eDiscovery
The Disclosure Pilot Workflow
CYFOR has developed a best practice workflow for document preservation, collection, review and production for Initial Disclosure under the Pilot Scheme.
The Disclosure Pilot Workflow
Data Preservation
As soon as it’s been established where the key documents are stored, it is strongly recommended to keep them in a secure location and backed up until a full forensic collection can take place.
- Once the sources of Electronically Stored Information (ESI) have been identified, we always recommend to turn off all devices and place in a secure location.
- In order to complete a forensically sound collection, CYFOR will make Forensic Images (exact copies) of devices and emails accounts to collect them in their entirety.
Data Collection
The collection of data is recommended as early as possible to preserve all files and their associated metadata in a forensically sound manner. This can be accomplished either remotely or onsite.
For server data, unless it’s required to collect all data, CYFOR will make a logical extraction of relevant sections of the server.
- CYFOR will make forensic collections of data
- Secure FTP link: CYFOR can provide a link to upload sources of ESI or, if provided the appropriate credentials, we can log in and make a download of ESI.
- Remote Download: If ESI such as emails and server data is in the cloud, our investigations team can make the collection of the data remotely once we are provided the appropriate credentials.
- (Onsite forensic collections are available)
Data Processing
Processing is an essential part of the workflow to ensure that all data converts into structured searchable text. CYFOR then filters through the data by; de-duplication, file type filtering, applying a date range and a list of keywords.
This time is available for CYFOR project managers to complete chargeable work such as additional searches, customising the workspace and providing consultancy.
- CYFOR will upload data onto a Relativity workspace.
- Early Case Assessment (ECA)
- Once the data is available and before the hosting is activated, CYFOR will commence the filtering of data, if required. This time can be used to provide keywords and search term reports to assist in identifying Keywords for the Disclosure Review Document (DRD).
Analysis
By using the powerful analytical features of Relativity, the identification of relevant documents can be significantly increased. Sophisticated software techniques such as Email Threading, Clustering and Active Learning. All of which are powered by Artificial Intelligence.
- Analytical features such as Technology Assisted Review, Email Threading and Clustering are set up during this stage to help minimise the data set, organise and prioritise documents and accelerate review.
Review
Now that the volume of data has decreased, the proportion of relevant documents have subsequently increased. The review can be completed in a linear document by document review. Alternatively, further search terms can be applied to jump straight to key documents of interest.
- Hosting: Once access to the documents is required, CYFOR will host the data for the initial disclosure
Production
When key documents have been identified, CYFOR’s technical professionals export the relevant files, ensuring Redactions (if applied) are fully implemented.
Onsite Collection: If required, we will attend a UK location to forensically collect data.
- If required, CYFOR will create a production of the documents for CCMC or disclosure.