The Preservation stage in the Electronic Discovery Reference Model (EDRM) records that organisations take steps to preserve potentially relevant electronically stored information (ESI) so that it cannot be altered, destroyed or lost. The goal of the Preservation stage is to ensure that relevant ESI is protected and preserved in a way that is defensible and meets the legal requirements for discovery.
The Preservation stage involves several key tasks, including:
- Identifying potentially relevant ESI: This involves identifying all the data sources that may contain relevant ESI. It is important to cast a wide net during this stage to ensure that no relevant data is missed.
- Issuing a Legal Hold: A legal hold is a written notification issued to custodians of ESI, informing them of the obligation to preserve all potentially relevant information. The legal hold specifies the type of information to be preserved, the duration of the hold, and any restrictions on the use or access to the information.
- Collecting ESI: Once the legal hold has been issued, organizations must collect and preserve potentially relevant ESI in a forensically sound manner to ensure that the data is not altered or destroyed. This may involve imaging hard drives, copying files and emails, and preserving metadata.
- Managing and storing preserved ESI: Preserved ESI must be managed and stored in a secure and defensible manner to ensure that it is not altered or destroyed. This may involve storing ESI on secure servers, restricting access to the data, and maintaining a detailed chain of custody.
Overall, the Preservation stage is a critical component of the eDiscovery process. It ensures that potentially relevant ESI is protected and preserved in a way that is defensible and meets legal requirements. Failure to properly preserve ESI can result in spoliation, which can lead to legal sanctions, fines, or adverse judgments.
Forensic Tech 