Video: 6 Biggest Pain Points and Solutions for Collecting Modern Attachments | Duration: 3592s | Summary: 6 Biggest Pain Points and Solutions for Collecting Modern Attachments

Transcript for "6 Biggest Pain Points and Solutions for Collecting Modern Attachments": Hello, everyone. I'm gonna give it a few seconds here as a few more people join. It's so great to have everyone. This is such an exciting conversation. Obviously, modern attachments is such a a big topic in the market right now as we're seeing and hearing. Today, we're gonna be talking with Steven, Jeremy, Sam, and George, 4 fantastic speakers with a wide variety speaking from in house experience, LSP experience, and in house. So really excited for this conversation and to really get into it. Those who don't know me, my name is Jacqueline Murphy. I'm a marketing campaigns manager here at Reveal. A big part of my job is putting on webinars like this. So at the very end of this webinar, you'll get a small, survey just asking for any more ideas or different topics that we can bring to the surface and more speakers that we can kinda bring in to just really educate and bring really cool conversations, to the light. And in addition to, putting on webinars like this, I'm also gonna be a moderator here in the chat. So as you have questions or different comments or if things don't work for you or if anything's being buggy, feel free to send message in the chat, and I'll make sure to that I'm watching it and my team is on it. Today we're gonna be going over a lot of really cool conversations within modern attachments. But before we get started, I just wanted to share a couple of key items or key things to know, that there is a live q and a session at the very end of this webinar with all the speakers that you are hearing from today, and there will be a survey as I mentioned earlier at the very end of this just to kinda get your take and I see and make my job easier to make sure that we're bringing great conversations to you. This conversation is being recorded and will be available on demand following this. And finally, if you would like to request a demo at any point for Reveal or any of its products, you can click the request Reveal demo button right above me. This will be for any of our products, including some of the ones that, will really help with the modern attachments. With that said, I'm gonna pass this off to George to get started here. Welcome to today's webinar where we are going to tackle the ever persistent problem of modern attachments. We are not by the way going to spend any time debating what we call these things modern attachments or something else that's a whole another discussion. I have with me 3 great panelists. I will let each of them introduce themselves and then we will get into the meat of the matter. I am George Scioscia. I am SVP of brand awareness at Reveal and the moderator for this session. We'll go first with you, Steven. Great. My name is Steven Gresh. I'm a director of forensic technology and consulting with TransPerfect Legal. I've been working in the discovery field for about 13 years, and that's with digital forensics as well as ESI hosting and review. So I've seen everything from, burning scan docs to CD to using AI and tar to, get into more modern review. Provide data collection strategy for ediscovery council and oversee forensic collections, investigations, and expert testimony. Prior to joining TransPerfect, I, was into processing and hosting. So, like, here we have big, wide view of lifespan of data after the point of collection and interest in maintaining the integrity of data throughout the life cycle. Thanks, Steven. Jeremy? Hi. I'm Jeremy Robertson. I'm the discovery manager at Peloton. I've been in the ediscovery industry for about 16 years as well. I started off on the product side, product management, moved over to vendor side, and now I'm responsible for our ediscovery collection, ESI protocol working with vendors and outside counsel. And Sam. Hi. Sam Sessler at Norton Rose Fulbright. I've been with our firm for 13 years, in the industry for approximately 17 years. I manage our global lead discovery services team and cyber team. And before NRF, I was at PricewaterhouseCoopers where I did digital forensics and, advisory lab management. Thank you. So let's, for our audience. So you all know today, the way we've got things set up, we will have our discussion for about 45 minutes initially and then we are reserving the final 15 minutes more or less for q and a. I'd like us to start at the beginning if you will with what what are we talking about when we talk about modern attachments. And I'm gonna do for the 3 of you what I'm gonna keep doing for the next 45 minutes, throw it out there and see who grabs it first. Who wants to take on the definition of modern attachments? So I'll kick us off. I think, that's a highly debated question. But for most intents and purposes, for collections that we do, it's linked documents that exist within the same environment of an email or a message. So that may be Gmails with Google Drive or OneDrive and Exchange emails. And that's that's how we've typically handled them. Sam, any any spin or additional thoughts on that? Yeah. I would I would definitely agree with Steven. The industry typically accepts that the the linked document that individuals are collaborating in, whatever version of that document it might be, that's, for further conversation, with what you would see within a corporate environment. There are other forms of modern attachments that may exist in a non corporate structure, or a linked attachment. We don't commonly, collect or preserve those, sources of information often but, it does come into play. So there are other definitions unfortunately and these spaces ever ever growing and more complex as everyone So, Jeremy, are you gonna help clear this up or make it more modeled? Well, I would just add one more thing. Everything I agree with everything everyone's saying. The one area that I would add is we also, from an in house perspective, look at Slack attachments and for people using Microsoft Teams or other chat platforms, those would also be considered modern attachments, something that doesn't necessarily come directly with a specific email or message attached anything that's linked out. And so, we'll use that. Sometimes we might look at your end confluence as well, because