ProCheckUp supports eDisclosure and eDiscovery work involving electronically stored information. The service focuses on identifying, preserving and examining digital material so that it can be handed over with a clear record of how it was handled.
Data sources and preservation
Relevant devices, accounts, systems and custodians
Collection boundaries, search requirements and access permissions
Evidence handling, review needs and the required handover format
eDisclosure / eDiscovery
The ProCheckUp Forensic Services team of highly skilled professionals leverage the know-how and support of our team of specialists in digital data to help our clients address the complexities associated with eDisclosure (eDiscovery in the United States or eDisclosure in the United Kingdom) and information governance through the delivery of a comprehensive set of services and solutions. Electronic discovery used in legal proceedings such as litigation, government investigations, or Freedom of Information Act requests, focused on information that is in electronic format (often referred to as Electronically Stored Information or ESI). Electronic discovery is subject to rules of civil procedure and agreed-upon processes, often involving review for privilege and relevance before data are turned over to the requesting party. We deliver solutions to complex electronic discovery challenges our clients face and we collaborate with our clients to assist with the preservation, collection, processing, hosting and production of data subject to discovery.
Examples of ESI include emails, instant messages from peer-to-peer apps, electronic documents, website content and accounting databases ESI can also encompass raw data or metadata, which our expert investigators can analyse for hidden evidence.
ESI is critical to successfully resolving a dispute or bringing the perpetrator of a criminal act to justice. Ensuring the integrity of the information is just as vital so that it can be used in court. Our dedicated experts specialise in understanding exactly where the information might be located, as well as preserving the integrity of the information.
Once litigation is foreseen, it is the legal duty of the company to lock down and preserve the relevant electronically stored information (ESI) and begin the process of making eDiscovery enquiries.
We can also conduct advanced digital forensics analysis on networks, RAM memory, mobile devices and video forensics. We also offer advanced decryption services, advanced file and system recovery, and forensic tape analysis & recovery.
The process of identifying and collecting the relevant ESI can be a time-consuming and expensive task, unless you have in-house expertise. Most information critical to a case can be stored in a multitude of formats and on a range of devices. ProCheckUp's extensive experience in digital forensics underpins our eDiscovery services. Identifying and accessing this information with forensic level integrity is a specialist task, one driven carefully by a detailed, multi-step process..
The six eDisclosure service stages
The stages below describe the service workflow to agree with your instructing team. Work may return to an earlier stage as the matter develops. Legal decisions about preservation duties, relevance and privilege remain with the instructing legal team; agree the applicable procedure and jurisdiction at the outset.
Phase one - Identification
The identification phase is when potentially responsive data are identified for further analysis and review.
Agree the questions, custodians, date ranges and systems potentially relevant to the matter. Include email, collaboration platforms, devices and backups where in scope. Record who controls each source, access requirements and any gaps. This creates a collection plan that can be refined when new sources or issues emerge.
Phase two - Preservation
Potentially relevant material is safeguarded against alteration or destruction. The timing and scope of preservation duties and legal holds should be confirmed by the instructing legal team.
Agree hold instructions and responsibility for carrying them out with the legal team. Identify deletion schedules, account closures and short-lived information that could affect preservation. Record the steps taken and any limitations; a hold instruction alone does not technically prevent every loss or alteration.
Phase three - Collection
Collection retrieves potentially relevant data from the agreed sources for processing and review. It should be authorised, documented and planned to minimise avoidable changes to the original information.
Agree a proportionate collection method for each authorised source. Record where material came from, who collected it, when and how it was transferred. Preserve relevant metadata and document integrity checks where applicable, along with failed collections or inaccessible sources, so later reviewers can understand the evidence’s provenance.
Phase four - Processing
During the processing phase, native files are prepared to be loaded into a document review platform. Often, this phase also involves the extraction of text and metadata from the native files.
Agree processing options such as date handling, extraction, deduplication and treatment of encrypted or unsupported files. Reconcile input and output counts and retain exception records. The objective is a usable review set with an explanation of what changed, what was excluded and what requires further attention.
Phase five - Review
During the review phase, documents are reviewed for responsiveness to discovery requests and for privilege. Different document review platforms can assist in many tasks related to this process, including the rapid identification of potentially relevant documents, and the culling of documents according to various criteria (such as keyword, date range, etc.).
The instructing team defines relevance criteria, privilege decisions and review priorities. Agree access controls, search terms and any redaction requirements before release. Record review decisions and quality checks, including how potentially privileged, confidential or unrelated personal information is handled; a keyword match alone does not establish relevance.
Phase six – Production
Documents are turned over to opposing counsel, based on agreed-upon specifications.
Agree file formats, numbering, metadata fields and the secure delivery method with the instructing team. Check the release set against the approved selection and record any redactions or exceptions. Keep a delivery record and agree retention, return or disposal instructions for working copies after the matter concludes.
Reporting and handover
At the end of the engagement, the client is provided with a final deliverable, consisting of a full technical report detailing the evidence and their significance, timeline of related events, recommendations for further processing, and a management-level summary. Further deliverables can be arranged for clients including continuous support, events and training.
Further guidance: EDRM: the wider electronic discovery lifecycle.
Preparing for the engagement
Agree the questions to be answered, the authorised data sources and any preservation requirements with the instructing team. Confirm how sensitive and unrelated information will be handled.
Outcomes and next steps
The output should explain the collection and processing performed and any limitations affecting the material. Scope and reporting requirements are agreed with the customer's legal or investigation team.
Related services
Discuss your requirements
Contact ProCheckUp with the environment, objectives and timing you have in mind. We can discuss the appropriate scope and next steps.
Need Help?
If you have any questions about cyber security or would like a free consultation, don't hesitate to give us a call!
For More Information Please Contact Us
ACCREDITATIONS
