating Systems. It identifies some data locations that may not have considered.
Most collections involve obtaining emails. How and where to collect that information will change depending on the email program used, setup and internal resources. One thing to consider is whether the company uses an email archiving program which is common among large corporations. If you (or your client’s) organization uses one, make sure to consider that program in your workflow decisions. If certain archiving programs are in use and you collect from Exchange, you could encounter issues such as missing attachments or possibly even missing large parts of the bodies of emails.
If you find yourself having to deal with PDF and printed emails during your collection, check out my 7 Questions to Ask Yourself Before Getting Started.
Document Repositories
As employees migrate to remote working, document repositories like SharePoint, eFileCabinet and Rubex are being used more than ever to share assets and information. Unfortunately, from a collection standpoint, this can present new challenges when obtaining data. Generally, it’s best to export this data from the tool itself, as there can be significant additional meta-data kept within the program. This should always include a discussion with the administrator of the program.
Messaging Apps
Again, with remote work comes new collection challenges. Messaging apps like Teams, Slack, Skype for Business are gaining traction as employees are forced to connect and collaborate in new ways online. While these apps are certainly handy, they present new challenges when it comes to collecting data in a format that can be easily reviewed.
Generally, you want to export the data from the messaging app itself. Depending on the tool, exporting to CSV may be the best way to go. In this format each individual message would be a separate line in the CSV, with a field for the message, sender, recipients, time and more. It’s possible to convert this data into a format that can be loaded into a review program (where each message would be a document), however each conversation would become a single family. This process can become even more complicated for apps that allow for images/files to be attached in a message.
Cell Phones
Now, mobile devices themselves can act as a full-functional computer that fits in your pocket. They are also almost impossible to collect yourself. A forensic collection of a cell phone will collect all files on the phone, including text messages and call logs. It can also collect data from some third-party applications, but it depends on the individual apps’ permissions. The key thing to remember is if you image (collect) a cell phone, you are capturing what is on the phone. Just because emails are connected, it does not mean someone’s entire email account will be included.
---
This is not a be-all, end-all list. Custodian interviews, client discussions, workflow planning and consultations should be utilized to plan for the data collecting. Discussing the requirement and possible locations in advance can save you costly rework if called in to collection later. Cell phone collections should be discussed, such as with a company like Ricoh eDiscovery to go over your options, and what will and won’t be available for you.
You may also be interested in...
How Targeted Collections Can Save You Time and Money
Learn what it means to perform a targeted collection and how, by using this focused approach, you can save time and money during your investigation.
Legal Hold 101: What you need to know about preserving your records
We asked our Tuesday Tips Team about the basics of legal holds: what they are, how they affect the way organizations manage their records and what tools can be used to help.
