Choose Your Own Preservation Adventure: The High-Stakes World of Forensic Data Collection
MEET OUR AUTHORS:
Tim Morenc, Senior Director, Legal Solutions at BlueStar https://www.linkedin.com/in/timmorenc/
Alvey Matlock, Digital Forensic Expert at Guardian Forensics https://www.linkedin.com/in/alvey-matlock-7960649/
A Digital Mystery Presented by BlueStar & Guardian Forensics
Synopsis: You’re an attorney preparing for a major case. Key digital evidence is stored on various devices, laptops, mobile phones, cloud accounts—but how you collect it will determine your success in court. One wrong move, and the evidence could be challenged, or worse—deemed inadmissible or the death blow receiving a judgement ruling of spoilation of evidence has occurred.
The clock is ticking. Your client asks, “Can I just send you the files myself?”
OPTION #1: Let the Client Self-Collect
You agreed with the client, thinking it’s the fastest and cheapest route. Your client sends emails over a few key documents and screenshots from their phone. At first glance, everything seems fine. But as you prepare to present the evidence, the opposing counsel raises a critical issue—metadata is missing, timestamps are inconsistent, and chain of custody was never documented.
The judge frowns to say the least. “Without proper forensic preservation or otherwise scientific approach, this evidence is unreliable and subject to opposing counsel conspiratory theories.”
Game Over. Your evidence is tossed, and your case weakens and may result in summary judgement. Should you retry?
🔄 Go back and choose another path
OPTION #2: Use an In-house or MSSP IT provider for Collection
You have decided to involve the company’s IT staff. The thought process is they are technically savvy people why not. They pull files from internal servers and download email records. The collection appears more structured, but something seems off.
During cross-examination, a forensic expert from the opposing side asks, “How was this data extracted? What software was used? Were any files altered in the process?” where is the original folder/file structure and the phrase most all judges understand in today’s courts is the Metadata has been destroyed.
The IT team, well-versed in security but not eDiscovery and Digital Forensics best practices, can’t provide definitive answers nor can they reliably testify in court because they lack the credentials, training and experience. Without forensic integrity, the data is challenged.
Risk Level: High. This might hold up, but it’s a gamble.
Would you like to play it safe?
🔄 Go back and choose another path
OPTION #3: Partner with a Digital Forensic Expert
Realizing the inherit risks to ESI, you bring in a forensic data collection expert. They use industry-standard tools to create forensic and legally defensible copies of devices and cloud information, ensuring no data is altered. Chain of custody is meticulously documented, and all metadata is preserved.
During trial, the evidence is held under scrutiny. The forensic expert provides a clear, defensible explanation of how data was collected, stored, and verified. The judge nods with approval.
🔹 Congratulations! You’ve successfully navigated forensic data collection by adopting a solid framework deployed by the professionals.
Moral of the Story?
· Self-collection is risky. It’s fast but introduces errors, missing metadata, and legal challenges.
· IT collection isn’t foolproof or defensible. Without forensic-grade preservation by qualified experts, data integrity can be questioned.
· Forensic experts ensure defensibility. Proper collection methods, documentation, preserving evidence integrity and prevent costly disputes or summary judgements.
Cutting corners risks losing cases, clients, and credibility.
Ready to future-proof your eDiscovery process? Let’s talk about forensic data collection done right.