SHAREPOINT FORENSIC AND E-DISCOVERY COLLECTIONS
Microsoft SharePoint forensic and E-Discovery collections have become a growing concern for legal IT professionals and their clients. An extensive amount of potentially relevant discoverable content stored in SharePoint sites can be a minefield of technical challenges. A quick Google search can point to some information about how to copy the document libraries in a SharePoint site. However, what about the associated metadata? Linking document versions? Verification logs? This does not include the other content a SharePoint site can store like calendars, contacts, tasks, blogs, wikis, and many other “lists” that can also contain discoverable information.
Potential SharePoint Sources
There are several obstacles that will be encountered during a typical SharePoint Forensic or E-Discovery collection:
LINKING AND COPYING IS VERY SLOW AND INCOMPLETE
It becomes apparent very quickly that just linking and copying the document libraries, especially without audit reports, is incomplete and could easily miss discovery that the attorneys need to do their job. If you have been involved in a SharePoint site collection that uses the option to link to document libraries and use a copy utility to collect the data, you realize it is very slow. This is due to the administrative overhead when mapping a drive letter to a SharePoint document library. Not only does it take a lot longer to collect documents from libraries using this method, the SharePoint metadata is not captured during the copy process. It is much quicker to connect to the native SharePoint web services when “requesting” a copy of a document that resides in a SharePoint site.
Some litigation support service providers have built custom utilities to link metadata with documents. However, this still requires several additional steps including exporting from the MS SQL Server databases and linking the information to documents. After all these steps you still leave behind the “lists” which many custodians use daily.
OVERCOMING FORMAT INCOMPATIBILITIES
There are multiple considerations when bridging the gap on how SharePoint data is structured and stored, and how to transfer the content into common E-Discovery and review applications. For example, many items in SharePoint site lists are displayed as part of a web page in SharePoint and the data is stored in SharePoint’s SQL Server database.
To extract and provide an easily viewable version offline, you need a tool that can take several dissimilar sources and “flatten” the content out while linking to the files. This allows you to easily import the content into popular E-Discovery tools. It isn’t enough to just backup or export SharePoint data because you have to convert it into a format that vendors and legal counsel can use. Comma separated files in various formats (i.e. Concordance DAT) are commonly used to transfer and link data between dissimilar systems.
AFFORDABLE OPTIONS FOR YOUR CLIENTS
At this time, there are only a few products and services offered that address a complete SharePoint site collection focused on defensibility and E-Discovery. Of those that are available, most are priced for larger collections with a large investment, or require using a specific vendor for your E-Discovery processing.
The most reasonably priced tool we have seen is Pinpoint Labs SharePoint Collector (SPC) for Forensic or E-Discovery collections. When using SPC, you can still use your current E-Discovery processing vendor. You can also purchase affordable software licenses for one time use, unlimited single users, or enterprise-wide use.
PINPOINT LABS SHAREPOINT (SPC) COLLECTOR FEATURES
Important features in Pinpoint Labs SharePoint Collection (SPC) tool include:
- Fully portable (no local installation required)
- Multi-threaded processing for faster collection
- Collect documents, lists, calendars, and contacts
- Capture announcements, attachments, wiki, blogs
- Extract SharePoint file metadata
- Extensive chain of custody
- Collect user data and display file lists
- Retain folder structures
- Resume incomplete jobs and reprocess errors
- Create Concordance DAT file for easy import into E-Discovery processing and review applications
You can obtain more information or request an evaluation license for Pinpoint Labs SPC by visiting https://www.pinpointlabs.com/sharepoint-collection.html. You’ll find a short demonstration video below.
[tube]https://www.youtube.com/watch?v=TRW9BKgY9L4 [/tube]
Microsoft SharePoint sites will continue to be a frequent and important E-Discovery source. This article provides a basic understanding of the obstacles commonly encountered. In most cases, it isn’t enough to simply map and copy the SharePoint document libraries, especially when there are more affordable, flexible and defensible alternatives available.