A Change in Overnight Business Processes
The enforced social distancing resulting from the COVID-19 pandemic changed a lot of business processes practically overnight. It forced organizations with processes that required location in a physical space to rework those processes to support remote work. This has led to the increased use of collaboration apps, like Slack and Teams, video conferencing apps like Zoom and enterprise-wide cloud-based solutions, such as M365 and G-Suite.
It has also changed the nature of discovery processes. Document reviews no longer used review teams working in an office together, but instead needed to be reconfigured to support reviewers working remotely. And ESI collection for discovery purposes, traditionally done on-site and in person, has been revolutionized to support the ability to be done remotely because of 1) employees are not frequently in the office, or 2) because of social distancing restrictions, or 3) remote collection has simply become more convenient.
Dramatic Shift to Remote Collection
To what extent was collection revolutionized because of the pandemic? According to ComplexDiscovery, initial market model estimates for 2020 suggested that approximately 95% of collections would take place on-site, with only 5% to be performed remotely.
But the outbreak and impact of COVID-19 and the corresponding location-dependent travel and group aggregation restrictions changed that dramatically, reducing estimates for the percentage of collections to be conducted onsite to 10% for 2020, while the estimated percentage of collections to be performed remotely in 2020 increased from 5% to 90%. That raised the estimated market for remote collections essentially tenfold: from original market size projections of $80 million to $800 million!
Reasons for the rise
While the pandemic was an important catalyst to the dramatic increase in remote collections, they had already been on the rise pre-pandemic. Reasons for the rise include:
When to Consider On-Site vs. Remote Forensic Collection
If you have several computers or devices in one location that need to be imaged, this may be best accomplished by an on-site forensic collection. However, when the expense of on-site forensic data collection is significant, or if finding a qualified forensic collection consultant in the geographical location where the hardware to be imaged is difficult to impossible, that’s when it makes sense to request a Remote Digital Forensic Data Collection. Remote forensic collection is the most cost-effective way to collect your data in a forensically defensible manner when you have data sources in various cities around the country (or even the world). And it may be the only possible means of collection if those sources all need to be collected in the same day, or within a few days.
Sometimes, you may have both scenarios. If you have one location that has several computers or devices to be collected and also have one or two computers or servers in other locations, then a hybrid approach to the collection can be conducted. Using one approach in some locations doesn’t preclude using a different approach in other locations in the same matter.
Remote Forensic Collection Forensically Defensibility
Is remote forensic collection forensically sound and defensible? Absolutely! Remote Forensic Data Collection is handled in the same manner that an on-site collection would be handled utilizing the exact same tools such as AccessData’s FTK Imager and Cellebrite, among other forensic collection tools. At Forensic Discovery, we just add a pipeline to transcend the distance using Zoom.
Conclusion
Even as we have started to see many businesses return their workforces to the office (at least part of the time) as social distancing requirements are eased, remote collection of data for discovery purposes is here to stay as it saves on travel costs and we’re seeing more sources of data move to “the cloud”. Consult your forensic collection consultant on the best method to handle your collection, based on where and how your data is stored.
