Legal Investigations are a deep dive into understanding data in preparation for legal action. As the amount of data flowing through the world’s vast technological oceans continues to swell, so too do the challenges faced in legal investigations and electronic discovery (eDiscovery). As organizations continue to produce and store more electronically stored information (ESI), legal investigators must spend more time and effort combing through and recovering data. As eDiscovery investigations become more complex, the need for more robust software, more voluminous storage, and more efficient data processing tools is essential.

At iDiscovery Solutions, we like a challenge. We tackle increasing industry demands strategically, so each step of the forensics process is done methodically – and efficiently. Let’s dive in.

The 5 Ws of Investigations

Legal investigations, in an archaic fashion, entail diving headfirst into millions of emails and documents – searching for the electronically stored needle in a data haystack. This leaves investigators wondering where to begin, what to look for, and where to go next. Without direction, clients will question how long the investigation will take and how much it will cost. On the onset of any investigation, five essential questions must be asked: Who? What? When? Where? And Why?

By leveraging a suite of analytics tools in softwares like Brainspace, NexLP, or Relativity® a faster resolution can be reached for each of the five essential questions at hand.

Who?

Analytics tools can identify different individuals based on information like name, email addresses, phone numbers, or Social Security Number. These softwares then combine information where possible – creating a digital profile. Utilizing this digital profile in conjunction with frequency and timeliness of phone calls or emails can help to identify the key players in the investigation.

What?

Many analytics tools on the market today have keyword clustering and conceptional analysis, like the ever-popular Brainspace Wheel. By identifying and analyzing related terms based on usage and frequency, it is easy to identify and understand some of the most important words and concepts in the data set. This part of the data extraction process is fundamental to answering the ‘What?’ in legal investigations. Through a visual representation of the most important concepts in the dataset, it is easy to narrow in on the issue or issues that are being taken up in the investigation.

When?

The question of ‘When?’ in an investigation can take on different forms. For example, it could be as simple as already knowing the range of dates in which an event occurred and using that timeframe as a culling tool to limit the data that needs to be investigated. On the other hand, this question could be asking how often an event occurred, the order in which a series of events occurred, or the timeframe of occurrences that led to a final event in question. Either way that the question is framed – with analytics tools, it is simple to narrow down the documents to fit within the range needed, or to chronologically analyze documents, emails, or word frequency to identify patterns leading to key events in an investigation.

Where?

Much like ‘When?’ the question of ‘Where?’ can appear in different lights. In the context of legal investigations with the goal of understanding data, this question most often appears in the form of virtual locations, for which we conduct data mapping. For example, where is this data stored, or where is this data coming from? With analytics software, once the ‘What?’ is identified, it is easy to establish a link between the data being scrutinized and where it is being stored.

Why?

The ‘Why?’ is the final and most difficult question to answer when investigating an incident. Once the four previous questions are answered by leveraging analytics tools, reflecting back is needed to answer this question. Through reasonable deductions made from the previous questions and an analysis of events and patterns a hypothesis of the ‘Why?’ can typically be reached.

Investigations in Action

A legal investigation may seem like a short exercise in answering five alliterate questions, but when put into practice, it is a bit more complicated than that. The analysis begins when the metadata from documents, emails, and other data is extracted from ESI. The documents and their associated metadata are then loaded to a review software and pushed to an analytics tool.

The investigations commence with a deep dive into who is involved. Tools like Brainspace have the capability to extract entities from the data, building out profiles of individuals. From there, investigators can compare the entire population of individuals to the frequency of emails sent or received in relation to a specific topic in question, resulting in the key players in an investigation. Investigators often go beyond the data they are in possession of, turning to open records and social media searches to identify additional background information about individuals, their associations, and their relationships. This results in a through cast of characters and individual profiles of the key players in the investigation.

Next, investigators look to answer ‘What?’, ‘When?’, and ‘Where?’ by using conceptual analytics, key word patterns, and conversation analysis to explain what was going on between the key individuals, when was it happening, and where was it occurring. One way in which this is done is through building a timeline of key events related to the investigation, detailing when and where they occurred. Another way in which this is done is through email or keyword pattern analysis, or by developing an understanding of what words or phrases where used, when they were used, and who used them. Both a timeline and recognition of patterns help to build an understanding of the events in the investigation.

Once the key players, important events, and patterns are identified they can be analyzed to determine a narrative. A narrative is the story that explains the ‘Why?’. This could look like a narrative of why something fraudulent happened, or simply why your data is the way that it is. Whatever the case, the narrative answers the question at the root of the investigation in the first place.

A Faster Resolution

Through combined decades of experience in investigations and access to advanced analytics capabilities, our investigators at iDS are experts in leveraging analytics to help answer the five essential questions of investigations efficiently and effectively. We work step by step with our clients so that the complexity of legal investigations feels more like answering five simple questions.

Check back to learn more about iDS, analytics, and investigations in future blog posts.

iDiscovery Solutions is a strategic consulting, technology, and expert services firm – providing customized eDiscovery solutions from digital forensics to expert testimony for law firms and corporations across the United States and Europe.