There are four main electronic evidence processes in any electronic discovery project:

1. Restoration and Harvesting

2. Processing

3. Review

4. Production

This article focuses on the restoration and harvesting process which can be broken down into three major steps:

1. Collection Completed -- Client has already collected data.

2. Collection Preparation -- Data has not yet been collected and the client may require guidance for evidence self-collection, or an outside party to harvest the data.

3. Restoration Involved -- Data needs to be restored from back-up tape or media.

Collection completed

To effectively harvest electronic evidence as part of e-discovery and mitigate risk, it's important to understand what steps have already been completed or still need to be taken. In step 1, where the client has completed the collection, the following types of questions can help with the initial planning and strategy assessment:

How is the collected evidence organized on the hard drive or other back-up media? Is it by custodian, by server name, or by some other taxonomy?
This is important to know because if the data arrives for processing and is jumbled in a giant mess with no discernable way to organize it, there will be increases to processing time. Better data organization on the front end increases speed and efficiency during processing and review. This also allows for cleaner production sets to be delivered on the back end.

Who performed the collection, and what tools were used to harvest the data?
This is vital to understand. Did the client perform the collection themselves by simply dragging and dropping the data onto portable media or copying in onto a CD or DVD? Did the client employ a separate, third party? Were the tools used to copy the data forensically sound, and was the process legally defensible? Knowing all this information up front will allow legal teams to be better prepared to address potential objections by the other side, especially around the subject of evidence authentication and spoliation.

Will data restoration services be required to get to the evidence?
The answer to this question will depend on what tools were used to collect the data. Some tools will put all of the data into a proprietary container format.

Will data restoration services require any type of forensic analysis?
Depending on the case and tools employed to harvest the evidence, forensic analysis, or trying to find the deleted files and file fragments from a forensically-imaged hard drive, may be necessary.