those are linked out as a lot, but those are not as, often asked for, depend on the case as, like, Google Drive or other documents in Slack and email. What then is the problem here? Why are we talking about this, and how does this differ from what we've been dealing with so many years with attachments to email messages? I can I can give you an update from an in house perspective, which makes it a lot of fun is when people now with the collaboration tools, we are able to work across the world? Right? And you can give access to multiple people that that increases our ability to make changes real time, not have to be in the same room with each other. At the same time, when we send out links, versions change. Not like your traditional email where we send out a word document and you know that is the word document that they see or you send out a PowerPoint. Now with the collaborations, when we send it out, the problem is what version are people actually opening it at. Right? Some days you might be very busy at work and you won't have the ability to open it right away. People will have updated it and then you open it up 2 days later. The other issue is that since the record isn't directly attached to it and it's linked out to another location, our technology isn't quite there for all products to be able to just pull those direct versions at the time, which is causing which is where we run into some issues. So so is that the problem we're talking about or are there yet more issues? Sam, Steven? Yeah. I'll I'll jump in there. I think Jeremy hit it right on the head. The the tools are not, fully, you know, supportive of version history he mentioned. However, there are there are now a lot of tools that are coming into market as well as, recent, actually, recent core decisions that have pushed technology companies to now support the preservation and collection of multiple versions of of modern attachments depending on the technology. So, the native application, the native compliance tools are starting to catch up. And so parties from an from an outside counsel stand standpoint, parties are now expecting, the ability to collect, monitor attachments, preserve those attachments, and in some situations, identify which version was actually that point in time, in their review and production. So while some tech is lagging, others are catching up and expectations are now being set accordingly, which makes our lives both, easier and more difficult at the same time. So there are some there are new technical challenges which come with this new way of associating files such as word processing files or presentation files. Using them rather. Not even associating with something else, but just using them. And there are changing expectations about what opposing parties can do, what organizations internally can do. Let's take a look at the the, expectations because I I think will help, bring to light some of the technical challenges as well. And I'm gonna start first with so I'll start with you, Sam, as the law firm. From the law firm perspective, a party receiving a request from the other side or beginning to have discussions with the other side about how to go about dealing with these things called modern attachments? Because often the law firm is the first point of contact in this situation. What do you see? Yeah. The the expectation of scoping appropriately is, is really set now. I think that expectation of identification and scoping has always been a expectation. However, those conversations are different in the sense of, how we scope for modern attachments, how organizations are collaborating and sending documents and storing documents. I mean, Steven, for example, you've over the years, I assume you have dealt with document collection on devices and, on premise repositories now. We are collecting any and all versions of documents in the cloud in the form of a modern attachment. Right? So the expectations of of scoping are very important from a law firm perspective. Understanding how our clients are collaborating, what their licensing looks like within their organization. Are they on a E5 license, an E3 license? What does their Google environment look like? All of those considerations come into play in those initial conversations. If you miss something, you may go down a path of a collection methodology or a negotiation with an opponent in an ESI protocol with, regarding what you can and and cannot do. So it's important to have those conversations early. And even even if you don't, you you don't get, you get another bite at the apple, so to speak. So don't my advice there would be, non legal advice, of course, would be constantly revisit that conversation with your client, with client IT and with your service providers as well because it could impact how you conduct downstream workflows. Jeremy, you're the client. What's your take on this? Yeah. So, I mean, everything Sam said is true. Like, we actually have to set so first off is all about collaboration. Right? You have to work with your in house counsel. You work with our outside counsel, and then we're also working with our technology provider as well. The more under the more I understand about our systems and the more information I can give will make us better partners. So in these cases, having a really strong legal hold and be able to do in place preservation is really important, especially with Google Drive documents so that we're not able to change ownership so that links still work so that we will be able to tell the team what we do have the capabilities of doing. I also look really closely with our outside counsel and technology partners to tell me this is how we've been doing it. I'm not up to to speed with all the latest technology advances. I try to be, but there's going to be as a provider, you're going talk to so many more my clients. Right? So you're going to see so much more. So I like to be very upfront with what we have. What do we do? This is how we preserve it. This is how we typically collect data. These are different systems. And this is how we do it. Let's put that in the ESI because I don't want any surprises. As well as we can. We want to try and cover the 90% of it. We can, because when you're doing custodial interviews, you're going to find out that use something that we might not have called out right away and that we might not have a process put together. But that's