Data Source Atlas

Where relevant data can live: the data source atlas

Use the atlas as an interview menu. A category is a possibility until an owner confirms the actual system, account, period and available records. Record the business content and the separate metadata and logs. Counsel and the receiving specialist set relevance, preservation, lawful authority and scope, and choose the sources each matter needs. The same entries are in Data-source-inventory.csv with columns for the owner response.

D01 Laptops and desktops

What it may hold: Local files, downloads, synced copies, browser records and user or application artifacts if retained.

Ask the owner: Which device IDs, user profiles, encryption or recovery arrangements and relevant dates exist? Is a scoped forensic collection needed?

Likely contact: IT asset owner and custodian.

Limits to confirm: A local synced folder may contain placeholders rather than all cloud content. Leave the device as it is; the inventory records its identifiers and custodian.

Sources: NI04; MS01

D02 Mobile phones and tablets

What it may hold: Messages, work apps, photographs, attachments and account links subject to device or app state.

Ask the owner: Company owned or personal? Which apps and accounts were used, who can authorize collection, and what is still available?

Likely contact: Custodian, MDM owner and counsel.

Limits to confirm: Confirm which app data the MDM can reach and who can authorize collection of personal information. Deletion and encryption can limit recovery.

Sources: NI04; LG01

D03 External media and paper

What it may hold: USB or external disks, removable media, notebooks, printouts and offsite files.

Ask the owner: Which media or physical locations were used and who has custody?

Likely contact: Custodian, facilities and records manager.

Limits to confirm: A record may have left the managed network without a surviving access log. Preserve physical identifiers and custody.

Sources: NI04; NY02

D04 Email and calendars

What it may hold: Messages, attachments, drafts, calendars, tasks, shared or delegated mailboxes and groups where supported.

Ask the owner: Identify all primary, alias, legacy or shared addresses and relevant mail systems; what export includes attachments and metadata?

Likely contact: Messaging administrator and business owner.

Limits to confirm: An individual mailbox search can omit shared mailboxes, external mail, deleted or inactive users and cloud linked documents.

Sources: MS01; GO01

D05 OneDrive and personal work storage

What it may hold: User owned work files, supported versions, sharing links and retained content.

Ask the owner: Which exact user or site URLs exist, including deleted or unlicensed accounts? What holds, licenses and deletion schedules apply?

Likely contact: SharePoint or OneDrive administrator.

Limits to confirm: Request recycle bin contents directly, alongside the normal eDiscovery search. Check the current archive terms for unlicensed accounts and the date each account will be removed.

Sources: MS03; MS05

D06 SharePoint and Teams files

What it may hold: Team sites, libraries, lists and separate channel sites where used.

Ask the owner: Which site or library and private or shared channel locations are relevant? Where do linked files actually live?

Likely contact: Site and collaboration administrators.

Limits to confirm: Collect channel files, lists, versions and linked targets alongside the mailbox messages.

Sources: MS01; MS02; MS05

D07 Teams messages and meetings

What it may hold: Searchable compliance records, chats or posts, recordings or transcripts and meeting artifacts where supported.

Ask the owner: Which chat, channel or meeting types, policies, organizers and storage locations apply? What known content exclusions exist?

Likely contact: Teams, messaging and site administrators.

Limits to confirm: eDiscovery uses compliance records rather than the live Teams database. Files and recordings may require different locations. Features and channel behavior change.

Sources: MS02

D08 Google Gmail and calendars

What it may hold: Messages, attachments and calendar content supported by the actual Workspace or Vault setup.

Ask the owner: Which accounts or domains, delegated or group mail, licenses and retention or holds existed for the relevant period?

Likely contact: Workspace or Vault administrator.

Limits to confirm: Vault holds what its licenses and configured policies cover, so confirm both. Deleting users or required licenses can destroy availability.

Sources: GO01

D09 Google Drive and shared drives

What it may hold: Owned or shared files, shared drive material and versions or exports as supported.

