So much data means we need a place to put it – but where that is depends on how often you need to get to it. You want to know where it is if you need it, but you might not want to pay to have it instantly accessible all the time.
Below, we’ll talk about offline & nearline storage, chain of custody, and purging data when the case is complete.
What is Offline Storage?
Let’s say you have a case that you know is going dormant for the next six months to a year. You won’t need to review anything and you won’t have to touch the data. But you’ll need it when the case comes back.
Offline storage may be a great choice for this scenario, because it keeps the case framework intact but deactivates the user access. Of course, the ability to do this depends on the options offered by your service provider. This is a great choice for anyone paying per user.
For offline storage, the data is removed from the active eDiscovery platform. Metadata, tags, or other pointers allow for future restoration, but the files are kept in a separate, non-active environment. Depending on the platform and the service provider, it may take a few days to get that access restored when needed.
This can mean putting all the data on an external drive, but if that’s the case, the data may need to be re-indexed and re-loaded. This adds time to the full restoration of a case.
The most important questions to ask are:
What is Nearline Storage?
This is a middle ground between an active case and offline storage. Again, it may not be available from all service providers, but it’s a great question to ask if you’re going to have light use of your data for a time.
It’s slower access to the data but cheaper than having everything live, and retrieval of that data can happen in hours or days rather than instantly. It’s also good choice for archived matters where a full deletion isn’t quite called for yet.
How Do I Move Data Properly?
The key factor in moving data is maintaining a chain of custody. This means that each movement needs to be recorded: who accessed, who transferred, or who deleted the information. Improper handling of data can compromise evidentiary integrity. Retaining these chain of custody documents can provide defensibility (or just evidence) in court.
If data is moving to external drives, knowing how those devices are secured is important as well. it's a great question to ask your providers or litigation support team. Cybersecurity risks still exist even when data is "at rest" so devices should be protected by encryption as well.
Closure & Purging
Let’s say the case is over, done, kaput, and you’ll never need the data again. It’s time to close and purge, which means permanently deleting all case related data from an eDiscovery platform.
This includes
This final step is important because traces of data can remain if the process isn’t properly handled. To ensure complete removal, all backups (both automatic and manual) should be included, and all storage environments should be checked for redundant copies.
But this is an irreversible process, once it’s gone, the data can’t be restored. It should only be done after everyone agrees that access isn’t required. Note that some vendors require written authorization before purging.
Conclusion
Knowing the differences between offline storage, nearline storage, and purging can help determine which process is right for your case. Make sure that in that process, consideration is given to the finality of data deletion, the importance of chain of custody, and the time to retrieval if moving offline or nearline.