where, as long as we get that 90%, I feel like it really helps our outside counsel set the standard and allows us to look well prepared for the court. And if there is some adjustments we need to make, it's not as massive of an adjustment, and that usually protects us. And and Steven, are you using that level of sophistication and understanding with the other corporate clients and law firm personnel that you deal with? No. I think it really varies. We see folks that still want everything printed out on paper for review to very, very sophisticated clients who have done these a 100 times and, you know, tend to know more about their internal systems than we may at the point of collection. And so that early, consulting and conversation really comes in handy when it comes to dealing with the, IT team, for example, and the systems admins to know that that legal hold may be put in place, for example, or that the, in house counsel is communicating with outside counsel. And we, as the vendor, tend to be, sometimes, the communicative glue kinda holding that together and making sure all the teams are are up to date and also where those gaps may lie. So for example, with, you know, the modern attachments, they may not have even heard of modern attachments before. And so we may be the ones telling them that's something you should look into and maybe hear some documentation and some court cases or what have you. Or they already know. We need these. We want these. We need the version in time or the current version may work. So it really does depend. And it also, you know, with things coming up in the news and and court cases that that hit you know, you may get buzzwords, but maybe their idea of what a modern attachment is, They've heard of it, but they don't necessarily know, how it applies to review or or how it's going to come together at the point where, you know, maybe they know we need to collect it. We need this thing. But they don't necessarily know what to do with it once they have it. And so not only from the point of collection, but also from the point of, downstream kind of processing review, what is the coding panel gonna look like, that kind of stuff. We definitely see a very wide spectrum of of sophistication from from client's counsel, etcetera. What I'm hearing is that from the law firm and from the corporate perspective, there can be very different starting points, very different perspectives, very different levels of understanding, and therefore very different expectations. We've got another factor in the mix and that's what the courts have been saying about all of this. Anyone care to enlighten us as to where the courts are at these days with respect to modern attachments recognizing that not all courts have the same view? I can start. Although, I'll leave it to the professional lawyers and such to to kinda jump in. But, you know, we've seen, both again, a wide array, but also an evolution of understanding and what the courts want. And then we've also seen requests for production that may come for from example, like, 3 letter bureaus, like the SEC or some such, where they'll they'll have a very strict definition. There's no room for negotiation. But, you know, 3, 4 years ago, somebody said undue burden. Court said, okay. This isn't an attachment. Doesn't matter. And now we're seeing things like the, Uber case with the, sexual assault that came up where the court defines the modern attachments as attachments, but to be treated differently. And, really, the conversation and and what they were assessing out had to do more with, how they were going to be handled as opposed to whether or not they were modern attachments or whether or not they needed to be collection collected. So they would say, yes. We do need to collect these. Yes. These are attachments, but how you handle it is is open to negotiate. Maybe I shouldn't go here, but I'm going to. From each of for any of you who care to weigh in on this, to what extent do you think we should be looking to the courts for guidance about how to handle modern attachments? To what extent do you think we should be looking elsewhere more folks more on the technical side for for example? Anyone can go with that? I'll I'll jump in. I'm not a lawyer, but, I I have, you know, I have a thought that, just just from working with lawyers for so many years, what's reasonable versus what's, unreasonable and what's burdensome versus not. Because the ability to collect and preserve modern attachments is now widely possible at a low cost in most circumstances. And if we have information that states that, that data may be unique in substance, then we may have the obligation to collect it, preserve it, review it and potentially produce it. And that wasn't the case before, right? The technology wasn't there. As Steven said, just a few years ago, it was easier to side on the burdensome argument, but that is no longer the case. And so, looking outside of the courts and and focusing more of what is technically capable, what's reasonable, and and ethically, what are we obligated to do, I think that's where we look, in my opinion. So so, Jeremy, you must talk with your counterparts in other corporate organizations. There has to be a sense, as to how this should be handled and and whether what Sam just lay outlined as a a a reasonable approach to take. What what are you hearing and seeing? So, I mean, I like to do a mixed approach. Right? And this is where discussing the ESI protocol is really important to us. I feel like as long as we come with information in the beginning of what we can do, what we can provide because it's still a newer field. People are more willing to accept it because we're not being as rigid. And so a lot of times it depends what we'll do. One other thing that people don't always notice is when you're collecting a lot of these documents anyway, you're already collecting these links in in the Google Drive documents. And so you're usually already providing them some sort of versioning of it. So going back to that, it's a mixture, right? And then going back to the ESI protocol as long as and our relationship building is telling them, okay, let's this is what we do have. This is how we will provide the information when we do our reviews. As Steven mentioned earlier about the coding panel, we like to have an area with linked documents. So that as we're going through the review, even