Improving e-Discovery in Global Enterprises Through Remote Data Collection

While the document review aspect of the discovery process generally receives the majority of attention because of the expense and time involved, the collection of potentially responsive electronically stored information (ESI) can also represent a major expense and logistical challenge.

Employees are becoming increasingly untethered from their offices through laptops, smartphones, tablets and other portable devices. Collecting ESI can be even more complicated for organizations that operate in multiple locations. In fact, ESI collection for global enterprises can present additional logistical and legal challenges related to the international dimension.

Traditionally, collections require an on-site examiner to have physical access to the target device containing the ESI. During the collection process, the user is unable to use the device. Additionally, the examiner can only collect ESI from one device at a time. This approach often requires extensive planning, including working with the company IT team, coordinating with the security staff, scheduling the custodian to hand over the device, and ultimately transferring the forensic images from multiple sites to the processing lab.

Fortunately, the use of remote forensic collection technology can often represent a valuable alternative, allowing cost savings while also minimizing business disruption. Although not feasible in every situation, remote collection can be a valuable tool in the discovery strategy.

Advantages to Remote Collection

Remote collection offers several benefits over the traditional method, including the following.

Quicker Response

Rapid deployment is one of main advantages of remote collection. Once the software component is in place and the computers, devices or systems have been identified, the collection can begin immediately. This aspect is particular relevant for ESI collection in global enterprises, especially for companies that operate in remote locations or countries that require special authorization to visit/conduct business.

Business Continuity

Collection of individual devices, enterprise-wide systems, or software applications can be time consuming and cause business disruption. With remote collection, users do not need to give up possession of their devices, and servers and applications need not be taken offline during the collection.

Simultaneous Collections

With the right experience and software, the collection team can remotely conduct numerous ESI collections simultaneously. This can result in a significant cost reduction and strategic advantage when compared with traditional collections.

Invisibility

Deliberate spoliation can be a serious challenge in a litigations or investigation. The presence of an on-site examiner can alert users and increase the risk of ESI spoliation. Remote collections can be done with no visibility to the user, minimizing the chance to incur obstructive activities.

Recurring Collections

Data repositories are often collected multiple times over the length of the litigation or investigation. Once the software is in place, a remote approach can provide exponential cost reduction over time, as each collection can be rerun at any point. The savings are even more pronounced when considering global enterprises for which traditional collections require considerable international travel time and costs.

Consistency

When traditional collections are performed in different countries and by multiple examiners, it can be difficult to ensure consistency in the collection processes such as imaging naming conventions. On the other hand, one single examiner or team can remotely perform all global collections related to a specific investigation from one single site.

A Single-Data Repository

The traditional approach generally involves multiple storage hard drives with potentially higher costs and tracking challenges. In an international context, hand-delivering the storage drives may not be an option, and international shipments can be risky and costly. Conversely, the remote approach allows the collection of all ESI into a single storage point.

Minimized Privacy Issues

In litigations that cross international borders, a remote approach can also help to alleviate privacy concerns. A remote collection typically only targets selective ESI (i.e. only specific file categories) rather than the entire repository. This can be important in jurisdictions such as the European Union, where over-collection becomes not only a cost concern, but also exposes the company to additional legal issues.

Challenges with Remote Collections

Remote collections may not represent a viable solution for every organization in every situation. There are many challenges to remote collections.

One of the most important differences between traditional and remote collection is the scope. In a traditional collection, the repository is copied bit by bit into a physical image, including active files, unallocated and unpartitioned space. A remote collection generally creates a logical forensic image that includes targeted files, but does not include unallocated and unpartitioned space. When advanced forensic analysis is required (such as data carving and deleted files recovery), physical bit by bit images are necessary. Therefore, the e-discovery support team and legal team should carefully consider whether targeted logical forensic images suffice for the scope of the investigation or litigation.

