Preservation Questions
Following is a basic list of questions that should give you a general understanding of the IT systems involved in the litigation. It is always advisable to contact a competent forensic consultant early in the process to ensure all the electronically stored information (ESI) needed for the litigation is handled properly early in the process.
General
- What is the retention policy?
- Who is the in-house contact for IT policy questions?
- Who is the in-house contact for acquisitions or preservations?
- Are there any regulatory requirements for data retention?
Data Protection - Suspend processes that could destroy data
- What relevant evidence is in danger of being deleted or overwritten?
- Are massive amounts of Electronically Stored Information routinely purged?
- Are e-mails automatically purged on central servers or on individual computers?
- Are backup tapes recycled?
- Has a thorough litigation hold for all employees that have relevant information been issued?
Monitor preservation efforts and reissue litigation holds.
Take possession of the data and ensure security.
Computer
- What is the operating system?
- What computer programs are used, including e-mail (business and personal)?
- Are files stored on the computer or on the server?
- Are e-mails stored on the computer or on the server?
- Is there a personal computer that could hold evidence?
- What backup processes are used for individulal computers?
- Are there any passwords? Is so, are they available?
- Is encryption used? If so, is the encryption key available?
Server
- What is the server OS?
- What is the e-mail program, including version number?
- Where is the server that hosts the custodian(s) e-mails and documents?
- Is there a Blackberry (or similar technology) in use?
Make arrangements to acquire Custodian e-mails and Backup files.
Backup
- What are the backup procedures in detail?
- What type of backup hardware is used?
- What backup software is used including version number?
- What type of media is used, including the capacity?
- How frequently is data backed up (Daily, weekly, monthly, quarterly, annually)?
- Is there a policy to replace old tapes? If so, how are old tapes handled and stored?
Storage of Back up Media
Onsite – Location with contact name.
Offsite – Location with contact name.