if we're not necessarily giving it all right away, we can start and providing the documents to our outside counsel. So they have a better understanding. And again, if we provide our team with information earlier, they can come up with a strategy that helps, helps us look like we're being partners, which we are, but also protecting ourselves and protecting the information we give. And so usually we will try and limit because a lot of the links are the same links to. That's something that you also that's where the burdensome comes in. Because when you're collecting documents, usually these documents are being shared amongst the same type of people, right? Because you're collecting maybe they're higher up VP's and they're all having the same links. Right? And so you have to be a little bit smart about how are we collecting what are actually links. The other problem you may have is when people send emails, they don't think about it through ediscovery lens. They might send, they might highlight something in blue and underscore it, which makes it look like a link. Right? And then from a lawyer's perspective, they might see them. They're like, why didn't you provide this link? We're like, sorry. If you look at the code in the back, it's not actually a path. It's just someone used wrong highlight. Right? And so there's always going to be a little give and take. But I feel like what has worked in the past for us is as long as we're open, as long as we explain to our outside counsel are outside counsel have been great at being able to shield and provide enough information that we're following standards and we're, not overly burdened, but still being able to put in some work to get that information. So, Steve, are you to Jeremy's point because I thought all those are really good in terms of really just the flexibility of an ESI protocol. Because some of the examples Jeremy mentioned while technology is catching up and and supporting the collection of modern attachments, if your ESI protocol is inflexible, and for example, the technology does not do a great job, whether it's at the point of collection or processing or even production, it does not do a great job of putting Humpty back together again. So the while you may be able to collect the modern attachments, the context in putting the family relationship back together is quite difficult actually. And, while there are few tools that can help you along the way, if your ESI protocol is inflexible and it forces you to put those relationships back together while relying on cloud metadata and other custom workflows, it can create a very burdensome process. So I very good points, that Jeremy raised there on the protocol. Yeah. And before we move on, we see that on the technical side too. I mean, the amount of kind of custom scripting work that we need to do to put those family relationships back together. Together. And then whether or not you're even calling it a family. Are you saying it's a parent and a child? Are you calling it a parent and a linked attachment and you have a custom field for that? You know, all of those things need to be discussed, you know, in order to to have a production and have both sides agreeing. And so that early communication, those ESI protocols are really huge to to know, bless you, to know kind of what we're we're getting into when it comes time to collect. Because you you can do a collection. It can be fine. It looks great. There are no errors, and you put it through. And because it was exported a certain way through the the platform that, you know, internal message ID you might need inside of an email to link that back together again isn't there. And now you have to go back to the well and redo it because there weren't any errors, but you didn't have that one new piece of metadata or that one piece of metadata that may normally exist but wasn't in that export. And that that landscape has really changed quite a bit and become a lot more particular, especially when you're talking about versioning, but like putting families back together, definitely. So I'm hearing that on the ESI protocol side, it's really important, 1, to bring up this topic, 2, try to structure something that's got some flexibility in it so you don't get locked into your own rigidity and create problems for yourself along the way. And 3, even at that stage, it's already a time to start talking about the various technologies you might have to deal with and bringing up some apparent limitations. Am I missing anything on that front before we move to workflows? Yeah. Let's jump to workflows then. How do you make this happen? And let's start this time with you, Steven. Yeah. We'll get into the collection side and then, you know, we can kinda go in phases maybe. But from a collection standpoint, once you know you need them, you have the credentials, you've worked with IT team and house counsel, outside counsel. You're you're kind of ready to go. Then, you know, there really are new considerations that come into play when collecting these documents. Now maybe it's something like in Google Vault where you can potentially collect versions as they existed in history, but then the metadata may not work right. So as as a forensic examiner, I'm really concerned with not just collecting these things, and, again, did that collection finish without errors, but, also, what is the life cycle of that document or that data gonna look like at the point where you're reviewing and producing? And many times, especially with collaborative platforms, like, we have OneDrive, like, with with Google Drive, that kind of thing, You don't get that metadata unless you have these XML overlays and very technical logs that come out with the export. And then the the teams need to overlay that because a lot of current processing platforms just look at the file in the file system metadata. They don't have the apparatus to necessarily overlay that that custom metadata. Even though it's not custom in this case, it's just provided separately. So from a collection standpoint, there are quite a few factors that we need to evaluate when we're looking at grabbing the data in a defensible manner. But then, you know, what do you do with it once you have it? And and, you know, we can kinda get back into that in a in a minute. But that the those considerations also really come up at the collection standpoint because you can, again, collect