Preserving Chain of Custody in E-Discovery

Source: LexisNexis Tech Tips...

As the field of electronic discovery has matured, attorneys have enjoyed the benefits of electronic document review. They realize that the actual discovery and review processes have not changed—only the tools and the storage media are different. Review teams have become accustomed to the speed and efficiency of electronic discovery and would consider even a small-sized document review unmanageable if forced to use paper review methods.

Veteran review teams have learned that most of what it takes to make an electronic discovery project successful must happen before a single byte of data is gathered. This article discusses one of the crucial components of a discovery project: how to maintain a chain of custody log for all data gathered throughout the life of the case.

Purpose

The purpose of a chain of custody log is to prove that the integrity of the evidence has been maintained from seizure through production in court. Chain of custody logs document how the data was gathered, analyzed, and preserved for production. This information is important, as electronic data can be easily altered if proper precautions are not taken. A chain of custody log for electronic data must demonstrate the following: the data has been properly copied, transported, and stored; the information has not been altered in any way; and all media has been secured throughout the process.

Procedures

Documentation must be maintained throughout the life of the evidence and must be readily available for review at any time. Every instance of contact with the data must be documented throughout the entire discovery process.

A chain of custody log should include the following items in the documentation:

Initial Data Collection

• Name of individual who received the evidence
  
• Date, time and place of collection or receipt
  
• Name of custodian
  
• Description of data obtained, including media-specific information:
  • Media type, standard and manufacturer
  • Serial numbers and/or volume names
  • Writing on labels
  • Characterization of data
  • Amount of data
  • Type of data
  • Write-protection status
  
  
• Description of data collection procedures
  • List of tools used for each procedure
  • Name of the individual conducting each procedure
  • Outcome of procedures
  • Problems encountered, if any

Additional Documentation

• Movement of evidence (evidence transfer), including purpose of transfer
  
• Date and time of media check-in and check-out from secure storage
  
• Physical (visual) inspection of data
  
• Description of data analysis
  • List of tools used for each procedure
  • Name of the individual conducting each procedure
  • Outcome of procedure
  • Problems encountered, if any
  
  Notes section to record anything out of the ordinary

Conclusion

Complete and accurate logging procedures will help ensure that electronic data can be authenticated in court. A little extra effort at the beginning of the project will afford a smooth, efficient chain of custody documentation process.