Ediscovery Trends

According to a survey released by Symantec, email is no longer the primary source of ediscovery responses.  While email can provide important communications and contextual information, loose files (such as Microsoft Office documents) and database files are being produced on an increasingly regular basis.  The inclusion of databases in particular indicates that more and more litigation could be focused on theft of intellectual property – when a disgruntled employee leaves one company for another, customer databases are a ripe target for theft.  Of course, confidential and proprietary documents are also high on the list, so look for companies to become even more litigious as their IP is increasingly at risk.

In email forensics, it’s important to realize the scope of the data that you are dealing with.  While I agree with some of this blog post on email collection, when important litigation is involved, a computer forensic expert is a must.

The main reason you do not want your internal IT admin exporting emails for you is that often the person who recovered the data will be called upon to testify before the court.  A certified computer forensics professional has the experience and proper methodology to refute claims (such as spoliation, for example) made by opposing counsel.  A reputable ediscovery or digital forensics shop should have certifications and the expertise to help plan the most efficient way to collect, cull, and review your documents.  Proper planning for litigation can ensure that you’re using resources wisely and not throwing good money after bad.

However, if your firm uses Exchange and is simply conducting some sort of internal investigation, then the DIY approach to data collection is probably just fine.  Make sure to know the limits of your IT staff though – data collection can be a long process and they may not have the resources to do the job as quickly as a dedicated forensics firm.