The collection phase involves extracting the chat data from its existing format and making it available for processing and review.  We talked in our first blog post about the different types of chat platform, and certain issues that can arise with accessing historic chat data. Our third blog post covered issues with identification and preservation, which are obviously key prior to the collection phase.

Collection methods must be defensible

Defensible collection methods (by which we mean they will stand up to later scrutiny) will ensure that:

• chat data is extracted in a way that is efficient, audited and repeatable, with no alteration to underlying metadata
• the most proportionate and targeted set is selected, reducing the volume of data extracted to reduce unnecessary data processing and hosting costs
• potentially duplicative sources are collected in a way that they can be accurately compared, to avoid errors on deduplication.

Another benefit of a well-organised and documented collection process is that the process can be re-used for future collections over any new data that comes to light.

Top tips for collection

To maximise the fruitfulness of collection of chat data, and reduce the cost of discovery exercises:

• To avoid spoliation, collect without tipping off. If data needs to be collected from a business device (and we try and avoid this if at all possible) this would require the device to be physically removed from an individual for a period of time, which may tip off the custodian that an investigation is ongoing. To avoid suspicion, some businesses think carefully about the reason given for needing to access a business device.
• Narrow down the set for collection. Consider whether you need all conversations where an individual is present in a chat group, or only the conversations where the individual is an active participant, ie is messaging and reacting.
• Choose the format of export wisely. There are often multiple ways to export chat data to different formats. Different chat platforms and software licences for a chat platform will allow administrators different export rights to the chats and their attachments. For example:
  • Some subscriptions will allow a company administrator to export public channels, but would require an application to the software provider to be able to export private channels and direct messages.
  • Some chats can be exported to text file, however attachments would not be retained where they were originally inserted in a chat, but rather provided separately and divorced from their insertion point. The best collection source is likely from the application itself, via a specialist forensic tool.
  • Some chat platforms allow data to be exported in several different file types, eg PST, TXT and XML filetypes.  Choose the best filetype for export, eg XML contains the relevant metadata and is most readily converted to a reviewable format so would be the preferred export format if faced with this choice.

This post is part of a blog series on our eDiscovery-related experiences working with chat data.

• Our first post looked at the main types of chat platforms and some of the issues that can arise.
• Our second post provided tips on what to consider ahead of any investigation commencing.
• Our third post considered identification and preservation of chat data during an investigation
• Our next post will consider the production of chat data to the authorities.