Ask the owner: Who owns each file or shared drive, including external owners? Which search and export settings were used?

Likely contact: Drive or Vault administrator and document owners.

Limits to confirm: Request the external target and the historical versions behind any shortcut or user search. Confirm the export scope with the provider.

Sources: GO01

D10 Google Chat Meet and Voice

What it may hold: Supported messages, meeting artifacts, recordings and Voice records if used and retained.

Ask the owner: Which services, history settings, organizers and licenses were in use?

Likely contact: Workspace or Vault and communications administrators.

Limits to confirm: Confirm coverage service by service, including which calls were recorded.

Sources: GO01; GO02

D11 Slack and shared workspaces

What it may hold: Channels, direct messages, files and preserved edits or deletions where the plan and tools support them.

Ask the owner: Which workspaces, plan, export authority, apps, retention and Slack Connect parties apply?

Likely contact: Workspace or org owner and counsel.

Limits to confirm: Exports or API access are plan or permission dependent. External organizations can control relevant content and retention.

Sources: SL01; SL02

D12 Other messaging and meeting systems

What it may hold: Business use of texts, WhatsApp, Signal, Zoom, chat, voice or other collaboration tools.

Ask the owner: Ask each custodian which actual accounts or apps were used, whether history or recording existed and who controls it.

Likely contact: Custodian, communications owner and counsel.

Limits to confirm: Encryption, device state, disappearing settings, contracts and legal authority differ.

Sources: NI04; LG01

D13 Identity and access platforms

What it may hold: Account, sign in, role, group, authentication and administrator records if logged.

Ask the owner: Which tenant or account IDs, role assignments, event sources and dates can be exported?

Likely contact: Identity administrator.

Limits to confirm: Pair sign in records with device and session records, which are where the examiner looks to attribute later actions. Log availability depends on actual coverage and retention.

Sources: NI04; MS04; GO02

D14 Security monitoring and endpoints

What it may hold: SIEM, EDR, DLP, alerts, case records and file or device activity if collected.

Ask the owner: Which endpoint agents, policies, sensors, fields, exclusions and retained periods cover the relevant event?

Likely contact: SOC, endpoint owner and providers.

Limits to confirm: An alert is a lead requiring interpretation. Record where agents had visibility and for which periods.

Sources: NI04; MS04

D15 Network and remote access

What it may hold: VPN, firewall, proxy, DNS, wireless and remote support records if enabled.

Ask the owner: Which identity, device or IP mappings and times are available; what NAT, clock or shared account issues exist?

Likely contact: Network team and remote access provider.

Limits to confirm: Pair network records with endpoint and identity records, which are where the examiner looks for file content and the person acting.

Sources: NI04

D16 Microsoft audit and export reports

What it may hold: Activity logs, query or export job records, processing errors and source counts.

Ask the owner: What exact licenses, policies, event types, role filters, earliest dates and error reports apply?

Likely contact: Purview administrator.

Limits to confirm: Content retention is separate from audit log retention. A zero result can arise from scope, indexing, permissions or filters.

Sources: MS04; MS06

D17 Google audit and export reports

What it may hold: Admin, login, Drive and other service events, job histories and errors as available.

Ask the owner: Which log type, time period, query, export mechanism and event delay apply?

Likely contact: Workspace security or Vault administrator.

Limits to confirm: Retention and delay vary by log. Preserve each activity log under its own retention setting alongside the Vault hold.

Sources: GO01; GO02

D18 Cloud infrastructure and storage

What it may hold: Virtual machines, object stores, snapshots, databases, cloud keys and management or data access logs where configured.

Ask the owner: List accounts, subscriptions, regions, services, logging settings, bucket or container IDs, lifecycle rules and providers.

Likely contact: Cloud administrator and application owners.

Limits to confirm: AWS default Event history is regional 90 day management history; it excludes data events. Enable or request data event logging for storage downloads.

