1-877-764-0920 
In litigation cases, attorneys often turn over collection of ESI evidence to the custodians themselves and the level of management of that process can vary widely. Some attorneys provide specific instructions regarding the types of evidence that they want to be collected and they even provide specific search terms for the custodians to use when searching for responsive ESI. Other times, the attorney instructions may be quite vague where the custodians are ordered simply to locate any ESI responsive to the subject matter.
Even if the attorney provides specific instructions, there are several common mistakes that can be made when collecting ESI that can result in a loss of metadata and make it difficult to verify the authenticity of the data downstream. Here are three of the most common mistakes that legal professionals make in data collection:
Most of us have at some point gone to a workstation or network drive and copied files to another location or an external drive. It’s easy to “drag and drop” files to collect a copy of them, right? Sure, but doing so can result in the loss of key metadata and create confusion in the copied version of the files.
Try this out. Click on any file in a folder in Windows, hold down the Ctrl key and drag it to another folder to make a copy of it. Then, right click on the file in the new folder and select Properties. Notice anything unusual? Look at the Created and Modified dates – the Created date and time will be later than the Modified date and time! Why? Because the Created date reflects the date the copy was made.
Key metadata such as created date or folder information can be lost when using the file copy and paste method, so it’s not a recommended approach for data collection.
When many custodians collect from an email program like Outlook, they may be inclined to conduct the searches right within Outlook, even though Outlook’s searching capabilities are not near as robust as most eDiscovery software platforms. Even worse is what happens when the identified messages that are responsive are dragged and dropped out to a Windows folder as .MSG files. While the email may be an intact representation of the email as it exists within the mailbox, the folder information is not included, which can be important.
Imagine if the email messages came from a folder called “Top Secret” or “Accounting Irregularities”. You’d never know when reviewing the collected messages.
Mobile devices make it super easy to capture what’s on the screen – with a push of a couple of buttons, you can capture any screen display at any time. But the screen capture method for mobile devices is not a preferred method for capturing evidence from a mobile device – or any device for that matter, as screen captures fail to capture key metadata that may be important to your case.
For example, your iPhone or Android device will capture the date and time of when a picture is taken and (unless it’s turned off), the location too. Imagine losing that information for pictures taken at an accident scene – you’ve lost the ability to demonstrate exactly when and where the accident happened if you capture a copy of the photo with a screen capture.
Screen captures of text messages are also inadequate and can be easily manipulated, as this case illustrates. Failing to capture important metadata from mobile device evidence could make or break your case.
It’s easy to make mistakes when collecting ESI, even if the attorney on the case is active in managing that collection, so you need to work with an eDiscovery expert and forensic collection specialist to ensure the collection is handled in a manner that preserves all important metadata and enables you to authenticate the evidence in court if needed. Making these mistakes and others during collection can negatively impact your entire case.
To schedule a free computer forensics consultation for your law firm or business, contact Forensic Discovery online or call us at 877-764-0920. Our certified computer forensics experts have helped thousands of clients throughout the country retrieve and preserve digital evidence from our offices in Arizona, California, Colorado, and Texas.
"*" indicates required fields