Additionally, the software and hardware necessary for remote collections can require a substantial investment in their purchase, installation and maintenance. Remote collection solutions can be advantageous for large corporations with numerous and geographically dispersed users, but they may not be economically practical for smaller entities. In any case, organizations interested in adopting a remote forensic approach should work closely with industry experts to identify the right software, platforms and procedures for their own specific e-discovery needs.

Network limitations are a challenge as well. During a remote collection, the device needs to be running and connected to the network in order to remotely copy the ESI. Therefore, network speed and reliability have an impact on how quickly the ESI can be collected. Additionally, coordination with the company IT team is essential in order to configure firewalls and allow the connection between the remote collection software and the target ESI source. This aspect may be challenging when it involves fragmented IT teams.

Conclusion

Whether the standard approach or the remote solution is chosen, it is crucial for the legal team to be synchronized with the IT staff. In fact, while the legal team is generally focused on responsiveness and thoroughness of the collection, the IT team might have security and technical concerns. Data collection may be perceived by security professionals as intrusive and somewhat conflicting with the fundamental IT principles of confidentiality, integrity and availability. Therefore, a strong coordination between the legal and the IT team is essential to address any potential internal divergences and facilitate the discovery and collection efforts.

As with any technological investment, the adoption of a forensic remote collection solution presents economical risks and should be carefully considered. In addition to the technical and monetary aspects, legal requirements play a key role in determining the feasibility of the approach. Nevertheless, the use of remote forensic collection technology can present valuable advantages over the traditional collection method. Due to their international dimension, global enterprises have the potential to take advantage of the benefits of the remote approach.

This article contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional adviser. Deloitte shall not be responsible for any loss sustained by any person who relies on this publication.

Marco Ore is a manager in the Deloitte FAS ' Discovery practice. He has experience advising Fortune 500 clients facing complex litigations, and specializes in developing and executing digital forensic and eDiscovery solutions. Mr. Ore is a Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Fraud Examiner (CFE), EnCase Certified Examiner (EnCE), and Clearwell Certified Administrator (CCA).

While the document review aspect of the discovery process generally receives the majority of attention because of the expense and time involved, the collection of potentially responsive electronically stored information (ESI) can also represent a major expense and logistical challenge.

Employees are becoming increasingly untethered from their offices through laptops, smartphones, tablets and other portable devices. Collecting ESI can be even more complicated for organizations that operate in multiple locations. In fact, ESI collection for global enterprises can present additional logistical and legal challenges related to the international dimension.

Traditionally, collections require an on-site examiner to have physical access to the target device containing the ESI. During the collection process, the user is unable to use the device. Additionally, the examiner can only collect ESI from one device at a time. This approach often requires extensive planning, including working with the company IT team, coordinating with the security staff, scheduling the custodian to hand over the device, and ultimately transferring the forensic images from multiple sites to the processing lab.

Fortunately, the use of remote forensic collection technology can often represent a valuable alternative, allowing cost savings while also minimizing business disruption. Although not feasible in every situation, remote collection can be a valuable tool in the discovery strategy.

Advantages to Remote Collection

Remote collection offers several benefits over the traditional method, including the following.

Quicker Response

Rapid deployment is one of main advantages of remote collection. Once the software component is in place and the computers, devices or systems have been identified, the collection can begin immediately. This aspect is particular relevant for ESI collection in global enterprises, especially for companies that operate in remote locations or countries that require special authorization to visit/conduct business.

Business Continuity

Collection of individual devices, enterprise-wide systems, or software applications can be time consuming and cause business disruption. With remote collection, users do not need to give up possession of their devices, and servers and applications need not be taken offline during the collection.

Simultaneous Collections

With the right experience and software, the collection team can remotely conduct numerous ESI collections simultaneously. This can result in a significant cost reduction and strategic advantage when compared with traditional collections.

Invisibility

Deliberate spoliation can be a serious challenge in a litigations or investigation. The presence of an on-site examiner can alert users and increase the risk of ESI spoliation. Remote collections can be done with no visibility to the user, minimizing the chance to incur obstructive activities.

