Hello all,
It's been proposed to me to email the customer a Chain of Custody document, instructions on how to fill it out and to have them send the evidence to my lab for the imaging and analysis for long distance collections…I guess it depends on who is "collecting" the evidence on the customer side, for my purpose let's say a regular IT staff just shuts down the computer, takes the hard drive out and sends it to me…(Not interested in Live Analysis at this time). Does anybody operate this way? The cases will be civil and most likely Acceptable Use etc etc. Any reason to operate this way besides reducing travel costs and time?
We've taken this route a few times on collections for ediscovery purposes. We typically do not recommended self-collection of any kind for the obvious reasons (e.g. potential spoliation/lack of defensibility/employee tampering/etc.) but when we can't talk them out of it (usually because of cost reasons) we've done as you describe - send a CoC form along with explicit instructions for the collection.
Thank you for the reply, isth. Do you know if any of those cases made it to court and if so, were they negatively impacted because of the way the collection was done?
Thanks again.
I'm with a litigation support vendor and many of the matters do go to court. The possibility exists that self-collection can negatively impacted a case, but I don't have first hand experience of this happening with a client of mine that has chosen the self-collection route. (Of course just because it hasn't happened doesn't mean it can't)
Our primary clients are law firms and as such we leave decisions like this up to the attorneys. They are the most familiar with the legal side, aware of the likely hood that the collection being questioned or not, and should have the knowledge to make a decision in the best interest of their clients. Our approach as a consultant is to provide the pros/cons of each method and let them decide from there.
I have worked on several cases where they've allowed the IT personnel to do the collection and they have botched it one way or another requiring us to go back (and costing more in the long run)… forgetting to capture requested folders, not exporting the correct date range of emails, etc.
Here are a few random articles on the risks of self-collection for ESI purposes. Not sure if any of this helpful but figured i'd throw in my $.02.
http//
http//
http//
Thank you isth. Everything was very helpful.
I would agree with isth. We, frequently, have the clients ship evidence to us for examination and as long as the process is well documented, there shouldn't be a problem.
For everyone's protection, we provide a detailed description of how items are to be packed. Since we have had poorly packed items damaged or destroyed in shipment due to poor packing we offer to provide the appropriate packaging for shipment.
We don't recommend that the client remove media unless they are well equipped to do it and have the appropriate antistatic and other protection. If they do remove the media, they are instructed as to how to document the device from which it came and to photograph any "evidence" before shipping. This is to protect the client from accusations of deliberate destruction should the device be damaged in shipment.
For jobs where live imaging is required or the system simply to impractical to ship, we ship to their site a system configured with Remote Desktop and then use F-Response to image the systems over the network.
Also, I recommend that you use reliable, established shippers and that you request signature confirmation for all deliveries.
All of this having been said, I can say that in one instance, medis shipped via common carrier DID disappear, never to be recovered, and there was no backup. So, while it is rare, it does happen and if the evidence is critical, then I'd look for a different method.
Make sure you document everything you are doing. Specifically your request to do the collection yourself. Their declining that and requesting that you provide the instructions etc etc. If the conversation takes place on the phone, there is nothing wrong with sending out a follow up email summarizing the phone call.
While there will be times when you can not convince your client to let you do the collection (generally cost associated like others have said), YOU will be the one deposed as the Expert. You want to be able to convincingly answer the question of why you did not collect the data. IMHO, many attorneys/clients will make the decision to self-collect, but they are not the ones that are deposed on their actions - you are. If you are to give a report, I would mention in your report that based on a conversation with so and so, you forwarded instructions for collection, etc etc. Cover your self.
Remember
If it's not in writing, it did not happen
-=Art=-
We have had law enforcement clients who have confirmed via e-mail the processes they will use in shipping the hardware to use and we have agreed that. When the hardware arrives, the agreed processes have not been followed with PCs simply in cardbard boxes with a plastic seal inserted into fan vent.
It's imposible to turn the clock back and do it correctly, all you can do is nag the clientt to do it correctly next time and fully document what has happened. If the defence want to make an issue out of it, they have every right