GDF Software for Cloud Collection and eDiscovery
Collect Cloud Evidence Once, Cull Early and Review Less
Email, files and chat for one matter now sit across several providers, and every duplicate that survives collection is paid for again in review. eCloud Discovery collects from Microsoft 365, Google Workspace, file sharing and collaboration platforms in one workflow, culls known software and duplicates early, and exports a review ready set with the collection record attached. GDF built it, owns it and runs it on its own eDiscovery matters, which keeps processing and hosting scaled to the matter.
Browser Based, Subscription Licensed and Owned by GDF
Supported Operating Systems and Platforms
eCloud Discovery runs as a browser based workflow. We confirm the current supported browsers and any source side utility or operating system requirements during a walkthrough, so your team knows what it needs before the first tenant is connected.
Software Licensing and Deployment Models
Subscription. Contact us for pricing. Because GDF owns its software, processing and hosting are scaled to the matter, and to small and midsize businesses as readily as to national firms.
Engineering Development and Enterprise Support
Developed, supported and owned by Global Digital Forensics, the same firm that uses it on its own eDiscovery matters.
The product
What eCloud Discovery Does for a Cloud Heavy Matter
Cloud evidence rarely lives in one account or with one provider. A single matter can involve mailboxes, tenant administration records, file storage, collaboration channels and on premises email, and each source has its own access rules, export behavior and audit trail. Collecting them one tool at a time multiplies the handoffs, the duplicates and the chances that something is missed or collected twice.
eCloud Discovery brings those collection paths into one workflow. It supports authorized acquisition from email providers and business suites, from file sharing services and from collaboration platforms, and it keeps the source context with the data. Once collected, the material can be searched, compared against NIST reference data, deduplicated and exported for review or for direct import into the eDiscovery tools your team already uses, so the review set reflects what actually needs to be read.
Email and business suites
Collect from supported Gmail, AOL, Google Workspace and Microsoft 365 sources, including tenant level and on premises email workflows, under the authorization counsel has arranged.
Files and cloud storage
Acquire authorized data and the available logs from supported services such as Box, Dropbox and ShareFile, so file activity and the files themselves arrive together.
Collaboration records
Collect supported Slack, Microsoft Teams, Zoom and related collaboration content with its source context, so a message is reviewed with the channel, thread and participants around it.
Search and culling
Search the collection, compare files against selected NIST NSRL reference sets to set aside known software, and document every exclusion and deduplication decision.
AI assisted search
Use assisted search to surface likely relevant material in a large corpus, with human review controlling the final cull and the record showing what the software suggested and what a person decided.
Review ready export
Export natives, metadata and the agreed load file formats for delivery into supported eDiscovery platforms, whether GDF hosts the review or your team does.
If your matter already has a provider list, send it over and we will tell you which sources eCloud Discovery can reach.
Methodology
From Authorized Account to Review Set in Four Steps
-
Connect
Authorize the supported accounts, tenants, repositories and collaboration sources within the matter, using the permissions approved for it.
-
Collect
Acquire the selected data and record the source, scope, time, operator and available verification details, so the collection record is ready for the examiner who later has to explain it.
-
Reduce
Search the collection, compare it against selected known software hashes and deduplicate it, recording the reference set version and each filtering decision.
-
Export
Produce the agreed files, metadata and load files, then reconcile the delivery against the collection record before anything reaches a reviewer.
Operating note
Where Provider Support Begins and Ends
Provider support, available data types, audit coverage and export options depend on the account, the subscription, the permissions granted and the provider's current APIs, and availability can change between provider releases. We confirm those details for your sources before collection begins, so the plan rests on what the provider will actually return rather than on a product name.
Not sure what your tenant’s export will actually return? Ask an examiner at (800) 868-8189 before the collection is planned.
Related Proprietary Software and Forensic Services
Confirm the Collection and Export Before Connecting a Tenant
Ask for a walkthrough built on the provider, the account type and the data sources in your matter. We confirm the available build and the access terms, then record the supported record types, the permissions required, the provider licensing in place and the export format for each source. You see exactly what each source will return before the collection starts, not halfway through it.
The source check identifies the tenant or account, the authorized administrator, the date range, the retention settings and the records a provider export can omit, so the legal team knows at the outset exactly what the collection will reach.
A trial handoff uses a small authorized sample to check native files, message attachments, family relationships, identifiers, timestamps and the field mapping of the receiving platform before the full collection runs.
Reconciliation retains the requested and exported counts, the filters applied, the duplicate decisions, the failed items and the records excluded from the review set, which is the record opposing counsel will ask about if the collection is challenged.
Data handling is agreed in writing before any credential or evidence is provided: the hosting region, the permitted users, any model use, the transfer controls, the retention period and the deletion method.
An illustrative export record lists one mailbox, its requested date range, the delivered message and attachment counts, any export errors and the receiving reviewer. Hashes verify the delivered files, and the reconciliation shows any gap between what was requested and what the provider returned.
Microsoft Purview source and permission requirements
Bring the account types and the receiving platform to a walkthrough and we will confirm the supported sources and the export format for each before a tenant is connected.
Talk with an examiner
Put eCloud Discovery to Work on Your Next Cloud Collection
Tell us the providers, the custodians and the scale. A GDF examiner will call or write back promptly to confirm the supported sources, the workflow and how the export fits the review you have planned.
Global Digital Forensics has served law firms and corporations since 1992. GDF owns its software and uses it to scale eDiscovery processing and hosting to small and midsize businesses.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .