To Self-Collect or Not: Still the Question

Last month, I detailed the dangers of self-collection and advised against it. For all of us who advise their clients to have their data for e-discovery production collected forensically and find that, despite their dazzling and irrefutable logic, their clients still insist on self-collection, here are some questions to ask the client. Sometimes the answers to those questions do a better job than we can of persuading the client to engage a competent vendor to do the forensic collection, but at a minimum they help the client and the client’s IT staff understand what they need to do to collect Electronically Stored Information (“ESI”) in a defensible manner.

“Forensic data collection” can be defined as: 1) making a bit-stream, forensic image of the media, that is, a copy of every “0″ and “1″ on the “original” media, which preserves not just the saved files but also deleted files, file fragments, Internet history, metadata with no possibility of it being altered (other forms of copying may alter metadata) and other sources of evidence; 2) making a “hash value” – a number unique to any given digital media, generated by inputting data from the media into a complex algorithm – of both the original and the forensic image, then verifying that the image is identical to the original when comparison shows they have produced identical hash values; and, 3) documenting chain of custody to make authentication of the data easy. “Self collection” can be forensic data collection, but usually it is not. IT personnel often self-collect using Symantec Ghost or other similar tools created for use in IT, which do not as a default collect deleted files, file fragments, Internet history and so on, and also cannot verify the image they make since it is not an exact copy of the original. Just as often, “self collection” refers to the “drag and drop” type of copying which users like you and me employ, e.g., burning copies to a CD or other external media. Such self-collection copies only saved data (no deleted, etc.); moreover, such copying often changes file creation dates and other key metadata.

Evaluative Questions