Recurring Collections

Data repositories are often collected multiple times over the length of the litigation or investigation. Once the software is in place, a remote approach can provide exponential cost reduction over time, as each collection can be rerun at any point. The savings are even more pronounced when considering global enterprises for which traditional collections require considerable international travel time and costs.

Consistency

When traditional collections are performed in different countries and by multiple examiners, it can be difficult to ensure consistency in the collection processes such as imaging naming conventions. On the other hand, one single examiner or team can remotely perform all global collections related to a specific investigation from one single site.

A Single-Data Repository

The traditional approach generally involves multiple storage hard drives with potentially higher costs and tracking challenges. In an international context, hand-delivering the storage drives may not be an option, and international shipments can be risky and costly. Conversely, the remote approach allows the collection of all ESI into a single storage point.

Minimized Privacy Issues

In litigations that cross international borders, a remote approach can also help to alleviate privacy concerns. A remote collection typically only targets selective ESI (i.e. only specific file categories) rather than the entire repository. This can be important in jurisdictions such as the European Union, where over-collection becomes not only a cost concern, but also exposes the company to additional legal issues.

Challenges with Remote Collections

Remote collections may not represent a viable solution for every organization in every situation. There are many challenges to remote collections.

One of the most important differences between traditional and remote collection is the scope. In a traditional collection, the repository is copied bit by bit into a physical image, including active files, unallocated and unpartitioned space. A remote collection generally creates a logical forensic image that includes targeted files, but does not include unallocated and unpartitioned space. When advanced forensic analysis is required (such as data carving and deleted files recovery), physical bit by bit images are necessary. Therefore, the e-discovery support team and legal team should carefully consider whether targeted logical forensic images suffice for the scope of the investigation or litigation.

Additionally, the software and hardware necessary for remote collections can require a substantial investment in their purchase, installation and maintenance. Remote collection solutions can be advantageous for large corporations with numerous and geographically dispersed users, but they may not be economically practical for smaller entities. In any case, organizations interested in adopting a remote forensic approach should work closely with industry experts to identify the right software, platforms and procedures for their own specific e-discovery needs.

Network limitations are a challenge as well. During a remote collection, the device needs to be running and connected to the network in order to remotely copy the ESI. Therefore, network speed and reliability have an impact on how quickly the ESI can be collected. Additionally, coordination with the company IT team is essential in order to configure firewalls and allow the connection between the remote collection software and the target ESI source. This aspect may be challenging when it involves fragmented IT teams.

Conclusion

Whether the standard approach or the remote solution is chosen, it is crucial for the legal team to be synchronized with the IT staff. In fact, while the legal team is generally focused on responsiveness and thoroughness of the collection, the IT team might have security and technical concerns. Data collection may be perceived by security professionals as intrusive and somewhat conflicting with the fundamental IT principles of confidentiality, integrity and availability. Therefore, a strong coordination between the legal and the IT team is essential to address any potential internal divergences and facilitate the discovery and collection efforts.

As with any technological investment, the adoption of a forensic remote collection solution presents economical risks and should be carefully considered. In addition to the technical and monetary aspects, legal requirements play a key role in determining the feasibility of the approach. Nevertheless, the use of remote forensic collection technology can present valuable advantages over the traditional collection method. Due to their international dimension, global enterprises have the potential to take advantage of the benefits of the remote approach.

This article contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional adviser. Deloitte shall not be responsible for any loss sustained by any person who relies on this publication.

Marco Ore is a manager in the Deloitte FAS ' Discovery practice. He has experience advising Fortune 500 clients facing complex litigations, and specializes in developing and executing digital forensic and eDiscovery solutions. Mr. Ore is a Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Fraud Examiner (CFE), EnCase Certified Examiner (EnCE), and Clearwell Certified Administrator (CCA).