Sources: AW01; NI04

D19 Email journals and compliance archives

What it may hold: Journaled or ingested mail, attachments, other captured feeds and archive search histories.

Ask the owner: Which feeds, users or date ranges were captured, what failed, and does export preserve original fields and attachments?

Likely contact: Archive owner and provider.

Limits to confirm: Verify capture, deduplication and migration gaps so the archive can be compared with its source.

Sources: NI04; LG01

D20 Backups snapshots and recovery replicas

What it may hold: Point in time data, application or database copies, endpoint backups and old recovery media.

Ask the owner: Which systems or dates, catalogs, keys, overwrite dates, restore methods, cost and licensing are involved?

Likely contact: Backup administrator and provider.

Limits to confirm: Restore to an isolated environment. Ask the specialist whether an isolated restoration is justified, and confirm restorability with a test restore.

Sources: NI04; LG01

D21 Legacy systems and migrations

What it may hold: Decommissioned servers, previous tenants or domains, migration staging, historical exports and transfer logs.

Ask the owner: What moved, when, from or to which system, with what reconciliation and known exclusions?

Likely contact: Former owners, integration or migration team and provider.

Limits to confirm: A current system report can omit earlier data; old schemas, software or keys may be needed.

Sources: NI04; LG01

D22 CRM and sales systems

What it may hold: Customer or contact records, opportunities, activities, attachments, quotes and field histories where supported.

Ask the owner: Which objects, IDs, fields, audit or history features, attachments and integrations cover the dispute?

Likely contact: Sales operations and CRM administrator.

Limits to confirm: Standard reports may omit history, deleted records, relationships or linked files. Confirm vendor/version.

Sources: NI04; LG01

D23 ERP accounting and procurement

What it may hold: Orders, invoices, payments, approvals, vendor or customer changes and journals where retained.

Ask the owner: Which transaction IDs, attachments, effective or posting dates, approval records and audit histories are needed?

Likely contact: Finance, procurement and application owner.

Limits to confirm: Collect the approval, delivery, adjustment and bank detail change records with each invoice.

Sources: NI04; LG01

D24 Contracts and electronic signatures

What it may hold: Negotiation files, clause versions, signature envelopes, completion certificates and recipient events where available.

Ask the owner: Which CLM or electronic signature service, envelope or agreement IDs, history or certificates and linked exhibits exist?

Likely contact: Legal operations, contracting and signing service administrator.

Limits to confirm: A signature certificate is one part of the record; collect the identity checks and negotiation history with it.

Sources: DS01; LG01

D25 Document management and deal rooms

What it may hold: Matter or project files, version chains, comments, permissions, workspace activity and external shares where supported.

Ask the owner: Which workspaces, version policies, exports and external party copies should the specialist consider?

Likely contact: Records or legal operations and workspace owner.

Limits to confirm: Current document download can omit earlier drafts, annotations or workspace audit history.

Sources: NI04; LG01

D26 Tickets project and engineering tools

What it may hold: Requests, task comments, approvals, attachments, release or change records, code and designs.

Ask the owner: Which project or repository IDs, branches, issue types, revisions and external integrations contain relevant work?

Likely contact: Engineering, service desk and project owners.

Limits to confirm: Export relationships and linked artifacts may require separate requests.

Sources: NI04; EA01; IT01

D27 HR payroll and offboarding

What it may hold: Employment dates, role or device assignments, access change requests, separation and reimbursement records.

Ask the owner: Which relevant dates, devices, accounts and policy acknowledgments can be supplied lawfully?

Likely contact: HR, payroll, IT and counsel.

Limits to confirm: Restrict personnel and unrelated personal data. Offboarding can trigger deletion, token changes or wiping; coordinate preservation with counsel and security.

Sources: LG01; NI04

D28 Legal practice management

What it may hold: Matter metadata, documents, notes, billing, trust or accounting entries, communications, tasks and portals where used.

