Technical methods and scope
Find the Overlooked Sources Before They Become a Supplemental Production
An unlisted Salesforce organization, a Slack workspace that arrived with a merger or a data warehouse nobody told legal about can hold the records the initial custodian list never reaches. Identifying those sources before collection lets counsel answer the information request with a clear understanding of the business systems rather than learning about them from the other side’s motion.
Global Digital Forensics has served law firms and businesses since 1992, and our founder, Joseph Caruso, has worked with mainframe databases, real time transaction systems and source code since 1980, which is why legal teams bring us the systems that defeat a standard collection tool. We combine structured interviews, confirmed queries and supported discovery tools to identify where relevant records reside, who controls them and how they can be preserved, and we deliver the inventory as a documented record that later collection can rely on.
Identify the Business Repositories That Hold the Records
The source inventory records what was learned from authorized interviews, system records and confirmed queries, with validation steps, inaccessible systems and open locations named. The result is a usable map of the work completed and the questions still being run down.
We look past the formal application list for business records held in unofficial tools, such as a business unit’s own video meeting account, an unregistered notes workspace or deal documents kept in a personal cloud drive. Those candidate repositories are assessed through the authorized source mapping process and any additional access steps they require.
The environments we map most often are familiar ones with unfamiliar corners.
Microsoft 365 mapping covers Exchange Online, SharePoint, OneDrive, Teams and Viva Engage, each with its own records and export path, and Google Workspace mapping covers Gmail, Drive, Chat, Meet recordings and shared drives in the same way. Slack mapping identifies the standard and private channels, direct messages and connected workspaces that remain available, and Salesforce can hold email logs, activities, case notes, documents and internal feeds that never appear in a mailbox.
Beyond the suites, data warehouse and lakehouse platforms hold analytical records relevant to many commercial disputes, cloud infrastructure accounts hold object storage, managed databases and retained activity logs, and ERP, financial and HR systems hold the transaction records within the authorized scope. On premises and hybrid SharePoint installations, cloud file repositories with comments and version histories, video meeting platforms with retained recordings and transcripts, and backups, archive tapes and retired server images complete the picture, and each is assessed for access, retention and preservation path before any collection is planned.
Describe the sources and the production format, and a senior specialist will map the collection.
Connect Each Custodian to the Data They Left Behind
We connect each identified source with its relevant custodians, access rights, data types and available periods. That matrix drives preservation and collection decisions and is updated as the source record changes, so the legal team can see at a glance which people touch which systems and where a hold needs to reach.
Access and audit logs show account activity wherever the relevant events were configured and retained. The matrix flags shared accounts, missing logs and actions taken through integrated applications, so the hold and the collection reach every account that touched the data.
A Documented Source Record That Defends the Search
The Source Identification Report records the methods used, the systems identified, the custodians interviewed, the queries executed and the scope decisions the attorneys made. When the adequacy of the search is questioned, the legal team can explain how the source population was established and which evidence informed each inclusion and exclusion.
Counsel can use the documented source record when preparing Rule 26(f) discussions, discovery responses or answers to questions about search adequacy. We retain query timestamps and interview records and supplement the report as new information emerges, so the record grows with the matter rather than being rebuilt for it.
Call (800) 868-8189 or send the discovery schedule to plan the work around it.
Your Source Map and Identification Report
The source mapping package connects the inventory, the custodians and the scope decisions in one documented record that collection, processing and review can all rely on.
The Source Identification Report explains the systems found, how they were identified and their relevance to the matter, and the data map connects each source with its data types, custodians, available dates and collection status. The custodian matrix aligns people with their data footprint across the identified systems, the shadow IT record documents the unofficial or unapproved platforms found during the review, and the scope memorandum records the inclusion and exclusion decisions for the disclosure or production that follows. Call (800) 868-8189 to discuss the systems in your matter before collection is scoped.
The data discovery case study shows what the work looked like when the live system was gone and two terabytes of raw records remained.
