How the Pandemic Has Revolutionized Discovery Collection

A Change in Overnight Business Processes

The enforced social distancing resulting from the COVID-19 pandemic changed a lot of business processes practically overnight.  It forced organizations with processes that required location in a physical space to rework those processes to support remote work.  This has led to the increased use of collaboration apps, like Slack and Teams, video conferencing apps like Zoom and enterprise-wide cloud-based solutions, such as M365 and G-Suite.

It has also changed the nature of discovery processes.  Document reviews no longer used review teams working in an office together, but instead needed to be reconfigured to support reviewers working remotely.  And ESI collection for discovery purposes, traditionally done on-site and in person, has been revolutionized to support the ability to be done remotely because of 1) employees are not frequently in the office, or 2) because of social distancing restrictions, or 3) remote collection has simply become more convenient.

Dramatic Shift to Remote Collection

To what extent was collection revolutionized because of the pandemic? According to ComplexDiscovery, initial market model estimates for 2020 suggested that approximately 95% of collections would take place on-site, with only 5% to be performed remotely.

But the outbreak and impact of COVID-19 and the corresponding location-dependent travel and group aggregation restrictions changed that dramatically, reducing estimates for the percentage of collections to be conducted onsite to 10% for 2020, while the estimated percentage of collections to be performed remotely in 2020 increased from 5% to 90%. That raised the estimated market for remote collections essentially tenfold: from original market size projections of $80 million to $800 million!

Reasons for the rise

While the pandemic was an important catalyst to the dramatic increase in remote collections, they had already been on the rise pre-pandemic. Reasons for the rise include:

• Need to Reduce Travel Costs: When the norm used to be on-site collections, the costs associated with travel for forensic collection consultants could add up, especially if the consultant had to travel to several locations to collect custodian ESI. To reduce costs, organizations began requesting for forensic collections to be performed remotely on an increased basis.
• Convenience and On-Site Costs: With remote data collection, a forensic collection consultant can remotely initiate a collection from a custodians device(s) and then not have to be involved again till the collection is complete. This can require only half on hour on either side of the collection as opposed to the expert having to stay on site for half a day or longer.
• Rise in Cloud-Based Data Sources: As more organizations have begun to move enterprise-wide systems to “the cloud” more (even before the pandemic accelerated that trend), there was no need to be on-site to collect ESI from those solutions.

When to Consider On-Site vs. Remote Forensic Collection

If you have several computers or devices in one location that need to be imaged, this may be best accomplished by an on-site forensic collection. However, when the expense of on-site forensic data collection is significant, or if finding a qualified forensic collection consultant in the geographical location where the hardware to be imaged is difficult to impossible, that’s when it makes sense to request a Remote Digital Forensic Data Collection. Remote forensic collection is the most cost-effective way to collect your data in a forensically defensible manner when you have data sources in various cities around the country (or even the world). And it may be the only possible means of collection if those sources all need to be collected in the same day, or within a few days.

Sometimes, you may have both scenarios. If you have one location that has several computers or devices to be collected and also have one or two computers or servers in other locations, then a hybrid approach to the collection can be conducted. Using one approach in some locations doesn’t preclude using a different approach in other locations in the same matter.

Remote Forensic Collection Forensically Defensibility

Is remote forensic collection forensically sound and defensible? Absolutely! Remote Forensic Data Collection is handled in the same manner that an on-site collection would be handled utilizing the exact same tools such as AccessData’s FTK Imager and Cellebrite, among other forensic collection tools. At Forensic Discovery, we just add a pipeline to transcend the distance using Zoom.

Conclusion

Even as we have started to see many businesses return their workforces to the office (at least part of the time) as social distancing requirements are eased, remote collection of data for discovery purposes is here to stay as it saves on travel costs and we’re seeing more sources of data move to “the cloud”. Consult your forensic collection consultant on the best method to handle your collection, based on where and how your data is stored.

For more information about Forensic Discovery’s Computer Forensics services, click here.