|
|
|
Engage The Experts
|
Forensic Collections
Prior to any data collection it is critical to engage a discovery consultant to help clearly define the strategies and the standard operating procedures for the collection. Once you have an organized plan in place you must identify the sources of data which contain or may contain relevant information. Common areas include: shared servers & networks, custodian work stations, laptops & desktops, blackberries, iphones or other mobile devices, home computers, and other items located outside of the enterprise.
Can you perform a "Targeted Collection" to limit the data set and minimize time and money or is a "Full Forensic Collection" and mirror image of the data set necessary? What about maintaining the "Integrity" of the original native files? And how do you ensure all of your relevant data is collected in a defensible manner?
To begin - always hire an expert, a licensed forensic agent intimate with federal rules and a track record for performing collections similar to the one you are considering. Which expert you chose should be based on factors such as experience (both with collections and testifying in court), the specific security protocols involved, hardware and software environments, and of course the overall goals identified with your discovery consultant.
When engaging a forensic collection professional expect to pay for their expertise. Forensic agent rates range from $250 - $350 an hour to $1,000 - $2,000 a day, depending upon the complexity of the particular collection. For forensic collections, the ability to manage costs correlates to the amount of planning you have done with your discovery consultant - Do Your Homework!
Prior to sending a forensic agent it is important to make sure that all details of the collection are decided so that once the agent arrives their role and your expectations are clearly defined. Bring your discovery consultant on-site to meet with the in-house legal and IT departments to identify the scope of the collection. Leverage the discovery partner to orchestrate the custodians' schedules and manage the process. Make sure to have a detailed Custodian Interview Checklist which should be answered by each custodian prior to the collection. Finally, as you are dealing with extremely sensitive company information it is important that a Chain of Custody sheet is filled out every time data is transferred from the client, to the forensic agent, to the law firm and/or discovery partner.
A typical work-flow prior to a forensic collection is as follows:
Forensic Collection Primer:
1. Engage a Discovery Consultant early to create a collection strategy that accounts for the company's data retention policy, data map and the scope of the legal matter.
2. Identify all custodians and network drives that contain data relevant to the matter.
3. Complete a Custodian Interview Questionnaire per custodian to identify data creation and retention habits and to isolate non-relevant file types.
4. Structure a well thought out data collection schedule minimizing work place disruptions.
5. Employ Data Collection Best Practices capturing all relevant information.
6. Store collected data on static-free hard drives in sealed bags with chain of custody information.
7. Create a copy of the original hard drives for processing, leaving the original forensic hard drives under lock and key.
8. Document all steps of the collection process listing data collected, data not collected and any and all circumstances involved with the collection.
To receive a copy of any of the documents discussed above (Data Collection Strategy, Custodian Interview Questionnaire, Data Collection Best Practices or Data Collection Documentation Template), please contact the Discovery Experts at
BlackStoneDiscovery.com.
Thank you to those who have given us feedback on our newsletter. If you have feedback please email info@blackstonediscovery.com.
|
