Submit a digital forensic request

Submit a legal request to access data of current or former employees for internal investigation or litigation reasons.

Antes de Iniciar

Role required: sn_lg_ops.legal_user

Procedimento

1. Navigate to All > Employee Center.
   Nota:

   If you are using Legal Service Portal, you can submit a legal request by navigating to the Legal Service Portal portal and selecting a request from the Service Catalog.
2. Select Legal services from the header.
3. Select Browse Legal services.
4. Search for the digital forensic request item.
5. Click Digital Forensic Request.
6. On the form, fill in the fields.

   Tabela 1. Digital Forensic Request intake form

   Field	Description
   Add this request to	Option to associate the legal request with an existing legal matter or to a new legal matter. Existing matter: Option to associate the legal request with an existing legal matter. Only current legal matters that you have permission to access appear in the list. New matter: Option to create a new legal matter and associate the legal request with it.
   Existing matter	List of existing legal matters to associate with the legal request. Only current legal matters that you have permission to access appear in the list. This field appears only when the Existing matter option is selected.
   Name of new matter	Name of the new legal matter. This field appears only when the New matter option is selected.
   Activity request	Short description of the request.
   Detailed description	Detail information of the request, for example, details of the suspicious activities by the custodians or details of the litigation.
   Custodial data	Employees on whose data you are requesting the investigation. Also provide other investigation details for a custodian—search keywords, data sources, and search period. For more information, see Add a custodian to a digital forensic request.
   Non-custodial data	Resources and assets, such as server, laptop, mobile, or cloud storage, on which you are requesting the investigation. Also provide other investigation details for a non-custodian—search keywords, data sources, and search period. For more information, see Add a non-custodial data to a digital forensic request.
   Bulk upload	Export multiple custodian and non-custodial data from a file. For more information on uploading the data from a file, see Add custodial and non-custodial data from a file.
   Activities requested	Type of actions required on the data for the investigation. Preserve: Secure the original data from the source devices in compliance with departmental guidelines to protect and preserve the evidence. Collect: Acquire the digital evidence that may be relevant to the investigation. Collection might involve activities such as imaging storage devices, or copying or printing of the digital information. Review: Conduct an in-depth, systematic examination of the facts in the collected digital evidence related to the investigation. Present: Document and present the relevant information and findings of the examination in an appropriate format to stakeholders.
   Third party reference ID	Reference to a legal matter ID stored in your other matter management system.
   Third party reference system	Reference to your other matter management system.
   Preferred completion date and time	Date by which the investigation must be complete. The date and time is based on the time zone you are in while requesting.

7. Click Submit.

Resultado

• A digital forensic request is created in the New state.
• The Standard Ticket page displays that has the following tabs to perform different tasks:
  • Activity: Track the activity history of the request and post messages for the fulfiller working on the request.
  • Attachments or Documents: Upload and manage the documents in the legal request.
    Nota:

    If the external storage option is enabled, the Documents tab is displayed. Otherwise, the Attachments tab is displayed.
  • Custodial data: View existing custodial details. You can also export the data to a file.
  • Non-custodial data: View existing non-custodial details. You can also export the data to a file.
  • Request Details: Review request details.
• If you uploaded custodial and non-custodial data from an Excel or CSV file, the file is attached as a reference document to the request.

  The number of records successfully uploaded from the file into the request is posted as additional comments in the Activity tab on the Standard Ticket page.

  If a record from the file isn't added to the request, an error log file is added in the Activity tab. You can review the reason for failure in the error log file, fix the errors in your file, and upload it again by editing the request.

• For each custodian added in the request, a record is created in the Custodial Data [sn_lg_forensics_custodial_data] table. If a legal profile record for each custodian is not already present in the Legal Profile [sn_lg_ops_legal_profile] table, a corresponding record is created.
• For each non-custodial data added in the request, a record is created in the Non Custodial Data [sn_lg_forensics_non_custodial_data] table.

O que Fazer Depois

On the Standard Ticket page, you can update request details, add comments, manage custodial and non-custodial data, upload supporting documents, or cancel the request. For more information, see Update a submitted digital forensic request.

