Custodian Interviews: Critical to Defensible eDiscovery in the Age of Modern Communications
By Rick Clark, VP of Strategic Partnerships and Marketing at CloudNine, and Melissa Weberman, Counsel and Head of eData at Arnold & Porter
In today’s evolving corporate data landscape, custodian interviews—early interviews of key employees who hold relevant electronically stored information (ESI) —remain a cornerstone for defensible discovery. Even with today’s advanced analytics and AI tools, a thorough custodian interview can provide a major advantage in saving costs and managing discovery risks. As the volume and variety of corporate communication methods evolve—ranging from traditional email to short-messaging apps like Slack, Microsoft Teams, WhatsApp, and Signal—attorneys should consider sharpening their custodian interview techniques to identify and preserve relevant ESI. The stakes are high: poor interview and collection strategies can result in spoliation, sanctions, and reputational damage.
Start With a Clear Purpose
Custodian interviews serve multiple critical purposes in litigation, including:
- Identify where relevant data lives, including on personal devices or unofficial “shadow IT” apps—i.e., any tool employees use for work without the company’s formal IT approval or retention controls (e.g., personal Dropbox, WhatsApp, or a private Slack workspace). This ensures no major source of evidence is overlooked early on.
- Help preserve data and avoid spoliation, because by learning what data exists and where, counsel can promptly preserve it (for example, by issuing legal holds or suspending auto-deletion on systems). Failure to identify a source through interviews could result in data loss. For example, if a custodian uses an ephemeral messaging app, interviewing them quickly allows you to halt any auto-delete settings before relevant messages disappear.
- Scope and focus the discovery effort, as a well-run interview arms you with information to negotiate a reasonable scope of discovery with the opposing side. You can learn which data is truly important—and what can be safely excluded—making discovery more proportional to the needs of the case. This can reduce unnecessary review of irrelevant data, saving time and money.
- Uncover key facts and terminology, because speaking to custodians often reveals context that is not obvious from documents alone. They can explain project code names, acronyms, or unique jargon that they use, and critical date ranges and players. Knowing these details guides you in formulating better search terms or using analytics (e.g., recognizing a code word in emails that filters irrelevant documents). In turn, this improves the efficiency of downstream review and helps you spot important evidence faster.
- Demonstrate a defensible process, as courts expect counsel to make a good-faith, thorough effort to find relevant ESI. By conducting and documenting these interviews, you can later show the court (or opposing counsel) that you took reasonable steps to identify and preserve all relevant information. This record becomes vital if there are ever challenges to your discovery process or accusations of missing data.
Being intentional can ensure the interview is productive and minimizes missed evidence. Before the interview, review the custodian’s role, potential data sources, and communication tools. Consider preparing a case-specific checklist or interview template—do not rely on a static form—to ensure you are properly prepared for the specific nature of the case and the client’s business processes.
Customize Based on Your Role
Successful custodian interviews and defensible collections require strong collaboration among in-house counsel, outside counsel, and service providers. In-house counsel aligns the interview process with the company’s internal policies, reassures employees, and facilitates access to systems. Outside counsel, meanwhile, brings an external perspective that shapes strategy, ensuring that questions are thorough and appropriately scoped, and keeping the process defensible. Service providers deliver the technology for efficient and secure data collection, processing, and hosting for review. They offer tools for real-time collection, develop secure workflows for managing diverse data sources, and generate detailed documentation that may prove critical if collection practices are later challenged in litigation. When all three groups—internal legal teams, external attorneys, and technology partners—work together seamlessly, the result is a defensible, efficient, and transparent discovery process that stands up to scrutiny and reduces risk.
Build Trust with the Custodian
Custodians are more likely to share relevant information if they understand that interviews are standard procedure and not indicative of wrongdoing (but it is important they understand that the interviewer represents the company, not the individual custodian). Establish rapport by:
- Clearly explaining the purpose of the interview.
- Reassuring them that the process is routine—not an accusation.
- Emphasizing that the custodian’s cooperation protects the company and themselves.
- Collaborating with in-house counsel to act as a bridge and underscore legitimacy.
Gaining custodian buy-in can increase cooperation and the quality of disclosures. Further, building trust early can pay dividends later when collections need to be supplemented or deposition preparation begins.
Modern Communications: Ask the Right Questions
Today’s employees communicate through a mix of chat apps, collaboration tools, mobile devices, and cloud platforms. Consider asking specifically about:
- Chat applications (e.g., SMS, Slack, Teams, or WhatsApp) and whether relevant. messages sit in private channels or DMs.
