Please enjoy this blog post from Candi Smith, Sr. Legal Technology & eDiscovery Specialist, Jabil Corporation.
I was asked by ILTA to write a blog regarding the collection of data from collaboration tools, excluding Microsoft Teams and Slack. I stopped to think, not Microsoft Teams or Slack? Dude, what other collaboration tools are out there these days? Obviously, I only use Microsoft Teams and Slack. So, to find out what other collaboration tools existed, I did what most of us would do, I googled it! I found a site that listed 15 collaboration tools. Really, 15? After a quick glance, I only recognized Google docs and Trello. My mind started reminiscing about my days working law firms when these types of different tools came up frequently. After snapping out of what seemed like one of those flashback scenes in a sitcom, I thought wowza! Who should I contact to find out how to collect data from these collaboration tools? Luckily, I recalled several eDiscovery partners which many conversations have been had in the past.
I asked three partners to look at this list of 15 collaboration tools and share their insight on how one would tackle a data collection. Below are some of their suggestions.
Elevate - Pamela Ringer-Britz
Description: Google Docs is an online word processor that lets you create and format documents and work with other people.
Notes: Similar to SharePoint.
Collection requirements: Access to the user(s) Google account associated with documents.
Description: Discord is a VoIP, instant messaging, and digital distribution platform. Users communicate with voice calls, video calls, text messaging, media and files in private chats or as part of communities called "servers". Servers are a collection of persistent chat rooms and voice chat channels.
Notes: Similar to Slack.
Collection requirements: Access to the account associated with the server(s).
Generally, for all collections efforts, an interview with the custodian should occur to identify the relevant materials and confirm the intended collections requirements. There are many instances where targeted collections after an interview are readily apparent, reducing burden of collection efforts, and mitigating costs. A common gripe in industry is an abundance of data volume and hosting costs due to lack of limiting the scope early on.
Introduction of a forensic collection resource will assist to collect the data in a defensive manner, limiting liabilities and/or any issues that would require re-collection or duplicative work downstream. The resource can navigate limitations related to the specifications or account types and any other settings the user or organization may have applied. Additional benefits include in gaining visibility, identifying, and reporting challenges, and assisting attorneys with any required disclosures and documentation. Forensic collections resources can also validate by way of affidavits and/or court testimony if ever called into question.
LINEAL - Marco S. Nasca of LINEAL
When collecting collaboration applications distinct from Slack and Microsoft Teams, each technology available in the marketplace presents unique characteristics for export that must be understood to ensure success. For instance, the most typical application we experience outside of Slack or Teams is Google Docs. In Google Docs, the optimal approach for collection is via Google Vault instead of Google Takeout, as Vault provides an XML file output with the usable metadata, which can often be impacted upon download when using Google Takeout.
Collaborative messaging applications (i.e., WeChat, WhatsApp, etc.) are another source that presents nuances to consider in collection. First is the type of collection medium, where mobile phones as the trusted source are generally far more effective/preferred than personal computers. Further, iPhones are more straightforward than Androids due to additional collection requirements that may require a full physical image with an Android device. The encryption methodology of the application will also be determinative for success, particularly with data encoded at rest. For example, in Lineal’s Forensic team’s experience, we have found WeChat and WhatsApp much easier collection targets than platforms like Signal and Telegram, which prove to be more difficult as they encrypt data at rest.
In short, each application must be considered independent of another. The success of data collection will depend on data export type, source/medium, encryption, and a myriad of other factors. Partnering with a knowledgeable forensic examiner with the proper utilities, experience, and skillsets is critical.
Consilio – Mike Gutierrez
Collection from collaboration tools varies greatly by platform. Some platforms, such as Asana and Google Meet, have built-in export capabilities, but they may be designed for users rather than eDiscovery or compliance. It is important to determine what is included in terms of content and metadata, as well as if linked documents are included. There are several third-party eDiscovery and Compliance tools which support a wide array of sources. Third-party tools connect to the platforms via API, which typically provides much greater functionality to preserve more data types and metadata. Examples of such tools are Merge1, Exterro, Global Relay, and Hanzo, among others. Use of third-party tools comes with a cost, with the benefit of a more thorough and defensible product.
It is clear to me from the statements received from each one of the eDiscovery Partners, there will be specific challenges to be aware of when the custodian states they use a different collaboration tool other than Microsoft Teams or Slack. To sum it up, collaboration data collection is no different from any other software collection. The key is understanding how to gain access, how to collect the data, and what the required formats are for exports. Thank you to the eDiscovery Partners that contributed to this blog. New tools popup frequently and we are forced to play whack-a-mole to keep up.