Any member from the digital forensic team can triage and assign the request to themselves or to any other member in the group. Once the request is assigned, an approval flow is triggered. The flow creates an approval record for each custodial and non-custodial added in the digital forensic request. These approval records are assigned to the privacy team in the legal department. Any member from the legal privacy team can approve the request. After the approval, a digital forensic team member to whom the legal request is assigned can start working on the request. For more information, see Work on a digital forensic request.

Nota:

The approval details appear under the Approvals tab on the Standard Ticket page.

Add a custodian to a digital forensic request

Add a custodian and related data source details in your digital forensic request.

Antes de Iniciar

Role required: sn_lg_ops.legal_user

Procedimento

1. On the Digital Forensic Request intake form, in the Custodial data section, click Add.
2. On the Add Row dialog box, fill in the fields.

   Tabela 2. Add a custodian in a digital forensic request

   Field	Description
   Custodian name	Name of the custodian on whose digital assets you are requesting a digital forensic investigation.
   Data source	Source (hardware or software) from which the data for investigation is to be collected.
   Other data sources	Source (hardware or software), not listed in the Data source field, from which the data for investigation is to be collected. This field appears only when Other is selected from Data source.
   Keywords	Terms to look for within the data collected from the custodian data sources. You can provide multiple search terms each separated by a comma.
   Filter start date	Start date of the digital forensics investigation period. The digital forensic team member would check for the search terms in the data from this date onwards.
   Filter end date	End date of the digital forensics investigation period. The digital forensic team member would check for the search terms in the data until this date.
   Additional information	Additional details about the custodial data that would be helpful in resolving the request.

3. Click Add.
   The custodian record appears in the Custodial data list on the Digital Forensic Request intake form.

Add a non-custodial data to a digital forensic request

Add a non-custodial data and related search source details in your digital forensic request.

Antes de Iniciar

Role required: sn_lg_ops.legal_user

Procedimento

1. On the Digital Forensic Request intake form, in the Non-custodial data section, click Add.
2. On the Add Row dialog box, fill in the fields.

   Tabela 3. Add a non-custodial data in a digital forensic request

   Field	Description
   Non-custodial details	Details of the non-custodial data on which you are requesting a digital forensic investigation. For example, you can enter details such as model number, serial number, or product name of the non-custodial data.
   Data source	Source from which the data for investigation is to be collected.
   Other data sources	Source (hardware or software), not listed in the Data source field, from which the data for investigation is to be collected. This field appears only when Other is selected from Data source.
   Search location/File path	Location of the folder or file from where the data for investigation is to be collected. For example, a URL on a cloud storage or a folder or file in a system.
   Keywords	Terms to look for within the data collected from the data sources. You can provide multiple search terms each separated by a comma.
   Filter start date	Start date of the digital forensics investigation period. The digital forensic team member would check for the search terms in the data from this date onwards.
   Filter end date	End date of the digital forensics investigation period. The digital forensic team member would check for the search terms in the data until this date.
   Additional information	Additional details about the non-custodial data that would be helpful in resolving the request.

3. Click Add.
   The non-custodial record appears in the Non-custodial data list on the Digital Forensic Request intake form.

Add custodial and non-custodial data from a file

Upload a Microsoft Excel or CSV file containing custodial and non-custodial data to quickly add multiple records in a digital forensic request in one go.

Antes de Iniciar

Role required: sn_lg_ops.legal_user

Por Que e Quando Desempenhar Esta Tarefa

Use a file with a predefined format available on the digital forensics request page to upload custodial and non-custodial data.

Procedimento

1. Download the template file with the predefined columns and add custodial and non-custodial details.
   1. Click the Download an upload template here link to download the Excel file template.
      The template file contains sample records for custodial and non-custodial data. During import, the columns marked as Not applicable in the file are ignored.
   2. Review the sample data in the downloaded Excel file and add custodial and non-custodial details in the same format, and then save.
2. On the Digital Forensic Request intake form, in the Bulk Upload section, click Upload.
3. Browse and select the Excel file containing the custodial and non-custodial data.
   The file is attached to the request. The data from the file is uploaded into the request when you submit the request.