it. It can be perfect. It can look great. And downstream, they still can't use it. So we have to be very careful with that. I'm not hearing that there's a modern attachment collection easy button out there. Unless Sam or Jeremy, you see that? Yeah. It's I'll weigh in on what Steven was describing. There's definitely not an easy button. There are a lot of forensic tools and e discovery tools that allow you to do, you know, a more effective collection of modern attachments. The the the list is short. We found that the native tools do a really good job. But there are times when the forensic tools are necessary. An example of that is Steven was describing the cloud metadata versus the application or system metadata that you would have that, is traditionally extracted, during a discovery processing from a native file. You have to know which cloud metadata you should rely on to, and what to overlay. There are there are some situations where you nest you need that information in order to have context. There are other situations that we've seen specifically with M365 or Microsoft Purview, where some cloud metadata is incorrect, depending on how you plan to use it. And so it can it can create, improper context if if you don't know how, to use it and where it originated from and what it means. So, there is no easy button, but those are some of the issues that we have run across as well. Yeah. I'll I'll add to that. So we are a Google shop and the metadata is a really big thing because the collaboration tools for Google, you're using Google Docs, Google Sheets. Right? They're not actually word documents, so they're not actual solid documents. It's not like any of some mailed letter in your mailbox anymore. Right? So we have to when Google collects those documents, they convert it into Microsoft words. They convert it into Microsoft Excel. And if you don't get those XML files, your date created, date last mod will all be off. That also adds to so this is something that I going back to the yes I protocol I like to bring up Google has collaborators and fewer metadata. So that is only available for the time of collections. So where that makes it hard, though, is a lot of times if you go back and you're trying to collect older versions, the viewers and collaborators might be different. So I might have added someone and taken them off or move them. But that is very important. Metadata for us. It's not always asked about on the ESI protocols as well. So again, that's something that I try and partner with and tell them this is something we can do, but certain tools won't allow you to collect that information. So you also have to be careful with different forensic tools that you have because some forensic tools will only collect like the date created date last mod. So Google vault provides it. But then you have an X M l file that you have to do an overlay with, crazy ID numbers to try and match it up. So that's where we look at our vendors to do scripting to try and help it. Because if you're doing a massive collection, manually updating those overlays are really hard to do. It causes problems. So And if I can piggyback on what Jeremy is saying, you know, I think 2 things come up with that type of process, which, again, I can't emphasize enough communication, constant updates, that kind of thing. But also, at the beginning, even whenever these types of new workflows are being considered, you have to talk to client's court, opposing counsel about data sizes and time. Because time is money, it's gonna maybe be more expensive. But these processes can take a bit longer because they're nontraditional. Sometimes the the workflows change weekly or monthly. I mean, last week, Microsoft Purview was down for 2 days while they were trying to fix some glitches. So anybody trying to collect modern attachments, knowing the workflow where you need Purview premium, weren't even able to get anything done. And so it changes constantly, but that tends to make things take longer and typically be, you know, a bit more expensive. But if you're collecting every single version of a document that, you're now wanting to target those few that you need, which is one of the workflows I've seen, that's gonna be 10 times your normal data collection size. So that then turns into longer turnaround times and and typically more money. Part of what I'm hearing in this discussion is that unlike what we've gone gone accustomed to with email where we've we think we've got it all figured out and we think we know what to do, here it sounds like there are still a lot of variables that can change greatly. And we are in a situation where it sounds like from a lawyering perspective, so I'm gonna put my lawyer hat back on even though I haven't worn it a while, from a learning perspective it's really important to try to frame the discussion early on both with your client and with any opposing parties or investigators, whoever it might be, and then try to keep that framing such that you can keep coming back to modify, revise, and change as you run into challenges. Discover you can't get the information you thought you were going to be able to get. Realize you can't connect things together the way you thought you would, or realize you can do all of this stuff you wanna use it but you can only gonna get a chance to use it if you also give it to the other side. Is that what you all are seeing? Any of you? Yeah. I think so. I mean, if if if done well, yes. Absolutely. And you'll see that the more you know, I'm not gonna talk too much in-depth about transparency, but the more transparent you can be on this issue, it usually ends up to be a good thing depending on the situation. I I like the fluency and the idea that not all the windows in your house have to be transparent. You can pull down the shades on some of the windows, and that's entirely okay. I like that. I like that. I think others would too. But, no, I would agree. And and, you know, to Jeremy's earlier points about, you know, access control around Google Drive links, That's an example of you may not find that information out until later into the process, and you may need to revisit what you can and can't do. And it's important to have the ability, whatever tool or process that you're using, to have really good logging, capabilities because you'll often find that a collection, for example, may look complete, but you need to go