Case Studies

Discovery response collection work for a European client involved in a patent infringement case.

The project required on-site forensic imaging and active file recovery from 25 laptop PCs and 2 server systems. The identification and collection phase of the project yielded over 3 TB of data recovered and preserved within a 4-day time frame.

All laptops and desktops were imaged using either Tableau TD3 high speed forensic imaging hardware or FTK Imager software deployed with WiebeTech write blocking technology. Planet Data consultants were able to image 5 devices at a time while simultaneously preserving and collecting targeted server-based data using ESI collection software utilities designed to preserve all file attributes and validate collected data with hash generation.

The project also involved the preservation and collection of structured data from 2 separate enterprise database platforms. All collection work was performed on-site with minimal client involvement and interruption. Many levels of data validation and collection documentation were performed and preserved to ensure accuracy and completeness of the data acquisition tasks.

Expert testimony regarding the collection process was also provided as part of this engagement.

Second request response for a large U.S. client involved in a merger with an international corporation.

All employee user share data was also captured along with group and department share data from 10 different company departments.

Planet Data was engaged to provide data acquisition, processing, hosting and production services on this fast-moving request late on a Friday evening. Planet Data consultants were assisting with custodian interviews and collecting data the following day. Response and production speed were mission critical on this project and our objective was to have the collection phase completed by the end of the first week. Planet Data’s forensics team had completed all custodian and network share collections by Thursday evening. 4.5 TB of total data preserved and captured and shipped for staging and processing.

Remote and on-site data collection for a trade secret case involving a large European client with operations in both the UK and United States.

This was another fast-moving case involving the need for laptop and desktop imaging, network share e-doc collection, cloud data source collection, and mobile device imaging and collection. Custodian sources were spread across several US locations. Mr. Berkshire deployed remote imaging kits for both the PC and mobile device sources and organized web based meetings to facilitate the image capture of each targeted data source. The remote collection solutions saved enormous costs and provided a much faster turnaround for the full completion of the project.

All six key custodians and identified data sources in six different locations were fully captured and validated in only two days of work. Since cloud data sources can be accessed directly from Planet Data’s SSAE16 certified secure data center, cloud collection tasks could be performed simultaneously with the collection of the other sources of custodial data.

The engagement also required the preservation and capture of identified social media sources including Facebook pages, Twitter feeds, and LinkedIn accounts.

Onsite collection involving forensic imaging, targeted collection, and cloud data collections.

The scope included quantity three (3) MacBook Airs, 2 Dell Laptops, 1 Lenovo laptop. All of the laptops were to be forensically imaged with the exception of one of the MacBook Airs, which was to be target-collected.

There were also 4 mobile devices that needed to be collected. Those devices were a mix of iPhones and Samsung Galaxy Androids. The cloud collections encompassed 3 email accounts, one Yahoo! and two Gmail mailboxes.

The MacBooks were collected using Blackbag MacQuisition, both full forensic images and targeted file collection. The Dell and Lenovo laptops had removable drives and Planet Data consultants opted to remove and image each of them using our Tableau TD2s. Planet Data then verified each of the images and data sets with FTK imager before placing each of the original collection drives in our data center vault.

The 4 mobile devices were all collected using Cellebrite’s suite of tools and software. The iPhones were imaged with Cellebrite’s Physical analyzer. The Samsung Androids needed to be physically connected to Cellebrite’s UFED Touch and initiated from that device. Replacement SD Cards had to be inserted into a 2 of the phones to initiate the physical collection. File system and logical extractions were also performed on each.

Cloud Email was collected using MailXaminer (a forensic mailbox collector application) and Google TakeOut. MailXaminer was used for the Yahoo! mailbox - it collects the mailbox to its proprietary database and then provides export to PST functionality with full logging and chain of custody generation.

Google TakeOut is used online and is part of Google Apps. Google notifies the user when the archive has been created, at which point Planet Data consultants download the archives to Planet Data's secure data center in NY. The mailbox is turned over to processing in MBOX format.

The entire collection was completed start to finish in about 16 hours.

Local collection involving the pickup of 3 Windows laptop computers and 3 mobile phones (2 iPhones and 1 Android).

The phones were picked up in the presence of the attorney client and the device custodians and taken back to PDS’s local data center for imaging.

