Because of the continuing complexity of cases involving e-discovery, legal teams are required to work closely with colleagues throughout the organization. IT must be collaborated with in collecting data, and must interface with e-discovery software or service providers. Records Management, if such a department or individual exists, often holds the keys to big troves of potentially relevant data. And “line” employees, who can be potential witnesses and data custodians, must be contacted and relied upon to preserve any potentially relevant evidence.

This three-part series will help in-house counsel and other legal professionals to effectively work with IT professionals, records managers, and other employees.

Part 1: Collaborating with Information Technology

Have you ever wondered, “What is this IT guy talking about? LAN, proxy server, exchanges, what is all this stuff?”, when all you want is for your e-mail to work again. Well, IT professionals think the same when they hear you talk about spoliation and sanctions or try to avoid jury duty when they receive a friendly summons from the neighborhood county court. You likely didn't go to law school to perform forensically sound data collections, and your IT team did not go to law school at all.

However, the sheer size of data you may be confronted with and specific requirements by court order regarding data preservation and forensic collections require technical expertise. This is why coordinating with information technology (IT) specialists and data collection specialists is vital to your success.

Bigger Isn't Always Better

Data in e-discovery litigation, especially e-mails, continue to grow in size, quantity, and complexity. Eventually, you will be confronted with a case that has huge data sizes. In such a case, the most important thing to do is to determine how to collect what is relevant to the case. This is where an effective IT professional or data collection specialist can advise you on options for data collection and preservation. You can consult with them regarding what process you'll have to go through in order to achieve the goals for the case you're working on. Here are some examples of options that a knowledgeable IT or collection expert can walk you through:

Forensic collection options

• Forensic Image – Essentially a precise, exact data copy of a hard drive. This is like taking a large scoop approach to data collection, rather than a scalpel. With this method you obtain everything from a potential witness and cull down from there. This method tends to be very common in criminal prosecutions if forensic collection is available. However, it is important to make sure to take a forensic image, which preserves the files exactly. Otherwise, the collection itself can change the data and potentially spoliate the data.
• Forensically sound collection – Using a tool that can capture hash values from files, filepaths and file locations, thus you can verify and authenticate from whom the files came. Unlike the forensic image, this method can be targeted, and can utilize search terms to narrow down particular files that you may be looking for, for a specific matter.

Logical Data Collections

• Done typically copying data to a hard drive, CD/DVD, or possibly even by attaching native files via e-mail and sending that way. You can use keywords and searching on the system you're using to find specific documents assuming you have terms to check before collecting the data. This method is not forensically sound, however, it is not uncommon for data to be collected this way. Ideally, try to have an IT or data collection specialist doing this work, but the witness or custodian may be able to collect the data themselves and turn it over to you. You can have them sign a declaration that they've done their due diligence in disclosing the relevant data to you, shifting the burden to them.

Who can help me collect and how can I help them?

In the instance of court ordered forensic collections, you will need help and likely someone certified in a forensic collection tool. You will also need to instruct the IT or data collection specialist on what to collect, how much, and using what methodology. Even if you have a court order to perform forensic collection and preservation, you may have various options and tools to comply with the court's request; your IT team can talk you through the implications of each. This gives you an opportunity to work with the IT or collection specialist and for them to provide you with a consultation on how they will perform the work to meet the needs of your case's collection efforts.

I was at a seminar recently where counsel told his data collection specialists on a mobile phone collection that all they needed to collect were basic text messages (SMS – Short Messaging Service) and e-mails. The collection specialists did exactly what they were asked. Unfortunately, there was substantially more data to collect, including MMS (Multimedia Messaging Service) and EMS (Enhanced Message Service) data. Photos, videos, or other multimedia sent via MMS or EMS were not collected; neither were voicemails. Technical professionals typically tend to follow instructions to the letter and not question your directives—remember they are not lawyers and do not fully understand what you need unless you tell them what you are trying to accomplish. In this case, the techies perhaps could have done a better job of going back to the attorneys and explaining all of the other data collection options on the mobile device, and likely would have had the attorney explained that his goal was to get all the potentially relevant data off the phone.

No matter what the situation, you have to do your part in terms of outreach, communication, and management of the collection process and the case. For example, you will likely have to craft search terms, in consultation with your technical experts. This becomes an opportunity for you to explain the background and merits of the case, and to provide them some perspective from your aspect of the work. A better understanding of the case background and collection objectives between attorneys, IT and records management professionals can contribute to much better results.

Be receptive to feedback from IT and realize sometimes technological tools cannot always accomplish exactly what you think they can. Do your best to understand the tools and tech and how they work. The technical experts will then be able to relay to you what's achievable on their end and whether they can accomplish the data collection or preservation you seek to complete. Think about collection and storage options, and how you want to handle the documents for review and potential presentation at trial. For you to direct successful data collections that are technically and legally defensible, you will need both legal and technical professionals who can listen, understand, and identify issues from both professionals' perspectives and objectives.

In the end, because of the sheer size or complexity of the data you're dealing with, or possibly because you're dealing with a large number of potential witnesses or custodians, you will need someone else to perform the work. You likely will not have time or the technical expertise. The question then becomes what are the parameters and options for the collection and preservation of data. This requires planning and understanding of the substantive and technical issues of the case at hand. The best strategy is to make sure to help IT understand the substantive issues, while letting them help you understand the technical ones.

This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this publication.