Tell me if this sounds familiar. Litigation has been looming for months, and one day a subpoena drops on your plate. The deadlines are tight. Maybe it’s a second request and there are only six weeks to comply. Suddenly, everything has to happen at once. Outside counsel and vendors have to be engaged, teams have to be formed, processing and production specs have to be finalized, and data has to be collected. In the midst of this excitement, data collection resources are deployed to an on-site location to collect from multiple custodians and data sources, only to find that the proper permissions weren’t in place ahead of time, the custodians were unable to have their data collected for various reasons, or not all data sources were present. Collections stall, costs drive up, and the efficiency of the project starts to decrease.
These setbacks can set the tone for the entire project, and cause problems down the line. Hopefully, the vendor doing the collection maintains impeccable records and notes, as many times the issues encountered during collections crop up throughout the matter. This is especially true in second requests where data is rapidly rolling in and many processes are running simultaneously. But, if for some reason they don’t, the matter can face some serious issues and consequences all because the proper foresight and thought wasn’t put into place.
Thankfully, it doesn’t have to be this way. With some advanced preparation, the collections process can run smoothly, without the typical stress associated with the start of a new matter. I’ve outlined four key ways to help prepare you for litigation and avoid these setbacks:
1. Establish a Playbook Ahead of Time – The importance of a playbook has been discussed numerous times, by leading industry experts (for previous insights on playbooks, please read here, here, and here), and it is especially important in the context of data collection.
A playbook should contain an outline of all data repositories and the repository owners, so getting access to a data set for collections is not time or resource intensive. In the past, I have seen delays of up to several weeks just trying to get network credentials because the legal departments did not understand the IT processes and vice versa. Building in foresight, establishing access policies for litigation needs, and implementing SLAs between IT and legal goes a long way to limit lag time between the start of a matter and a successful data collection.
If your network is especially fragmented (typically seen in corporations where there have been numerous acquisitions) or complicated, creating a data map that is periodically updated is also a good idea. This will allow the corporate ediscovery coordinator to be able to tell what data exists where and to communicate that to counsel and the data collector.
2. Understand Your Data Sources – If you’ve reached out to a vendor to engage them in collection services, the first question you’ve probably received back is “what are the data sources”? The answer to this question informs so much of the collection process. It determines whether or not the collection will need to happen on-site or remotely, the kind of access a data collector will need, and if any special equipment is required.
As mentioned in the previous point, building out a playbook that contains information on the data sources and data repositories will allow you to proactively provide the information that a data collector would need, ensuring that the kick-off and initial collection phases go smoothly. I’ve provided some examples of data sources you may encounter during a collection, though this list is certainly not exhaustive:
- Laptops/desktops (Mac or PC – Specialized collections tools are needed for Macs)
- Cell phones (with the exception of iPhones, all cell phones need to be collected using specialized forensics equipment, as they require specific connectors and software to capture phone data. With iPhones, although they can be collected remotely, I recommend using the specialized equipment if the litigation is criminal in nature, to ensure that a full forensic image of the phone is captured.)
- Network shares (personal or team)
- Office 365
- Email (on-premise Exchange or archived emailed)
- External media (USB devices or external hard drives)
- Social media
3. Have a Plan of Attack – Advanced preparation is key when it comes to a smooth collection. In my experience, I’ve found that when a client creates a collection schedule, determines custodian data sources and potential issues (such as a corrupt hard drive), sets-up environment access (if needed), and sets expectations around the collection process ahead of time, it almost always guarantees success.
I would suggest using free scheduling tools like Doodle or Rally when there are multiple custodians to collect from to have them select times that work best for their schedules within your collection period. Depending on the amount of data and the data sources, I recommend a minimum of an hour to schedule for collections. Just remember, the more the data, the more time required.
Once custodians have selected what time they can be available for collection, I recommend circulating a calendar invite that contains the following information:
- The location of the collection
- The time of the collection
- What they need to bring (laptop, cell phone, tablet, network access credentials, etc.)
- An explanation of what is going to happen
- Set expectations around the collection (e.g. custodians will not be able to use their devices while they are being collected and that sometimes the collection may exceed the allotted time because of unexpected technical issues)
For the collection resource, if they are coming on-site, it is best to start the process of getting physical access to the client site and a conference room with internet and phone access booked as soon as the SOW is signed. This ensures that there aren’t unnecessary delays the day-of collections, and gives the collector adequate resources to conduct the collection. Additionally, once collection day arrives, it is helpful to have an IT resource on-call or in the room, to help navigate access and technical issues that may crop up.
4. Utilize Remote Collections As Much As Possible – In today’s ever interconnected world, on-site collections are becoming less and less of a necessity. In situations where there are multiple custodians being collected from one location, a full disk image is required and there are specific security controls that prevent remote access. In this case, remote collections may not be the best option, but by and large, remote collections should be leveraged as often as possible. They cost the client less, are typically more efficient, and allow for data to get in the hands of processing faster, which is especially beneficial when coming up against tight deadlines.
Typically, when I work on a matter where remote collections are an option, I take the lead on organizing the process. In some cases, this involves working directly with the client’s IT department in order to establish the necessary remote access protocols. In others, it involves coordinating remote collections with custodians and ensuring that they understand the process that we will be taking. Since this usually involves taking keyboard and mouse control of a custodian’s laptop, it is important to convey that process from the get-go. I’ve experienced situations in the past where custodians were not aware that they would have to relinquish control of their computer and adamantly refused to give access. In one case, it took weeks and setting up a dummy computer to get the information our client needed because of the custodian’s privacy concerns, and it put the client’s budget and timeline at risk. Though this is rare, setting those expectations ahead of time goes a long way to prevent any unnecessary delays or conflicts.
Overall, ensuring that a matter gets off on the right foot simply requires organization and advanced preparation. When all of the best practices outlined above are taken, collections are typically done smoothly, quickly, and effectively to limit the inconvenience that custodians experience. Try implementing them in your next matter and see how it goes!
Keep the conversation going! If you’d like to continue discussing any of these topics or are looking for more best practices, please don’t hesitate to email at firstname.lastname@example.org or find me on LinkedIn.