This protocol governs data collection for the matter identified above. It is written to be handed to a collection vendor with the expectation that they will follow it exactly. Departures require written approval from the client's eDiscovery lead. Fair is fair.
1. Matter Identification
| Client | |
| Matter Number | |
| Preservation Trigger Date | |
| Legal Hold Issued | |
| Collection Vendor | |
| Vendor Point of Contact | |
| Client Point of Contact | |
| Delphoria Advisor |
2. Delphoria Unique-ID Scheme
Every collected item must be stamped with a Delphoria Unique-ID at first-touch, before hashing. Format:
DLP-{matter}-{custodianCode}-{sourceCode}-{seq7}
| Component | Example | Rule |
|---|---|---|
| {matter} | 2601 | 4-digit matter number assigned in §1. |
| {custodianCode} | JS | 2–4 letter code, first initial + last name up to 3 letters. |
| {sourceCode} | M365 | See §3 source table for canonical codes. |
| {seq7} | 0000123 | 7-digit zero-padded sequence per (custodian, source). |
Example UID: DLP-2601-JS-M365-0000123
The UID must be written to a first-class field named DLPUniqueID in the load file, and preserved through processing, loading, review, and production. It must not appear only in a comment or hidden metadata field.
3. Sources in Scope
Check each source below that is in scope for this matter. For each checked source, specify the tool the vendor will use and any custodian-specific notes.
| ✓ | Code | Source | Tool | Notes |
|---|---|---|---|---|
| M365 | Microsoft 365 Mail | |||
| GWS | Google Workspace Mail | |||
| LAP | Laptop / Workstation | |||
| MOB | Mobile Device | |||
| WA | ||||
| SIG | Signal | |||
| SLK | Slack | |||
| TMS | Microsoft Teams Chat | |||
| OD | OneDrive / SharePoint | |||
| GDR | Google Drive | |||
| BOX | Box / Dropbox | |||
| NET | Network Share | |||
| SOC | Social / Public |
4. Chain of Custody
The vendor shall maintain a chain-of-custody log per collection event, including at minimum:
- Custodian name and consent status
- Device identifier (serial number, IMEI, or endpoint host name)
- Date and time of physical or logical possession
- Collector name and credentials
- Tool name and version
- Cryptographic hash of container (SHA-256 minimum)
- Storage location and encryption method for the resulting collection
- Any deviation from this protocol, with reason
Chain-of-custody logs must be delivered alongside the collection and preserved for the life of the matter plus statutory retention.
5. Custodian Handling
Every custodian collection must be preceded by an interview using the Delphoria Custodian Interview Script (DLC-M01-003). The vendor shall:
- Confirm the interview has been completed before scheduling collection.
- Confirm the custodian's identity at collection (photo ID or approved digital verification).
- Provide the custodian with the standard "What we took and why" leave-behind (see Appendix A of DLC-M01-003).
- Return personal devices within 24 hours of imaging unless otherwise agreed in writing.
- Document any custodian objections, refusals, or claims of privilege at the point of collection.
6. Deliverables the Vendor Must Provide
| Deliverable | Format | Timing |
|---|---|---|
| Collection Manifest — one row per collected item with the fields listed in DLC-M01-001 plus the assigned DLPUniqueID. | CSV, UTF-8 | Within 3 business days of collection completion. |
| Chain-of-Custody Log per collection event. | PDF, signed | At time of collection, revised at delivery. |
| Container(s) with the collected data, encrypted at rest. | Vendor-native (E01/UFDR/PST/JSON/etc.) | Per collection schedule. |
| Processing manifest identifying any items excluded from delivery (e.g. NIST hashes, application binaries) with reason. | CSV, UTF-8 | With container delivery. |
| Collection report — narrative summary suitable for attachment to a discovery response. | PDF, ≤ 6 pages | Within 5 business days of collection completion. |
| Any custodian statements, refusals, or objections captured during collection. | PDF or DOCX | Same day. |
7. Preservation Boundaries
The vendor shall not:
- Delete, alter, or overwrite any custodian data prior to imaging.
- Apply keyword or date-range filters during collection unless expressly authorized in writing by the client and Delphoria advisor.
- De-duplicate or de-thread during collection — those steps belong to processing.
- Convert file formats during collection (e.g. re-render PDFs).
- Disclose the existence, scope, or content of the collection to any party not listed in §1.
8. Escalation
The vendor shall escalate to the Client Point of Contact and the Delphoria Advisor (both, not either) within 4 business hours when:
- A custodian refuses to make a device available or claims privilege over the device.
- A device is inaccessible (locked, damaged, or missing).
- A source produces materially less data than the custodian's declared usage would suggest.
- Ephemeral or auto-deleting content is discovered that requires immediate preservation action.
- Any tool failure or process deviation from this protocol occurs.
9. Approval & Signatures
By signing below, each party confirms review of this protocol and commits to executing collection in accordance with its terms.
Appendix A · Deviation Log
Document any deviation from this protocol here. Include the reason, the person authorizing the deviation, and the date. Deviations must be signed by the Client Point of Contact.
| Date | Deviation | Reason | Authorized By |
|---|---|---|---|