FORENSIC COMPUTER SERVICE

phone: 800-655-5245

ELECTRONIC DISCOVERY (ESI) SERVICES

TYPES OF ESI

Any data that is stored in an electronic form may be subject to production under common eDiscovery rules. This type of data has historically included email and office documents, but can also include photos, video, databases, and other filetypes. Also included in e-discovery is "raw data", which Forensic Computer Service will review for hidden evidence.


The original file format is known as the "native" format. Litigators may review material from e-discovery in one of several formats: printed paper, "native file,", or a petrified, paper-like format, such as PDF files or TIFF images. Modern document review platforms accommodate the use of native files, and allow for them to be converted to TIFF and bates-stamped for use in court. 

stages of esi processing

1. identification

The identification phase is when potentially responsive documents are identified for further analysis and review. Custodians who are in possession of potentially relevant information or documents are identified. To ensure a complete identification of data sources, data mapping techniques are often employed. Since the scope of data can be overwhelming in this phase, attempts are made to reduce the overall scope during this phase - such as limiting the identification of documents to a certain date range or search term(s) to avoid an overly burdensome request.

FCSI's forensics will assist in extracting daa within the scope you specify.

2. preservation

During preservation, data identified as potentially relevant is placed in a legal hold. This ensures that data cannot be destroyed. Care is taken to ensure this process is defensible, while the end-goal is to reduce the possibility of data spoliation or destruction.

Electronic data from servers, individual computer hard drives, external media such as thumb drives, CDROM's and other storage devices are forensically imaged by FCSI so an exact copy of the asset is frozen in time.

Once that process is complete the physical evidence can be sealed and stored.

The forensic image obtained by FCSI, which is a pristine copy of the original asset, is stored in the event additional data is needed in the future.

3. collection

Once documents have been forensically preserved, collection can begin. Collection is the transfer of data from a company to their legal counsel, who will determine relevance and disposition of data.

Some companies that deal with frequent litigation have software in place to quickly place legal holds on certain custodians when an event (such as legal notice) is triggered and begin the collection process immediately. Other companies may need to call in a digital forensics expert like FCSI to prevent the spoliation of data. The size and scale of this collection is determined by the identification phase.

It is highly recommended that a third-party forensic company perform the collection.

4. processing

During the processing phase, native files are prepared to be loaded into a document review platform. Often, this phase also involves the extraction of text and metadata from the native files. Various data culling techniques are employed during this phase, such as deduplication and de-NISTing. Sometimes native files will be converted to a petrified, paper-like format (such as PDF or TIFF) at this stage, to allow for easier redaction and bates-labeling. Modern processing tools can also employ advanced analytic tools to help document review attorneys more accurately identify potentially relevant documents.

Part of the processing typically involves computer forensics and FCSI will assist in preparing documents to be loaded into a document review system.

5. review

Forensic Computer Service delivers the content to the processor of your choice while retaining the entire set of data for each asset.

During the review phase, documents are reviewed for responsiveness to discovery requests and for privilege.

Different document review platforms can assist in many tasks related to this process, including the rapid identification of potentially relevant documents, and the culling of documents according to various criteria (such as keyword, date range, etc.).

Most review tools also make it easy for large groups of document review attorneys to work on cases, featuring collaborative tools and batches to speed up the review process and eliminate work duplication.

6. production

Documents are turned over to opposing counsel, based on agreed-upon specifications. Often this production is accompanied by a load file, which is used to load documents into a document review platform. Documents can be produced either as native files, or in a petrified format (such as PDF or TIFF), alongside metadata.

Depending on the nature of the case the production of information to both parties can be done at the same time so each party is operating in the same time window.


early case assessment lifecycle

Early case assessment software is typically used by attorneys, corporate legal departments, risk managers and FCSI to help analyze unstructured electronically stored information. Effective early case assessment usually requires the combination of professional expertise and forensic software. This pairing, depending on the professional and tools used, can provide various degrees of early case assessment review. Early case assessment, as a managed process, often requires customization to each case and the client involved

Forensic Computer Service will work with your management, counsel and IT professionals to customize and help deploy the process.

The early case assessment lifecycle will typically include all of the following:

  • Perform a risk-benefit analysis
  • Place and manage a legal hold on potentially responsive documents (paper and ESI)
  • Preserve information abroad
  • Gather relevant information for attorney and expert document review

  • Process potentially relevant information for purposes of filtering, search term, or data analytics
  • Information hosting for attorney and expert document review, commenting, redaction
  • Produce documents to parties in the case
  • Reuse information in future cases

The software approach to early case assessment typically includes the following:


  1. Determine the assets to analyze
  2. Set parameters for the assessment
  3. FCSI will forensically image assets such as local hard drives, removable media,
        cell phones, file servers, whole networks, etc
  4. FCSI will assess the data from the forensic image
  5. Use the computer forensic tools to bookmark the files to be analyzed
  6. Review reports generated by the forensic software
  7. FCSI will package and forward relevant data to the processor for attorney review

FCSI is committed to providing professional quality services using the latest technology to acquire, analyze, report and testify on the work we perform for you. All of our work product is strictly confidential and is never released to any other party without your consent.