How to Prevent an e-Discovery Disaster

e-Discovery disasters can result in devastating consequences. Lost evidences can lead a company to be fined with multimillion-dollars or lose an otherwise court case which was otherwise winnable. Here are some best practices for IT Managers to stick to in order to prevent such situations.

Talk to your legal department on a regular basis. One benefit of meeting with in-house counsel regularly is that you'll get to know the key contacts so you'll be prepared to act fast if your company does face legal action. And the best part is that it greatly reduces the surprises you could face down the road.

Make your information-handling practices routine and consistent. It's critical to be able to prove in court that your standard operating procedures are maintained and followed by every individual in your company.

Keep a log, keep a log and keep a log. Backup logs, system and event logs, shipping receipts, help desk tickets, work requests, e-mail, meeting notes, journal entries, and yellow sticky notes can all be resources for you to resort to especially if  when you need to recall or prove what you did or didn't do in the course of a typical day.

Tame the mouse (and hold your horses) while the mouse is in your hands. Copying critical corporate files to irrelevant folder during an e-discovery project can not only compromise your chain of custody, but also mistakenly information to wrong people.

The most talked about term you'll hear after the e-discovery project starts is, chain of custody. Which simply means that you should be able to prove who had the data and when. Best practice is to start the chain long before the e-discovery matter begins, so you need to take steps now to ensure that you can track the chain of custody in the future.

Understand what spoliation is. Spoliation is the deliberate or negligent destruction, withholding or hiding of evidence when an investigation or litigation is under way. At the risk of stating the obvious, it's a big no-no.

The fact that you destroyed it means the law automatically assumes it was damaging.

Be ready to preserve or backup all data, immediately. If you have automatic cleanup or purging processes, you should suspend or discontinue them. If you don't know how much data is subject to the hold request, which is a typical scenario, you should stop all data destruction to be on the safe side.

Know what you have. Do you know where your data is? Do you think you have a handle on your data? Think again. I can't tell you how many times I've heard someone say, "They've found another server/drive/tape/flash drive."