It often comes as a shock to attorneys and their staff when they hear that electronic discovery processing doesn’t automatically search the entire contents of a custodian’s hard drive. So, it’s worth stating again for emphasis here. Common electronic discovery applications used by service providers and law firms aren’t designed to search the unallocated (swap, free, slack) hard drive space, which is where deleted files and other potentially relevant data will reside.
If you have custodians that need a thorough investigation you may need to dig deeper than the results that EED processing provides. If you suspect that specific custodians may have deleted files or user activity logs, or you need to analyze specific activity taking place on the custodians computer then you’ll need to begin a computer forensic investigation to review the computers unallocated space.
I’m not recommending that every custodian hard drive and server will need to be forensically imaged and analyzed. In fact, the majority of the files identified as being relevant to ESI (Electronically Stored Information) production can be processed and reviewed using off- the- shelf EED software. However, during the course of many cases, an individual or two can be identified as ‘suspects’, requiring a more thorough investigation of the activity on their desktop or laptop computers.