Data can be received by an electronic discovery processing team in many forms — on various media or via electronic transmission of the data. Because electronic documents may be evidence, they must be authenticated before being admitted at trial, thereby making a meticulously documented chain of custody necessary. Upon receipt, electronic data must be tracked and managed on both a physical and a file level.
Once the electronic evidence is received, properly accounted for, and documented, it must be restored to a computer systems environment for processing. This process can be as simple as plugging a hard drive into a processing network, or copying the contents of a CD or DVD to a central location, or it can be an involved process such as tape restoration.
An important aspect to be aware of when dealing with electronic data is how the various processing options may affect the metadata of restored and/or moved or copied electronic data. Since electronic data can be in many forms and may be contaminated with viruses, it is important to isolate the source data before putting it onto an active network or processing platform until the viability of the data has been determined. Data is pulled off of tape exactly as it was stored on source media prior to being backed up to tape. Therefore, if a file was infected with a virus before being backed up to tape, the same virus will exist once restored from tape. Understanding how viruses are handled will inform the legal team as to the integrity of the metadata available and provided for review.