Ask the owner: Which modules, linked storage, client portal and separate exports are relevant?

Likely contact: Firm administrator, legal operations and provider.

Limits to confirm: Clio matter list export contains matter form data; other subtabs may be needed. Export each subtab the matter needs and keep privileged material segregated.

Sources: CL01; CL02

D29 EHR or EMR clinical record

What it may hold: Visits, notes, orders, results, medication records, amendments, addenda and signed or unsigned status as stored.

Ask the owner: Which systems, patient or encounter IDs, modules, authors, date types and export formats hold the relevant episodes?

Likely contact: Health information management and clinical application owner.

Limits to confirm: Confirm the vendor and site. A printed chart may omit audit data, versions, attachments or separate departmental systems.

Sources: HE01; HE03; HE06

D30 Clinical audit and provenance

What it may hold: Audit events, accesses, amendments, signatures, proxy activity and emergency overrides if recorded.

Ask the owner: Which events or fields, identifiers, clock settings, retention and reports exist? Ask for a legend and known gaps.

Likely contact: Clinical security or application owner and vendor.

Limits to confirm: Certification guidance describes capabilities; confirm the fields, events and retention in this deployment.

Sources: HE01 164.312(b); HE06

D31 Imaging laboratory and pharmacy

What it may hold: PACS or RIS images or reports, laboratory or pathology systems, medication and administration records if used.

Ask the owner: Which separate systems, identifiers, original files, result revisions and interfaces relate to the episode?

Likely contact: Radiology, laboratory, pharmacy and department IT.

Limits to confirm: Confirm with each department which events and files exist and what the EHR export includes.

Sources: HE01; NI04

D32 Patient portals exchanges and telehealth

What it may hold: Portal messages, upload or download records, referrals, health information exchange traffic and telehealth artifacts where retained.

Ask the owner: Which platform, patient or account IDs, sending or receiving organizations and interface messages are relevant?

Likely contact: Portal, HIE or telehealth owner and privacy lead.

Limits to confirm: Read account activity with the proxy and import records, which are where the examiner looks for who acted.

Sources: HE01; HE03; HE06

D33 Practice management billing and claims

What it may hold: Scheduling, check in, referrals, coding, authorizations, claims or remittances and adjustments if used.

Ask the owner: Which clinical or financial IDs join the records and what does the billing export omit?

Likely contact: Practice administrator, billing and payer or clearinghouse contact.

Limits to confirm: Billing, clinical and legal records can differ. Pair charge codes with the clinical records, which are where the examiner looks for the care delivered.

Sources: HE01; HE03; NI04

D34 Facilities and physical systems

What it may hold: Badge or visitor events, CCTV, building controls and vehicle or location records if operated and retained.

Ask the owner: Which camera, door or location IDs, overwrite times, clocks and system owners relate to the matter?

Likely contact: Facilities, security, fleet and counsel.

Limits to confirm: Confirm privacy and authority, preserve the time context, and pair badge events with video or visitor records, which are where the examiner looks for who entered.

Sources: NI04; LG01

D35 Third parties insurers and outside professionals

What it may hold: Vendors, brokers, advisers, counterparties, outsourced IT and external archives may hold distinct records.

Ask the owner: Who owns or controls each copy and what request, consent or order or contract right is needed?

Likely contact: Counsel, business owner and provider.

Limits to confirm: Obtain third party data through a lawful request agreed with counsel. Coordinate lawful requests and restrictions.

Sources: LG01 Rules 34 and 45; HE03

D36 Automations AI tools and integration copies

What it may hold: Prompts or outputs, connected data, workflow histories, generated summaries and intermediate files where actually retained.

Ask the owner: Which tools were actually used, with which organization or personal accounts, connectors and retention settings?

Likely contact: Application owner, users and provider.

Limits to confirm: Preserve the original record and its provenance alongside any generated text, and verify the feature and export coverage.

Sources: MS01; GO01; NI04