Avoid Overcollection of eDiscovery Data with 4 Best Practices

Explore the pros and cons of full disk imaging versus targeted collection techniques – and which one makes the most sense for your business

Too much information – can it ever be a bad thing? There are two schools of thought when it comes to full disk imaging. The first is that collecting every piece of information from the onset ultimately ends up being less costly and time-consuming because there will never be a need to go back and redo work. The second viewpoint argues that a large corpus of data requires communication between councils and many levels of culling such as specific search terms and date parameters, which must be evaluated and sorted by professionals to help whittle it down. This is a costly proposition that could be avoided if a more specific set of data was collected in the beginning.

Is one method better than another? The short answer is that it depends on the circumstances.

#1 Consider Costs Carefully

The biggest disadvantage to full disk imaging is time. Imaging the whole PC as opposed to collecting specific file types is a cumbersome project and, no matter what, you’ll be left with an abundance of irrelevant data that doesn’t pertain to the case – even post deNIST. Either the forensic team or council will need to determine specific search terms, file types, and other culling specs in order to weed out the useable information.

However, some changes in the industry have spurred important considerations in regard to full disk imaging. While at one time the techs would charge a substantial hourly rate, now it’s more customary to charge a flat rate per source (i.e., laptop or desktop) – which makes full disk imaging cheaper than it used to be, and also significantly less expensive than revisiting the same collection site multiple times.

#2 Consider the Risks

For complicated cases like insider trading, or any other situation when data tampering is a real concern or situations where the scope of the investigation is likely to change and require more data, full disk imaging may be the most cost effective and least time consuming option. However, for most civil cases, too much data can be a hindrance. The best way to determine which path to choose is to evaluate case parameters, conduct pre-collection interviews and make a smart choice based on those outcomes.

#3 Target Imaging Based on Pre-Collection Interviews

Most cases begin with a pre-collection interview with the custodians in question including topics such as where data resides, what systems are used and relevant dates are all discussed. This interview allows the case team to know the landscape of where the data lives so that they can narrow their focus and find exactly what they’re looking for. These focused collections of data save time and money simply because they don’t require as much review. This is the method most often employed for smaller civil matters.

#4 Know the Limitations of Your Forensic Toolkit

Forensic tools are incredibly useful for data collection, preservation, filtering and deNISTing. However, unless the searching is restricted to date ranges or specific date metadata, these tools should not be used alone to run keyword searches.

Not all documents have extracted text, and therefore require OCR (optical character recognition) in order to create a reliable index. This process is crucial to accessing certain kinds of embedded data that may not be easily revealed by forensic tools. While some companies claim that their forensic software is up to the task of searching, in reality they are not able to execute a reliable and defensible work flow to search post collection and processing the same way eDiscovery software can.

Conclusion

There is no one-size-fits-all solution when it comes to deciding whether to choose full disk imaging or a targeted collection. In practice, law firms should literally look at their options on a case-by-case basis. The more you know in advance, the less work you need to do down the road.

When in doubt, industry professionals with many years of experience err on the side of caution and lean towards collecting more data so that there’s no chance of missing pertinent documents. However, full disk imaging is a specific method that should only be applied in scenarios when a large amount of data will be necessary to properly build the case.

Learn more about ONE Discovery’s unified eDiscovery solutions for cases both large and small here.