A Best Practice Framework for Data Acquisition

1 Corporate Headquarters 595 Greenhaven Road Pawcatuck, CT 06379 US European Office London, United Kingdom P: F: A best Practice Framework for data Acquisition This document contains descriptions of proprietary processes and proprietary information prepared by The Oliver Group. Duplication or disclosure of the information contained herein is prohibited without the express written permission of The Oliver Group. The Oliver Group l 2 Electronic data and electronic evidence. Finding it, accessing it and collecting it can be a daunting process. As the role of electronic data becomes increasingly more critical to the litigation process, it s imperative to develop rigorous protocols and procedures for data Acquisition .

2 The Oliver Group has spent years defining, building and implementing a best practices approach to the Acquisition process. Based on international standards, direct experience and technical expertise, our proven Framework has helped us successfully manage engagements across multiple jurisdictions. At a high level, the data Acquisition process typically can be broken into three phases: Phase One: Planning The planning phase allows The Oliver Group to refine the engagement strategy to meet the specific needs of the company. Ideally the planning phase should begin with a kickoff meeting that defines and validates the overall approach, and ends with stakeholder signoff.

3 Without agreement and understanding among the stakeholders at the outset, the likelihood of errors, delays and increased cost rises. The kickoff meeting should, at a minimum; cover the following items: Initial rules-of-engagement Identification of project stakeholders High level goals and objectives Secure communication procedures Incident handling and escalation paths Status meeting schedule Initial documentation/information request list The assessment process Every organization varies in its organization, infrastructure, technical environment, and culture. As a result, the engagement must be tailored to meet the unique requirements of the situation to ensure the complete and accurate capture of the dataset.

4 The assessment process consists of: Administrative Discovery Technical Discovery data Acquisition Action Plan Step One Administrative Discovery Administrative discovery is all about understanding the root cause of the inquiry for information and the entities and people that may be involved. It is important to consider is who is the main driver of the process: internal legal departments, outside counsel or regulatory entities. How data is acquired and handled may vary depending on the nature of the inquiry, which may be as a result of: Government investigation Internal audit request/investigation or other sources Criminal or civil litigation This document contains descriptions of proprietary processes and proprietary information prepared by The Oliver Group.

5 Duplication or disclosure of the information contained herein is prohibited without the express written permission of The Oliver Group. The Oliver Group l 3 The final element of administrative discovery is getting a clear picture of organizational layout and the flow of information between departments and individuals. This provides a roadmap of where key players sit within the organization and what are the most appropriate places to look for key custodian data . All of these facets must be taken into consideration because they have a direct impact on the project and its ultimate deliverables. For example, choosing a forensic Acquisition approach instead of a non-forensic approach has significant impact on the entire electronic discovery process and the accessibility of certain data post- Acquisition .

6 Step Two: Technical Discovery An understanding of the client s specific technical environment is critical to determining the scope of collection, the necessary tools and resources required, and formation of an appropriate action plan. The Oliver Group works in concert with clients to acquire specific technical information spanning several key areas (see chart). This upfront process can be completed by the client s internal IT and compliance staff, however, The Oliver Group frequently works with corporate clients and law firms in an advisory capacity to: Develop a litigation readiness plan which evaluates these areas in advance of an event Assist with locating and accessing relevant data Generate the specific strategy and tactics of collection Provide technical oversight and guidance This document contains descriptions of proprietary processes and proprietary information prepared by The Oliver Group.

7 Duplication or disclosure of the information contained herein is prohibited without the express written permission of The Oliver Group. The Oliver Group l 4 Step Three: Collection Plan Upon assessment of all pertinent information, The Oliver Group, in conjunction with the client, develops a data Acquisition Action Plan which consists of the following aspects: This document contains descriptions of proprietary processes and proprietary information prepared by The Oliver Group. Duplication or disclosure of the information contained herein is prohibited without the express written permission of The Oliver Group. The Oliver Group l 5 Phase Two: Collection Phase Two encompasses the actual collection of electronic data and is structured entirely to address the findings and action plan agreed upon in Phase One.

8 A typical data Acquisition project may include: Locating data deemed relevant on local drives or networks Verification that all relevant files have been located Documentation of all harvested data Installation of data capture devices and confirmation of capture location Accessing relevant email and file server data Creation of separate archive files for both file server and email data Providing a final report of collected files During Acquisition , The Oliver Group preserves all data associated with the electronic file including: Naming conventions Path structure System level metadata (filename, create date, modify date, last access date, and original file location) File level metadata (internal fields storing information such as author, subject, summary, etc) Experts and Teams Due to the complexity of the data Acquisition process it s imperative to build the right Acquisition team and enhance it with individual experts as necessary.

9 data Acquisition teams typically will include a combination of senior level consultants and systems engineers with backgrounds in a variety of relevant fields: Computer forensics data collection Media restoration Electronic discovery processing Acquisition Tools Depending on the requirements of the project, a variety of Acquisition tools may be used to automate and support the collection effort. The Oliver Group has developed a proprietary set of tools to enhance industry standard tools. The Oliver Group s approach to acquiring data is in accordance with forensically sound practices , ensuring data integrity is maintained throughout the process. A combination of standard and proprietary applications is used to locate and collect client data along with the appropriate tools for managing the logistics of the project.

10 Acquisition Procedures The Oliver Group s benchmark methodology was developed through extensive work on large scale Acquisition projects. We ve developed a streamlined, efficient process to acquire massive amounts of data as well as the needle in a haystack variety. This capability can only be found among service providers who have deep technical expertise and real world experience with the electronic data discovery process. This document contains descriptions of proprietary processes and proprietary information prepared by The Oliver Group. Duplication or disclosure of the information contained herein is prohibited without the express written permission of The Oliver Group.