Phases of eDiscovery
The consensus is that eDiscovery solutions consists of 9 different phases. In practice, there may be some deviation from the norm, but it more or less boils down to a process that follows a sequential order.
This phase is all about optimizing the process to keep the costs down. The goal is to envision the process before actually executing it to determine the best possible strategy of approach.
Are there any technical obstacles that could get in the way? Where is the evidence most likely going to be located? What volume of data are we working with? Who is in possession of the device where the sough-after data is stored? These are the questions to be asked in the identification phase of the eDiscovery forensics process.
Too many times, data is deleted for various sorts of reasons that may or may not have malicious intent. For instance, someone might delete their digital inbox to preserve space and make room for more emails, but it could also be to hide evidence. One of the responsibilities of a computer forensics eDiscovery expert is to preserve the data they’re working with to make sure nothing is accidentally deleted, overwritten, or lost.
The data collected must be done so in a manner that is forensically sound and indisputable in court. It is NOT acceptable to alter it in any way, shape, or form – it must be presented “as is” (with a few notable exceptions such as converting it to a more easily accessible format which we’ll cover below).
By using the right software that is suitable for file conversion without significantly altering the content itself, it’s possible to convert the file into a more user-friendly and compatible format without compromising the integrity of the evidence. For example, SalvationDATA’s VIP 2.0 is an industry-leading digital video forensics software that can do this with the help of its Ultra Transcoder and Ultra Player features.
Oftentimes, the need for this arises when handling video footage and digital recordings, so it’s important for an eDiscovery forensics expert to have the right digital tools at hand.
In this phase, it’s important to separate the evidence from privileged information. In case the privileged information is not necessary to be revealed to establish a point or to provide proof of X, that information should be kept away from the public eye.
When analyzing the data collected, it’s important to present the relevant pieces in a coherent manner and give them a fitting context. eDiscovery forensics experts are tasked with pinpointing the points of interest and identifying key figures:
Thankfully, a good Big Data Forensics System that comes with Digital Forensic Lab can help you visualize the data in a coherent manner and allow you to spot the correlations with ease, all while automating a good portion of the process.
This is an advanced solution that not only takes the heavy lifting of manual work out of the equation but also improves the outcome of the analysis through greater accuracy.
eDiscovery experts love this comprehensive technology developed by SalvationDATA because it also allows them to automatically generate a detailed expert report to present their findings before the jury.
This is the step to take before the material collected can be presented in court. Sometimes, it’s necessary to convert various files, documents, and other media from one format to another.
In the grand scheme of things, only a tiny percentage of data is relevant to the legal proceedings, and it’s important to pick the most relevant pieces with care. Choose wisely, and the jury will be more likely to side with your story.
The objective of eDiscovery jobs and services
The process of eDiscovery is well defined and has a clear objective, which ensures full compliance with the law and maximizes the chances of a successful outcome. In fact, there are many goals eDiscovery jobs try to achieve:
Preserving the chain of custody
If the chain of custody is not preserved correctly, the opposing legal team can easily undermine the efforts of the eDiscovery team and the court may be unable to admit the evidence presented as a result. To satisfy the requirement, most modern eDiscovery tools come with an integrated chain of custody reporting features.
In addition to that, you will often find extended metadata and file fingerprinting functionality built into them.
Don’t let crucial evidence be dismissed due to a small technicality.
Finding hidden data
eDiscovery software solutions are not quite on the level of their digital forensics counterparts, but they can do a terrific job at amassing large volume of data in a small amount of time and thus using as little resources as possible to accomplish the objective. The goal is to reduce manual labor as much as possible and use smart automation to expedite the process.
Most modern eDiscovery software allows you to swiftly search the files across multiple devices by entering keywords, phrases, or search parameters. But it goes even deeper than that: with the use of metadata searching, it’s possible to do an in-depth search that goes beyond matching a file name or the contents of a message.
Often, eDiscovery jobs involve reviewing documents, which could easily lead someone off-track and make the process non-time-efficient and non-focused as a result. However, with annotation, Annotation features can help keep the process structured and centralize information for reference.
Document annotation is synonymous with productivity.
Any privileged information obtained during the process should be kept private, so redaction is a necessary component. However, doing it manually takes time and money, so you’ll burn through your resources pretty fast. Moreover, human beings are prone to error whereas eDiscovery software is not, so it’s vital to utilize it where possible.
File sharing and conversion
Before we can present the findings in court, we need to make sure they are in the correct format which makes the files easy to share. For this reason, many eDiscovery and digital forensics solutions such as SalvationDATA’s VIP 2.0 come with conversion features that preserve the integrity of the evidence while transcoding into a more accessible and compatible file format.