As described above, the laptop drives were removable and imaged with Tableau TD2s and verified with FTK Imager. The mobile devices also followed the above process – collected with Cellebrite’s suite of tools and verified in Physical Analyzer. Once imaged, it was requested that Planet Data extract only text messages from the phones and present those for processing using established key terms, etc. This was accomplished with Cellebrite’s Physical Analyzer and handed over to Planet Data's processing staff in the UFDR format.

The drive images were to be analyzed for any evidence of an external USB connected and specific files copied either to or from according to a provided file list.

After extensive analysis, it was determined that two of the laptops had had a USB thumb drive attached and many of the files in question copied to it. Planet Data was able to provide the USB thumb drive make and model number, drive label, directory and file contents and the exact dates and times the copy operations occurred.

The collection was completed in under a day, the forensic analysis and text extraction took another 3 days.

Onsite collection and investigation of activities performed by a former employee of the client.

Client’s organization was running a Citrix environment with roaming desktops. PDS Consultants imaged the former employee’s thin client, collected their roaming profile from the VDI, and accessed and investigated the organization’s Office365 Exchange accounts for the relevant materials.

Found conclusive and relevant ESI in both in deleted email and through windows analysis of the employee user profile. Primary evidence included finding relevant ESI copied to an external USB from home on a remote desktop using the former employee’s roaming profile and communication recovered from Office365 searches connecting the employee and an outside party.

Law Firm Client

This law firm is a long term client of over four years and Planet Data is the preferred eDiscovery provider for their ESI processing, ECA and Relativity hosting projects. We are currently on project 67. We work with their internal litigation support team, associates and partners on many different types of projects. Planet Data has set up a customized workflow that meets the firm’s needs so that once a project is identified, it can be started and data can be available within 24 hours for the legal team to begin their review within Relativity.

Law Firm Client

This law firm is a long term client of over six years and Planet Data is the preferred provider for all of their ESI processing needs. We are currently on project 114 and they utilize our Exego platform to review and cull the data prior to loading it into their in-house platform for lawyer review. We have also performed traditional document coding services on many projects.

Corporate Client

This corporation was recently involved in a DOJ second request. They awarded their business to Planet Data in a competitive environment due to our ability to understand their specific project needs and requirements. We were asked to provide data collection assistance and consulting, process and host the data quickly and efficiently and provide an experienced project manager with second-request experience. Planet Data worked with their internal and outside counsel on developing a collection strategy that would minimize disruption within the company infrastructure.

We successfully processed the collected data quickly and per their specification; performed ECA in our Exego platform thereby reducing the data sets significantly; hosted the data in Relativity at our SSAE16 certified data center; and produced the necessary documents to the government in the correct manner. This project was completed ahead of schedule and the company was able to meet the deadlines set forth by the government.

Law Firm Client

This law firm was dissatisfied with their ESI vendor’s results and turned over a critical project to Planet Data. After reprocessing their collection in Exego, Planet Data found 36,000 responsive documents that were missed by that vendor. The document set largely contained embedded objects and encrypted data, making it invisible to many processing engines not sophisticated enough to capture said items.

Corporate Client

This pharmaceutical company delivered a project involving more than a terabyte of data. Planet Data assisted the client with reduction of data by implementing on‐site targeted custodian collection and forensic tools to reduce data prior to processing. During the collection process, the Planet Data Project Manager worked with the client to focus on key custodians and then only on certain directories within each custodian where the client believed the relevant data was located. Once the data was collected, deduplication and keyword searching was applied to further reduce the data by utilizing Planet Data’s Exego platform.

The final culled data was loaded into the Planet Data Relativity hosting platform for further searching and analysis. Planet Data saved this client over $300,000 based upon a comparison it performed against another supplier that started the project and was ultimately removed and replaced by Planet Data.

Corporate Client

This company was involved in a large IP matter involving over 300GBs of data that was processed and culled in Exego. The Planet Data Project Manager worked with the client to create a list of terms to apply against the data to reduce the overall relevant data set in Planet Data’s Exego platform. This iterative process allowed the client to create the terms and view what they believed was the resultant data. This approach provided the client with a better overall understanding of their data and they then created additional refined searches to reduce the sets even further. The final data set was then loaded into Planet Data’s Relativity platform for further analysis and to create productions by the legal team. The benefit of this approach was that less data was processed and stored on the hosting tool which saved the client significant costs.