Collection

Planning

Based on the results of the Identification phase, adequate planning of the search strategy is a major key to overall effectiveness in the collection effort. The first question that should be asked is where is the data. A good strategy is to work from a topology of the network and then create a map of the types of data, the locations and the custodians. Search terms, phrases and concepts need to be documented at the outset, along with a list of key company events and timeframes, as well as custodians of interest and relevance.

It is imperative the all knowledgeable persons are included in the planning process. The IT and legal staffs of an organization should be integral to this process. The IT staff will be the best source of information regarding the location and systems used to house data. The IT staff will also be invaluable in all technical aspects of the data collection effort. It is also imperative that the legal department be consulted as ultimately they will have to vouch to the court regarding the completeness and integrity of the data collected.

More Categories

Planning

Based on the results of the Identification phase, adequate planning of the search strategy is a major key to overall effectiveness in the collection effort.

Security

At the outset of a collection effort, appropriate steps must be taken to preserve the content of the electronically stored information (ESI) and its metadata.

Scope of Collection

Understanding the scope of data that is available is critical to executing a series of searches spanning all available sources of evidence.

Completeness of Collection

Understanding the type of data identified is important in to determine the kinds of searches to use to collect data in a complete manner.

Accuracy of Collection

Due to the nature of the complex systems in use in most companies today, files typically undergo numerous transformations throughout their lifecycle.

Scalability

Scalability of the collection mechanisms is paramount.

Auditability

Regardless of the collection method employed, strict chain of custody records must be maintained for all documents, data, and objects collected so that their authenticity can be assured.