eDiscovery Daily Blog

November 12, 2024 – Hosted by King and Spalding

The Masters Conference’s final event for 2024 brought together legal, forensic, and information governance experts to discuss the evolving challenges in eDiscovery and data management. Hosted by King and Spalding in Atlanta, the conference featured engaging sessions that provided actionable insights for legal professionals and investigators navigating the complexities of modern data ecosystems.

Session 1: Mobile Device Forensic Collections: Remote and Lab-Based Collection Strategies

Sponsored by Cellebrite

Panelists:

• Mike Amaral (Cellebrite) – Manager, Strategic Accounts
• Jordan McQuown (IST Management – CIO and CISO)
• Jerry Bui (Right Forensics – Owner and CEO)
• Jeff Hedlesky (Cellebrite) – Sales Engineer – Enterprise Solutions

This session delved into the intricacies of mobile device forensic collections, contrasting remote and lab-based strategies. As mobile devices increasingly become central to eDiscovery, understanding how to effectively collect data—whether through remote technology or in controlled lab settings—has become essential.

Key Takeaways:

• Diverse Forensic Approaches: The panel detailed unique strategies for collecting data from iOS and Android devices, highlighting the significant technical differences between the platforms. While iOS presents controlled challenges due to its closed ecosystem, Android allows more flexibility but requires robust methods for data integrity.
• Remote Collection Techniques: Amaral emphasized practical remote collection solutions, including obtaining iTunes backups or using self-service collection kits shipped to custodians. However, these solutions come with risks. Amaral and Hedlesky noted that while iTunes backups contain valuable WhatsApp data, they are not considered forensically sound, posing potential integrity issues.
• Lab-Based Collections: For comprehensive data extraction, lab-based methods were preferred. They provide access to locked or encrypted devices and offer more reliable data retrieval, including deleted files. Bui highlighted that lab settings ensure that if data retrieval needs to be revisited, the entire data set is still accessible, minimizing disruption to ongoing investigations.
• BYOD and Privacy Challenges: McQuown and Bui emphasized the complexity of managing data from bring-your-own-device (BYOD) environments, where personal and corporate data overlap. Privacy concerns require forensic teams to limit collections to court-ordered data only, fostering trust in both the legal team and custodians.
• Navigating Privacy Laws: Amaral outlined new state-level privacy laws passed in 20 states, including California, Virginia, and Colorado, which aim to regulate business use of consumer data. These laws impact how mobile data is managed, collected, and preserved, emphasizing compliance and consumer rights.

Highlighted Challenges and Solutions:

• Remote Workforce Impact: With more employees working remotely, the panel discussed corporate-issued devices versus BYOD policies. Amaral pointed out a growing divergence in collection approaches between law enforcement (seeking full collections) and private sector practices (favoring targeted collections).
• Management of Mobile Device Management (MDM): MDM policies can complicate data collection, potentially requiring cooperation with corporate infosec teams to bypass or adjust settings without triggering security protocols like device resets.

Session 2: Linked Files – The Saga Continues

Panelists:

• Bradley Koehler (Alvarez & Marsel) – Sr. Director
• Lionel Joiner (Redgrave) – eDiscovery Specialist & Attorney
• Nirav Shah (The Home Depot) – eDiscovery Counsel
• Ray Payne (Cox Communications) – Director of eDiscovery Technology Services

Linked files, which point to documents stored in cloud-based systems like Google Drive, Dropbox, and Slack, continue to present significant challenges in eDiscovery. This session explored recent developments, legal precedents, and strategic considerations for managing these data types.

Key Insights:

• Definition and Context: Koehler began by defining linked files as paths or URLs in documents that point to other files stored on various platforms. These links are increasingly common as collaboration tools become integral to workplace operations.
• Collection Capabilities: Shah highlighted the improvements in Office 365 and Google Drive, which now include capabilities for linked file collection, making data retrieval easier. However, gaps still remain, particularly in maintaining the parent-child relationships of linked documents.
• Case Law and Compliance: Joiner discussed how courts are assessing the burden of producing linked files, emphasizing that reasonable efforts to collect this data must be made, though technology and best practices are still evolving. Shah noted that in a recent case involving Uber, the court moved closer to treating linked files like traditional attachments, signaling a shift in judicial expectations.
• Practical Considerations: The panel advised that early-stage discovery should focus on custodian interviews and understanding the landscape of collaborative tools used. This approach helps establish where data is stored and what data can feasibly be collected and preserved. Payne stressed the importance of coordinating with IT departments, as these processes often extend beyond their typical duties.

Challenges and Future Outlook:

• Metadata Concerns: Discrepancies in metadata between linked files and their parent documents were flagged as potential landmines during production.
• GDPR Implications: Payne warned that linked files stored overseas might trigger privacy compliance issues, especially under GDPR regulations.

Session 3: From Preservation to Collection: Managing Change in Complex Data Ecosystems

Panelists:

• Lindsay Brady (King and Spalding) – Staff Attorney
• John Buzbee (King and Spalding) – Staff Attorney
• Adam Wall (King and Spalding) – Staff Attorney
• Scott Lucas (King and Spalding) – Staff Attorney

This session focused on the challenges of managing data in complex and evolving ecosystems. Topics included ephemeral messaging, data migration, and the proactive identification of emerging data sources.

Key Points:

• Custodian Interviews as a Foundation: Wall highlighted the critical role of thorough custodian interviews in identifying data sources and communication channels. These interviews inform the data collection process, streamline scope, and ensure that legal teams capture relevant information effectively.
• Collaborative Tools and Their Impact: Brady underscored the importance of understanding how linked files and collaborative tools impact eDiscovery workflows. The widespread use of platforms like Slack and Teams adds layers of complexity to data identification and preservation.
• Ephemeral Messaging Challenges: Buzbee discussed the increasing use of secure messaging apps like WhatsApp and Signal, noting that their automatic deletion features create significant hurdles for legal preservation. Lucas recommended developing written policies and conducting employee training to address these issues proactively.

Strategic Recommendations:

• Proactive Data Management: The panel advised that corporations standardize on a few collaboration platforms to simplify data management, especially during mergers and acquisitions.
• Preserving Linked Files: Taking “snapshots” of data at the time of a litigation hold can help maintain document versions as they were during the relevant period.
• Emerging Data Sources: As storage capacities expand and data moves to cloud storage solutions, keeping pace with technology and understanding its implications for eDiscovery remains essential.

Audience Engagement:

• Question from Rick Clark (CloudNine): Addressing the potential discovery of unreported apps during custodian interviews, Lucas recommended revisiting custodians to clarify the use of these apps and adjust the data collection strategy as necessary.

The Masters Conference Atlanta 2025 closed on a high note, reinforcing the importance of adapting to the changing landscape of data discovery. From mobile forensic strategies to linked file challenges and the proactive management of complex data ecosystems, the event equipped professionals with the knowledge to face the future of eDiscovery with confidence.