Read this guide freely. Request download access with your name and email.
GDF records the selected resource in its lead intake and private Stats.
Open your emailed link for seven days of preparation downloads in this browser.
No marketing subscription is created. Keep completed records in controlled systems.
Help counsel and a forensic consultant identify relevant people, devices, accounts, repositories and short-lived records before collection.
Attorneys, paralegals, business/medical contacts, project coordinators and client IT
Employment, confidential-information and departure disputes. This package does not assume theft, recoverability, employer ownership of personal accounts or authority to access another organization.
Begin with the alleged events and dates, not a request for every record on every device. Ask counsel to identify issues, custodians, time ranges and preservation priorities. Include records that may support or contradict the allegation.
Account disablement, license removal, transfer of ownership, device wipe and replacement can affect evidence. Coordinate security containment and preservation with counsel and authorized IT. The package does not require delaying necessary containment; document what changed and when.
A cloud-sync icon does not establish that a complete file resides locally. An email can link to a cloud document rather than attach it. Content, versions, sharing/access records and identity events may require different requests.
Federal and New York practice differ. Counsel should review preservation, proportionality, possession/custody/control, privacy, privilege, local rules and case orders. New York CPLR 3130 limits use of interrogatories in specified circumstances; commercial and uniform rules impose further limits. The sample questions are a drafting bank, not a ready-to-serve set.
Give each request to the suggested owner. Record what is available and what is unknown in the editable CSV checklist. Use a secure evidence location agreed with the recipient; the checklist is an index, not a place for passwords, real patient data or controlled technical information.
Records to find
Download the editable gathering checklist. CSV files contain plain records, without saved column widths or workbook formatting. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
EMP-R01 Matter facts and timeline
Ask
Counsel and HR
Gather
Employment/role dates, departure timeline, relevant business files/events, parties, issues and permitted time range.
Where to ask
HR, manager and counsel
Why it may be needed
Directs a proportionate information request without presuming wrongdoing.
Hold instructions/implementation, relevant retention settings, pending deletions, license changes, account disabling, wipes and replacement/reassignment records.
Where to ask
Counsel, messaging, identity and endpoint owner
Why it may be needed
Identifies time-sensitive risk of losing relevant information.
If missing or uncertain
Escalate imminent deletion or unknown hold coverage; no guarantee that a late hold recovers deleted data.
Download the response template. A useful answer names the actual system, period, supporting record and limits. If you do not know, name the person or provider who can answer.
1. Which accounts and devices did the person use for the relevant work, including shared and renamed accounts?
Suggested responder
Client IT or system owner
Useful supporting record
Identifier crosswalk with dates and ownership.
2. Which offboarding actions have occurred and what remains scheduled?
Suggested responder
Client IT or system owner
Useful supporting record
Dated action/change records and preservation confirmation.
3. Where do linked cloud files live, and who owns the external/shared copies?
Suggested responder
Client IT or system owner
Useful supporting record
Exact tenant/site/share/workspace IDs and owner list.
4. Which non-email tools did the person and coworkers actually use?
Suggested responder
Client IT or system owner
Useful supporting record
Custodian interview notes with apps/accounts and purpose.
5. What event types were logged at the time and how far back can each source be retrieved?
Suggested responder
Client IT or system owner
Useful supporting record
Coverage/retention table, earliest/latest examples and field legend.
6. Could a device, account, IP or badge have been shared or used by an administrator?
Suggested responder
Client IT or system owner
Useful supporting record
Assignment, delegation and remote-support records.
7. What migrations, deletions, license changes or policy changes may have affected records?
Suggested responder
Client IT or system owner
Useful supporting record
Change log with known gaps and decision owners.
8. What can a permitted export omit, and which errors or unindexed items need separate work?
Suggested responder
Client IT or system owner
Useful supporting record
Export process report and documented limitations.
Sample questions for counsel
Sample questions are drafting prompts for counsel. They are not a complete discovery request or a direction to serve them. Define the event, source, period and parties. Check relevance, proportionality, privilege, privacy, possession/custody/control, current local rules and case orders. Federal Rule 33 ordinarily limits interrogatories to 25 including discrete subparts absent stipulation or order. New York uniform and Commercial Division rules and CPLR 3130 impose separate limits and restrictions; especially check the interrogatory/deposition choice in negligence personal injury/property/wrongful-death actions. Split or narrow prompts only as permitted; do not disguise subparts. Use a document request, interview or deposition topic where that is the appropriate device. No requests are sent by these packages.
Supporting procedural sources: LG01, NY05, NY06, NY07 and NY08. These questions are separate from the internal IT interview.
Identify the custodians of records concerning [defined disputed event] during [period] and each custodian role.
Identify the devices assigned to [person] during [period], including their unique identifiers and current custodian.
Identify the business accounts used by [person] for [defined project], including aliases and shared accounts.
Identify the repositories holding [defined project records] during [period], their responsible administrators and relevant external owners.
Describe the retention/deletion settings applicable to [defined source] during [period], including material changes and known data gaps.
Identify the log sources that record [defined activity] for [period] and the person able to explain their coverage and fields.
Identify the preservation and collection actions actually taken for [defined source], including dates and persons performing them, without requesting privileged advice.
Identify responsive sources not searched or produced and the factual basis for claimed inaccessibility or limitation, subject to the applicable rules and orders.
Example only: A returned laptop contains an online-only shortcut to a project folder. The coordinator records the shortcut and asks IT for the tenant/site owner, relevant versions and sharing records. The specialist chooses a collection method; the coordinator does not conclude the laptop contains the full folder.
Missing facts and specialist decisions
These are explicit handoff questions. Marking records Received does not resolve them. Add client-specific questions and a responsible person.
EMP-Q01 What sources and time ranges are proportionate and within lawful possession, custody or control?
Ask
Counsel
Gather
Claims, issues, chronology, ownership and proposed source inventory
Resolution needed
Counsel-approved scope and authority before collection; preserve separately where required.
EMP-Q02 Can the relevant activity be attributed, and what alternatives remain?
Ask
Forensic specialist
Gather
Original records, timestamps, IDs, mappings and limitations
Resolution needed
Expert analysis after collection, not a conclusion from a checklist or isolated log.
Issue/date/custodian scope and authority are agreed with counsel.
Imminent deletion and offboarding actions are recorded and escalated.
Cloud/archives/backups and business systems are addressed alongside endpoints.
The source inventory distinguishes possible, confirmed, preserved and collected locations.
Download the record index. Use the shared walkthrough for custody, restricted records, missing information and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. Actual contracts, facts, configuration and case orders still matter.
