The eDiscovery Process and Commvault® Software
Understanding the eDiscovery process using Commvault software is essential for a complete investigation. IT and legal communication is essential during all phases of the process.
The eDiscovery process using Commvault software includes the following steps:
- Identify data for investigation including custodians, relevant data types, and data ranges.
- Preserve data using IT holds or litigation holds.
- Content index data.
- Create a legal review workflow process.
- Conduct basic and advanced searches for relevant information.
- Move relevant items to Review sets for deeper analysis including tagging and adding comments.
- Move responsive items to legal holds or export sets.
- Produce responsive items for investigation as CAB, PST, NSF and HTML files.
- Release non-relevant data from legal holds.
Identify data for investigation
The first part of identifying data is knowing the type and location of the data. This is primarily Email but also can include documents which may be on servers or personal computers. The legal team should communicate as much information to the IT team so they can quickly identify the location of the data to be preserved. Along with what type of data must be preserved, the date range and relevant custodians must also be provided.
In modern environments, it is quite common for user data not to be in central locations. Using Commvault features including end user desktop and laptop agents provides a longer reach of what data can be identified. An understanding of what users are doing with their data can assist when an investigation arises.
Preserve data
Once data is identified it must be preserved. In certain cases, especially when it is unclear what data must be preserved, an IT legal hold is implemented. This can be accomplished in several ways:
- Disabling data aging operations for storage policy copies, clients, or the entire CommCell® environment.
- Using Reference Copy to preserve files and Email messages on certain production systems. Reference Copy configuration is typically implemented by Commvault administrators with guidance from legal teams.
- Using Case Manager to preserve files and Email messages owned by custodians. It is important to note that file ownership is tied to system ownership which means that Case Manager is suitable when managing end user data such as laptops and desktops. Server data such as file shares and home folders can be included but it is not tied to a specific custodian. Filter criteria such as file types and key words can be used to determine which server data is preserved in the case. Case Manager implementation is typically handled by legal teams.
A critical point in the data preservation process is that data is managed independently from standard corporate retention policies. A standard policy of 30 – 60 days may be used for normal business operations which would not be adequate for an investigation that may span multiple years. Disabling data aging is a temporary method to preserve data but can come at a significant cost in extra storage requirements. Reference Copy and Case Manager physically copies data to an alternate storage location providing a more efficient long term storage solution.
Content index data
Content indexing is required to conduct full content searches for Email messages and files. In some environments content indexing is an ongoing process. This allows investigations to be conducted with minimal communication with IT teams, although it is still critical to check with Commvault administrators to ensure all indexing operations are up-to-date based on the scope of the investigation. Content indexes can exist for the entire retention time of the data or indexes can be pruned prior to data exceeding retention. Any indexable data that exists in a Commvault environment can retroactively be content indexed. It is always important to establish the data types, custodians, and date ranges to ensure all required data is preserved and content indexed.
Legal Review Workflow Process
Although searches can immediately be conducted, a good practice is to establish a workflow process. This includes who will be investigating and at what stage they will be actively involved. At this point a workflow can be established by defining query sets and review sets. Multiple sets can be defined and permissions can be assigned to ensure a secure workflow process.
At the start of the review process, basic and advanced queries can be crafted to begin identifying relevant information. Queries are then modified to remove non-relevant information and narrow the scope of search results. Multiple queries can be crafted and saved to query sets to simplify the process and divide responsibilities when multiple legal team members are involved. It is critical that all queries are saved in a query set to ensure a complete and defensible investigation.
In some cases, relevant items are immediately exported or placed in legal hold retention policies. This is common for basic investigation or in early case assessment situations where items are to be exported and presented to others or analyzed using third party software.
Move relevant items to Review sets
Once queries are crafted, relevant items can be moved to one or more review sets. Review sets provide a more granular method of investigation where comments can be added to items and items can be tagged. Multiple review sets can be created in a cascading manner when multiple levels of investigation are required. For example, the primary review set can be used for a high-level investigation to identify and tag potentially relevant items. These items can then be moved to another review set for a deeper analysis. This also is used to create a workflow where different individuals at different phases of the investigation can analyze items for relevance, non-relevance, or attorney-client privilege.
Move responsive items to legal holds or export sets
Throughout the investigation process, relevant items are reviewed to determine if they are responsive – all items within the scope of the investigation. These items can be moved to a legal hold or an export set. Both operations create physical copies of items and it is important to note that depending on how many items are included, this process can take some time.
A legal hold, in the context of the Commvault Compliance Search interface, copies items to a separate physical location and a specific retention is placed on these items. Legal hold retention policies are defined by the Commvault administrator with the assistance of legal teams. Legal hold retention policies can be named based on a case, retention terms such as 5-year hold, or any other naming convention required by the organization.
A common practice is to have a legal hold policy using infinite retention. This guarantees the preservation of data for the life of the investigation. Once the investigation is closed, the legal hold data can be released.
Export sets take selected items and immediately exports them to a compressed file such as CAB, PST, NSF or HTML. The export process may take some time to complete depending on how many items must be copied to the compressed file. The export file can then be downloaded directly to the local computer. It is important to note that placing items into an export set does not change the retention of items in Commvault protected storage.
Produce responsive items
Once all items are placed in a legal hold or and export file, they can be exported outside of the Commvault environment.
Release data from legal holds
Legal holds, implemented by IT, can be released if it is determined that all responsive information has been produced or the investigation is closed. If it is uncertain that all information has been gathered, it may be necessary to maintain the legal holds. Note that Commvault has additional features including Commvault OnePass archiving, storage to cloud, and SILO storage which can be implemented to hold on to data for extended periods of time.
