Ediscovery Trends

In email forensics, it’s important to realize the scope of the data that you are dealing with.  While I agree with some of this blog post on email collection, when important litigation is involved, a computer forensic expert is a must.

The main reason you do not want your internal IT admin exporting emails for you is that often the person who recovered the data will be called upon to testify before the court.  A certified computer forensics professional has the experience and proper methodology to refute claims (such as spoliation, for example) made by opposing counsel.  A reputable ediscovery or digital forensics shop should have certifications and the expertise to help plan the most efficient way to collect, cull, and review your documents.  Proper planning for litigation can ensure that you’re using resources wisely and not throwing good money after bad.

However, if your firm uses Exchange and is simply conducting some sort of internal investigation, then the DIY approach to data collection is probably just fine.  Make sure to know the limits of your IT staff though – data collection can be a long process and they may not have the resources to do the job as quickly as a dedicated forensics firm.