Preparing for an E-Discovery Search

Many people become puzzled when responding to an e-Discovery request.  Often times, a person will begin searching and not realize that some preparations should to be made prior to doing so.  To save time (and therefore money), it is a good idea to ask the following questions as soon as you get an e-Discovery request:

  • Can you narrow the scope of the search?
  • How should exceptions be handled?
  • How should the results be presented?
    • Should the result be deduplicated?
    • What format should the results be in?
    • What types of reports are needed?
  • Who is the key point-of-contact if anything needs to be clarified?

First, identify if you can narrow the scope of a search.  For instance, try to determine who is important in this search, what date range is relevant and what kinds of data should be targeted.  The more you can familiarize yourself with the search, the more helpful you will be to the requester.  Sometimes entire data stores need to be included, but often the scan can be limited to just specific areas.  Additionally, although email is the most common type of data store included for discovery, often files shares, SharePoint, backups and even end-users’ machines may be relevant.  If you clarify the scope ahead of time, you will save ample time skipping over unrelated data.

In an ideal world, every document in your data set will be searchable.  However, there are instances when data cannot be searched due to encryption or corruption.  For every item that cannot be searched in Discovery Attender, an exception is generated.  What should you do with these items?  With Discovery Attender, you have a variety of options to deal with exceptions.  First, you can generate a report that lists the items that threw an exception and the reasons why.  Second, you can export these items (where possible) and deliver an exception set in conjunction with the result set.  In some instances, you might even be able to ignore the exceptions.  To determine which option is best, be sure to ask the requester how he/she would like you to handle the exceptions.

Once the search is complete, you will have a result set which contains the items that meet your specified criteria.  There are many things you can do to organize and streamline your data set.  One popular option is deduplication.  Deduplication will create a single instance of each item in your result set.  For example, let’s say a message was emailed to three of the mailboxes in your search.  This will result in the same message appearing three times in your result set.  Deduplicating will leave a single instance of this item, while still keeping the links to the original three.  Deduplication will save a significant amount of time and money if the data set needs to be further reviewed.

In addition to determining whether you need to deduplicate your result set, you will also need to determine how to present the data to the e-Discovery requester.  This not only includes the file type of the export, but also the internal structure.  This can be accomplished in a variety of ways with Discovery Attender.  For instance, you can export the result set to a PST file or to flat files.  To build on this even further, you can also vary the formatting of the exported data.  For example, you can either merge your result set to a single PST file regardless of the source or you can generate a PST file per email store you searched.  You can also enforce a size limitation on the exported PST files such that it will rollover to a new one once that size has been reached.  Additionally, you can change the layout used in the internal structure of the exported PST file or change the naming convention used when exporting to flat files.

Often times, you will need to supplement the exported result set with certain reports.  Specifically, you may need to report on the search criteria, the number of hits found and so forth.  There are a variety of reporting capabilities available within Discovery Attender.  You can generate a summary report that gives a brief synopsis of the search that was performed, a duplicates report that provides a listing of each unique item and whether it had duplicates, a custom CSV report and include only specified data and much more.

As you can see, there is a lot you can do with the result set; should duplicates be eliminated, how the result set should be exported and what type of reporting should be generated are all questions that you should ask.  Make sure the e-Discovery requester knows the options available so they can provide you with accurate information.

The last thing you should determine when you receive an e-Discovery request is who the main point-of-contact is (if you should have any questions).  The majority of the time, this will be the e-Discovery requester.  However, there may be another person who will need to clarify questions about keywords, export format, search locations, or other topics regarding the search.  You should be in touch with this person throughout the e-Discovery process to help determine the best plan of attack should any further questions arise.

This is not meant to be an exhaustive list of questions, as there are likely many others that could be added.  Any detail you can get about the search ahead of time will help you better prepare for an e-Discovery search.  Having clear direction and good communication will make the task run much smoother, and therefore will help reduce time and stress during the e-Discovery process.

If you would like to learn more or to speak with a representative, contact Sherpa support.

Leave a Reply

Your email address will not be published. Required fields are marked *