Remote Collection What, When & Why

What is Remote Collection? A collection using a remote system that is integrated with company data sources allowing for ESI to be collected remotely. Anytime the collector is not in the same physical location as the data being collected. May or may not require direct interaction Used for targeted or complete collections Cost effective, efficient, & defensible

Possible Scenarios Collection at multiple sites with multiple custodians Collection where client IT wants/needs to be part of the process Collection at remote sites or from remote individuals Collection is in the “cloud” Cross border issue?

What Do You Need? Review specific collection targets & strategy Identify data sources Location, System Type, Data Accessibility Confirm downstream use for collection Archival, Immediate use natively, ECA, Review Understand Timing & Costs Talk to the team, find out deadlines Discovery requests, investigations?

Determine Scope Identify custodians who currently or previously possess potentially relevant ESI Determine technical specifics surrounding the sources that house potentially relevant ESI Questionnaires  Interviews  Technical Surveys  Depositions Pretrial Conferences & Meet and Confer Custodian lists Priority of custodians Legal Hold & Preliminary questions at that time, who did you send the legal hold to?

Sources of Electronic Information Office Computers Mobile Devices* Home Computers Webmail Accounts External Hard Drives Social Networking Flash Drives & Memory Cards Cloud-Based Repositories CDs/DVDs Voice Mail Systems Backup Devices Shared Network Folders Structured Data*

Remote Collection Methods Remote connection with forensic engineer Email link to data custodian download agent for immediate one time use External hard drive to data custodian built in scripts for immediate one time use Centralized collection system utilizing distributed desktop agents

Benefits of Remote Collection Full disk or targeted imaging available with court defensibility Eliminated or minimized travel costs Flexible timing & scheduling with data custodian Eliminated or minimized management of onsite visitors and system account administration What do you need?