back to the well due to, a dead link or retentions, history, etcetera. So it's you know, you you will often see that coming full circle, and dealing with these issues is a pretty common scenario. So not not uncommon at all. Jeremy, you mentioned oh, go ahead. I was gonna say it also kinda depends on the temperature of the conversation. You know, we get into some cases where it's very contentious, And and so folks aren't really as willing to come back to the table for meet and confer or revise the the protocols and such. And so I think retaining experts to, when needed, in case there's an need for, like, an an affidavit or declaration saying, this tool that you said we have to use doesn't work for these reasons here, and why we recommend using a different tool or using, you know, few different tools in order to to achieve the goals. So just be one kinda add on to what Sam was saying. But generally speaking, I think, again, that was also kind of an earlier problem. It's always gonna be a problem. But as courts and councils and folks have have become a bit more informed on the subject, this seems to be one maybe silver lining is that I think everybody understands that this is a difficult topic to try to tackle and are more willing nowadays to kinda come to the table and have those conversations. Jeremy, you talked about some of the challenges specifically with with respect to Google. We've got, of course, Office 365 or m 365, whatever you wanna call it, and Slack as well as other various platforms. What other platform specific challenges do you all wanna raise here? Well, so one of the challenges I that we found out a little bit through all the different testing and going back to the well is sometimes the other thing that you can run into in Slack or any other thing that you send these links out is before someone goes on legal hold say they leave the company a lot of times are you have to look at what your off boarding schedules like do you put documents in a shared folder? Do you change ownership of records? How do you handle those type of records? Because you might not know that there's gonna be a litigation. You might not know, but you need to have these for business continuity reasons by changing the ownership of these records though it does. As Sam mentioned earlier it can break your links because now you change the Google ID. So these are little things little problems that I keep on going back to this and this is I love your translucent thing, but I'm very transparent with my outside counsel is if I tell them everything, they can decide where to pull up the shades and where to let the shades down, but they have that information because I might tell them, hey. Let's let's let's give we'll give them a list. They can choose a 100 or so records, right, that will find the files. And there might be some that the links don't work. Not because we deleted or not because we didn't preserve it, but because they changed ownership before the legal hold was put on place before this happens. I feel like being us being able to talk about that allows us to not look shady and to look like we are doing our part and we are not being a roadblock and being better partnership. And so that's that's those are some challenges that I've seen, being with just, like, links in general in Slack or Google Drive. And there's gonna be more stuff that we find as we continue to do this more and more and being flexible is the best, easiest way to, combat these kind of information and being open to new technology as we see. And then also from my perspective as an in house to test these technologies out and then to give feedback, based on, like, how we do our processes. Dan, Steven, other challenges from the various platforms out there? Yeah. Well, I think, you know, we've mentioned Slack and really, I think it circles back to what we're talking about at the beginning of the conversation regarding, you know, what's in scope and what is that corporate domain. Because you might have links from Atlassian projects from, like, a Jira ticket or something of that nature. It may be from Slack. It may be from email. But it's referencing back to I'll just stick with Google Drive, for example, and you get that Google ID. And you know, oh, I know what that hyperlink looks like. That's definitely coming from Google versus maybe something that goes outside of the domain and see whether or not that may be in scope. But so you have this plethora of sources, and then you need to kind of funnel it down into whether or not it's gonna be relevant if it's in scope. And then how do you fit these different shaped pieces into, you know, the the processing workflow or the review workflow. And so as Jeremy said, there's tons of of individual kinda custom workflows and and troubleshooting and and considerations that come into that based off of the data sources. But the one good side of that is if you do have most of those documents that are being linked to in a single environment, then once you've figured out how to put that list together of what you need, the collection side of it can be a bit more straightforward because maybe you have those Google IDs or you have that one environment that you're collecting from. So so that part can be the the good news as it were. Sam? I had a few point yeah. A few examples to along those lines. There are some products that are commonly used in a corporate, ecosystem, like box.com or, other document management systems that do keep versions of documents, and they do audit, user activity. The the challenge is a lot of those compliance tools that are built into those applications are are still, in my opinion, a little immature. And so a collection or an extraction of data becomes more difficult versus, m 365 or even Slack or Google, Workspace. And in particular, as Jeremy and Steven were describing earlier around, the Google Drive links, if there is a user modification to a document, even, a location or an action taken to that document to modify it, the the link does break or can can break. And some of those other platforms, some of those other document management systems, you have to go and and pull audit logs to, recreate those those references, those links. It becomes very, very expensive and and difficult to do. And so the reasonability aspect comes into into play when you're dealing with, you know, tools that are commonly used in an enterprise but