Digital Forensics: Preparing for a Legal Hold

Previous article in series – Digital Forensics: E-Discovery

Preparing for a legal hold or e-discovery may include the following:

• Consideration of the SLA and contract agreements to ensure that investigations of cloud-based assets are permitted, or to check if prior notification and acceptance are required
• Contract agreements, explicitly stating the communication path between court participants and the cloud service provider, to ensure that there is immediate notification by the cloud service provider of any presentation of court documents requesting access to client’s property or data
• Use of data dispersion techniques and data regeneration techniques such as error coding to ensure adequate protection of data in the event of seizure of one or more storage devices
• Use of data discovery to locate critical data that might be required for legal production
• Development of a legal incident response team that enables the legal department to coordinate activities with both the IT department and the cloud service provider
• Development of a data retention and destruction policy that effectively removes and destroys data that may be subject to e-discovery only after the required retention period
• Development of a method of data aquisition from the cloud service provider within the time limits required by the court, including securely storing the data, utilizing chain of custody, and providing nonrepudiation of the source of the data
• Development of contractual relationships with third-party suppliers of cloud forensics labs, cloud e-discovery data acquisition firms, and secure data transport and security firms

NOTE: It is important to note the production timelines stated on court documents do not incur court sanctions due to slow data acquisition from the cloud service provider.

Remember, it is important to provide exactly and only what is requested on a court document. Do not provide any more data than what is asked for.

All liaisons or communications with the court, requesting party, or legal participant must be through your legal department or representative.

Next article in series – Digital Forensics: E-Discovery Service Types & Legal Terms