A man and a woman looking at a tablet in an office building.

Handling Modern Data in the eDiscovery Lifecycle

Most eDiscovery teams have well-established processes for managing traditional data types such as PDF scans, Microsoft Office files, and email. However, the evolving digital landscape requires managing diverse newer data sources like Microsoft Teams, Slack, Zoom, and mobile data such as Apple iMessage, ever evolving list of chat applications on the market, and not to mention collaboration tools widely used in the corporate environment.

This resource offers high-level tips for managing various kinds of data at different stages of the data lifecycle. Use this page as a quick starting point.

Need more help? Contact us, and we’ll be glad to discuss your needs.

Overview of Frequently Encountered Modern Data Types

Microsoft Teams

Microsoft Teams is a digital collaboration platform for chat, video meetings, audio calls, and file sharing among other functions. Examples of relevant data for Microsoft Teams eDiscovery can include:

Chat conversations: Both one-on-one and group chats
Channel conversations: Discussions within specific Teams channels
Files: Documents, images, and other media shared as attachments or modern attachments, or stored within Teams
Meeting records: Agendas, attendees, and sometimes recordings and transcripts

Slack

Slack data can be significant in legal matters such as compliance audits, internal investigations, or litigation. Slack is highly dynamic and interactive, requiring special attention for collecting and preserving data. Data for Slack eDiscovery process to consider can include:

Direct Messages: Private one-on-one conversations between users
Channel Messages: Public or private group conversations organized by topic
Files: Documents, images, videos, and other files shared within Slack
Pins and Reactions: Marked important messages or user interactions within a conversation
App Integrations: Data generated or transferred by third-party applications connected to Slack

Mobile Device Data

From an eDiscovery perspective, mobile devices are computers with calling and texting built in alongside the ability to run diverse apps and services. Discovery professionals should consider the legal relevance of many kinds of data. Discovery considerations for mobile device eDiscovery include:

Text messages: Native messaging apps (see below for third-party messaging apps)
Call logs: Incoming, outgoing, and missed calls with timestamps
Email: Mobile email correspondence
Multimedia files: Photos, videos, and audio recordings stored on the device
Native and third-party apps: Data generated by built-in or downloaded applications, including web browsing history
Device data: Location history, device settings, system logs, and other device-specific information

Third-Party Messaging Applications

This data type can be complex due to the varied data retention policies, encryption methods, and user controls across different platforms. Each app may have unique data collection and preservation requirements, complicating standard eDiscovery processes.

Messaging apps: WhatsApp, WeChat, Signal, Telegram, Snapchat, and Facebook Messenger
Ephemeral messaging: Messages that disappear from the recipient’s device shortly after receipt

Considerations for Managing Common Modern Data Types

Select a combination of action and data type to learn the primary considerations for handling your data.

Retention policies: Understand the existing retention policies in Microsoft Teams. These policies can be customized to meet legal or organizational requirements.
‍
‍Custodian interviews: Conduct interviews with data custodians to gain insights into how data is stored and managed in Teams.
‍
‍Legal hold model: Evaluate the current legal hold model. If none exists, consider implementing one to preserve relevant data.

JSON export and attachments: Export JSON files and acquire attachments using the Admin UI. Legal holds can also be enacted in Enterprise tenants to preserve data.

Apple Message settings: Ensure that Apple message settings are configured to preserve messages indefinitely. Be cautious of deleted entries, which may be permanently removed after a 30-day window.

Retention settings: Note that retention settings can vary per application. Be aware that end-users may have the ability to override these settings.
‍
‍Read the blog: Managing Third-Party Messaging in a New Regulatory Environment

Identifying relevant teams: Determine which Teams channels or groups are relevant for data collection. Additional custodian interviews may be needed for clarification.

‍Filters: Use appropriate filters during the collection stage. Filters can reduce the time and volume of data collected but may limit search capabilities later.

‍Read the Case Study: Lighthouse Customizes Microsoft 365 for Multinational Corporation

Data acquisition: Use the Admin UI to export JSON files and acquire attachments. Leverage the Discovery API on Enterprise tenants for more efficient data collection.

Device management: Utilize Mobile Device Management (MDM) and Mobile Application Management (MAM) for data collection. Some devices may require a complete file system acquisition to obtain specific data artifacts.

Data caching: Some third-party messaging apps do not cache data on the device. Extra credentials or rights might be necessary for data collection.

Metadata preservation: Ensure important metadata like timestamps and user IDs are accurately processed for eDiscovery compliance.

‍Search and tagging: Use search and tagging options to filter and identify relevant Teams data for eDiscovery purposes.

Data parsing: Parse the exported JSON files and attachments. Alternatively, pull the data into a cloud-based processing platform via the Discovery API.

‍Listen to the Podcast: Improving eDiscovery Workflows for Modern Collaboration Data

Data ingestion: Conversions may be needed for downstream data ingestion. Messages from tools like Cellebrite may require specific time zone settings, especially in platforms like Relativity.

Data conversion: Most third-party messaging apps are compatible with Cellebrite for data processing. Apps like Telegram may require specific tools like a Windows desktop agent for data collection.

Make Sense of Your Modern Data

The complexity of enterprise data and its sources often requires specialized expertise in preparation for an investigation or litigation. Lighthouse eDiscovery, information governance, and digital forensics specialists can help—with everything from retention policies development and Microsoft 365 data governance to anywhere, anytime data collection and legal hold digitalization.