not, as sophisticated from a compliance standpoint. And then one one other thing that we've seen that's interesting and become a challenge, and I I know this is not a conversation on Copilot or Gen AI, but every webinar has to talk about this in some form or fashion. Right? But we have gotten into the depths to a certain extent of of some of that information being requested in our RFPs. So for example, a copilot interaction. A conversation that somebody has with the computer in order to generate content or to, have reference materials for for work product. And what we're seeing is that, the copilot interactions in m 365 are actually, part of it. They they are a document. They have their own classification, of course. But that conversation is being retrieved in collections or can be. And the supporting material that it that it relies upon to create a response is actually showing up in a collection as an attachment. And it it can look as if it is a modern attachment. And depending on your licensing, it may or may not get that supporting information. And is that a good thing or a bad thing? So there's a whole lot more when it comes to modern attachments that we haven't even scratched the surface on. Well, on that uplifting note, I guess, we are we have reached the point where it's time to turn to the q and a portion. I would like to to thank the 3 of you, Jeremy, Sam, and Steven for joining us today, for educating and enlightening us, bringing to our attention some of the challenges and issues we may need to face when we're dealing with the modern attachments and to totally mix up my metaphors, showing us a path out of the woods as well. Thank you all very much, and now we'll switch over to the q and a portion. K. Ready to go? I'd like to, I'm gonna go through some of the questions I see here, and let's see who can jump in and respond. One of them was, could you share your experiences and challenging challenges when working with tools like Google Docs and Sheets, especially regarding the management or preservation of metadata? I don't know. Jeremy, is that a question for you in the initial, in the first instance? Yeah. So, I mean, it's it's a challenge. Right? Because with Google Docs, as we talked about in the webinar, the metadata changes the metadata for participations and collaborators are constantly changing. And I think I saw the q and a that Google does not do a good job of legal hold when you put on a legal hold to keep that metadata information. So one in so what we tend to do is before, and I mentioned this in the webinar, is that we do like to tell our attorneys how are we collecting it, how are we, what is the information that we have available to us at that time? Because what we that information is only able to be collected. It is the fewer collaborators at the time of collection. If we do go back and buy pull previous versions, the only updated metadata that usually we are able to see are, date created and date last modified. And I haven't seen a tool that does a better job for us than what Google can provide, as of right now. Steven Yeah. And I can go ahead, Steven. Yeah. I can add on to that because we do quite a few collections from Google where we see exactly what Jeremy is saying. And because I think Glit holds were initially built out for deletions and document retention as opposed to collaborative platforms, the technology hasn't really caught up with the need. And so when we've gone in and manually tried to even look at what previous version, history was available, what metadata fields were available, you can not only get missing metadata, but you can also get incorrect metadata. So you have to be very careful when you're dealing with the collaborative platforms and grabbing those versions in time and and what that metadata looks like. Because something like a date created most likely will be the same, but something like a last edited by might be important and, you know, might be something that would be different between the versions. Yeah. One other thing to add, George, is, a lot of the ediscovery and forensics tools will not collect a Google Doc or a Google Sheet in a native form. It has to convert it to a document or a spreadsheet that is usable for ediscovery platforms. So just another thing to consider when working with those. So the question asked of us had to do with Google in particular. Is this same challenge and issue with other plat platforms or other systems? So I'm seeing quite a few, both with Microsoft 365 and and others. Where I would say it's a it's a challenge across the board. How each platform handles that goes about it whether or not they even acknowledge that it's a problem. I think it's just platform dependent. But one we've seen with, Microsoft 365, for example, if you grab every version of a document that's ever existed, which is one of their settings, you can get those documents as they existed in time and potentially get the correct metadata. But now you're collecting terabytes instead of gigabytes, for example. And and that can have a whole set of other problems. Jeremy, Sam, anything to add to that? I think, one important thing to add. The a lot of the native applications that we mentioned in the webinar, like, like Google Vault or Google Takeout, They do a really good job of now of being able to preserve and export, a lot of that cloud metadata, and version history. It's just really difficult to put it back into context. And so that's going to be the biggest challenge and remains the biggest challenge in my opinion. With the e discovery review platforms is an effective and efficient way to put that all back together for efficient review and production. Some of the forensics tools do a decent job as well, but they also have some limitation. Yeah. And I don't have as much experience with Microsoft as where Google shops. So a lot of the views, we'll have, whether it be more towards Google and Slack, versus, like, something as Microsoft or SharePoint or Teams. Here's another question. Probably one of the earlier ones asked, a commenting question. So here I'll just read it out. Interesting to hear Jeremy say that they're that you're usually already providing some versioning for linked Google Docs. How commonly are you guys pulling version specific links as opposed to here's the version that exists as of today? So version specific versus what's here today? So as of lately, I