- Collaboration hubs (e.g., Confluence, SharePoint, or Google Drive).
- Personal devices or accounts used for work.
- Any unsanctioned “side” apps or cloud storage.
Be prepared for reluctance or lack of awareness or recollection. Use visuals or demos to jog memories.
Coordinate With IT and Records Personnel
It is often useful to speak with IT personnel who understand the company’s systems. They can provide a high-level view of standard data sources, retention policies, and system locations. However, always verify those details with the custodian’s actual practice. For example, IT might report that “all email is on the server, none is stored locally,” but an interview reveals the employee saved archives on a local drive contrary to policy. Similarly, a policy might say employees should not use USB drives or personal devices, yet a custodian may admit they routinely did so. Use the IT interview as a starting point, then confirm details with each custodian to help avoid blind spots.
Leverage Real-Time Collection and Screen Sharing
Where appropriate, use technology that enables real-time review and preservation of data. Screen sharing or live data exports during the interview can:
- Validate custodian responses in real time.
- Capture volatile or short-lived communications before they expire.
- Prevent spoliation by reducing the lag between identification and preservation.
Tools that allow screen sharing, cloud sync capture, or mobile device previewing are particularly effective.
Document the Interview Meticulously
Consider taking the following contemporaneous notes:
- Custodian identifiers and role: Record the custodian’s full name, title/department, and location, along with a brief description of his role in the matter. This provides context for his data and helps show you identified relevant custodians in good faith.
- Interview logistics: Note the date of the interview, method (in-person/remote), and who conducted it. Consistency here supports defensibility, showing interviews were done timely (typically soon after the legal hold) and by appropriate personnel.
- Legal hold notice: Document that the custodian confirmed receiving the litigation hold notice and acknowledged his preservation obligations.
- Data sources identified: List every source of potentially relevant information the custodian uses, including:
- Devices: Work and personal devices (computers, phones, tablets, external drives).
- Email accounts: Work email (Exchange/Office 365, etc.) and any personal or secondary accounts used for work.
- Network locations: Shared drives, department file servers, databases, and cloud repositories (SharePoint, Google Drive, etc.).
- Business applications: Relevant enterprise systems (CRM, HR systems, finance databases) that the custodian accesses.
- Communications and collaboration channels: Document chat or messaging apps (Microsoft Teams, Slack, WhatsApp, SMS/iMessage, etc.), social media or direct messages if used for business, and any ephemeral messaging platforms. Note if relevant content exists and how it’s preserved. If the custodian uses apps with auto-delete or self-destruct features (e.g. Snapchat, Confide, Wickr), record this and any preservation steps taken (such as disabling auto-delete or instructing the person to save screenshots).
- Retention policies and auto-delete settings: Capture any information about data retention or deletion that could affect the custodian’s ESI. For example, ask if the custodian’s emails auto-delete after 90 days, if chat histories are retained, or if device data is routinely wiped. Document what you learn and any preservation steps taken. If the custodian had been manually deleting relevant data, note that and instruct (and document) that such deletions cease.
- Custodian’s actions: Document any actions the custodian has already taken regarding his data, and record if he mentions any data loss or issues.
- Follow-up steps and outstanding items: At the end of the interview, list any follow-up actions needed and track them. This might include scheduling a forensic collection of the custodian’s device, reaching out to IT about a newly identified server, or interviewing an additional person the custodian identified. Clearly document what will be done, by whom, and when. Maintaining this as part of the interview record ensures nothing falls through the cracks and evidences a continuing, diligent effort.
- Additional custodians or data sources named: A good interview often identifies other people or systems that might have relevant data. Document any new custodians, departments, or repositories the interviewee mentions. This guides your next steps and creates a record that you are expanding the preservation scope appropriately.
By following the above checklist, legal teams can create a defensible paper trail of their custodian interviews. In the event of a discovery dispute or motion, your team’s diligent documentation—complete with who, what, when, and how you addressed custodian data—can serve as strong evidence of your good faith and compliance with eDiscovery obligations. This not only helps in court but also keeps internal eDiscovery projects on track by tracking what has been done and what remains outstanding at each stage.
Best Practices Recap
- Start early.
- Use a standardized interview form but tailor questions case-by-case.
- Keep the tone transparent and cooperative.
- Involve IT and cross-check what policies say versus real-world practice.
- Document interviews, tools used, and preservation efforts meticulously.
Custodian interviews are more than an information-gathering step—they are a strategic moment to protect your client and ensure discovery obligations are met. By combining interview best practices with modern collection technology, legal teams can build a defensible foundation for any case.