will say as of what exists today is our standard, unless it's a government. One of the three letters that ask for the documents, then we try and limit and work with the government team to see what versions, how many versions we can pull because Google doesn't necessarily create. It's not like a document management system where they create, versions when documents are checked back in. And so we try to limit that when possible. And as of right now, usually, as of today, exist today has worked for us. That can change, obviously, as technology gets better, as it becomes easier to provide different versions. We do always put those different caveats around it. And then even when the govern when the 3 letter government agencies ask for items, we'll work with them to pinpoint specific documents that they would like to see different versions from, and then we will see what we can pull and provide information before actually pulling those records. And then Steven and Sam, let's let's expand this question beyond only to Google Docs. So so whatever the platform. Yeah. I can start. So we found, I think, similar to Jeremy that the difficulty in getting the previous versions and the version that existed in time and so on is generally understood at this point, I think, by more parties as opposed to just why can't you have this thing. There are tools that offer that availability and and we found most of them work to some degree but not necessarily to the degree we need for a defensible court document. And so once we've discussed that with both sides and said here here's the tool you want us to use, here's a test of what that data looks like. They look at it and they say okay never mind. The, version as it exists today is is acceptable. So we would I would say less than 20% are really pushing for the the version as it existed at that, time the message was sent. And we've had others as well that say, no. That's neither of those are gonna work and we need every version of the document that has existed. And, and so we've seen tools that have started building that functionality out as well. Yeah. And I I I would agree with that. I would say, with Microsoft specifically, our challenge is the licensing. So in the past, it was very difficult to get that specific version that was set at that point in time. You had to do a workaround with Purview to set a retention setting that was very specific, to allow you to get that version in time. Now Purview offers the ability to collect the point in time attachments. The challenge is you have to have specific licensing in place. And so working with our clients to change their licensing, at the point of preservation and collection is not always reasonable or effective. We do push to do that in many circumstances, but it's not easy. So the licensing for us becomes a challenge. Like Steven said, there are some forensics tools that aid in that, again, they are imperfect. So I'll jump right to one of the questions posed. Anybody have recommendations as to specific forensics tools since, Sam, you just mentioned forensics tools? Well, I think as we've kind of been alluding to in this, that the the native programs for something like Google Vault and Google Workspace or or Microsoft Purview Premium, for for Microsoft documents tend to be the main bread and butter for these types of collections. There's some information governance tools and some email collection tools and such that, again, they advertise being able to do it, but we've seen better results using the the native, functionality built out through Google and Microsoft. For others, you know, there are things like web preserver that you might use for, website collections when it's a hyperlink that goes outside of one of those, domains. And there are other tools, you know, I wanna get into kind of brand specific, but, they all kinda come with their own benefits and and, and detractions, I guess. So things that we you have to end up troubleshooting. So I wouldn't say I'd put one above any others other than the the native programming and functionality that exists within Google and Microsoft. Yeah. I would I would agree that there are the native tools so far have been, the best for us. However, not to name drop specifically, but FEC is fantastic. We've found forensic email collector. They've come a long way over the last couple of years. They actually pair very well with Google Workspace where you can, I'm sorry, Google Vault, where you can collect, you can perform a collection in Google Vault, and it will go and package the attachments and create a load file for you. It's not perfect, but it does bridge the gap, better than most. There's also very good connectors. I know Reveal has connectors, OpenText has connectors, a lot of Relativity connectors obviously, will allow you to perform collections in an effective way and gather those cloud attachments. However, you don't always have a natively preserved copy or an original. It ports that data directly into the eDiscovery platform. So just a few examples, of what we've run into. And one tool really quick for us we use is Ona. We use that a lot for our Google collections. It's great for when we're doing custodial interviews and they're telling us specific folders that we need to collect. Where in Google Vault, it makes it more difficult to do that. It allows ona allows me to go in specifically, and now they have vault connectors and also they have modern attachments for new Slack collections as well. Amazing. You guys have done such a great job, but thank you so much for taking the time. I know we have about 1 minute left, so I don't know if we really have enough time to answer any more questions, but I will make sure to send out an email following this webinar to, with some of the answers to the questions so that they were answered or not. As I said earlier, I wanna launch a survey to those who are still here just to ask for your advice and for tips. If there's any additional webinars that you wanna see in the future and how we did on this one to make sure that we can do better. You have a chance to make sure to thank our speakers today. Thank you all. You did such an amazing job, and it was so amazing hearing about this really complicated and new tool that's coming or I guess a new issue that's kinda coming every space. So thank you. Thank you. Thank you. Thank you very much. Thank you. Until the next time, guys.