W
DLC-M01-003 · Custodian Interview Script.docx — Word
File
Home
Insert
Design
Layout
References
Review
View
The purpose of this interview is to identify what the custodian used, where the data lives now, and what may have been lost. Be plain. Be patient. Take a breath — we've heard worse. Nothing in this interview implies wrongdoing.
Section A · Interview Metadata
Section B · Opening (read aloud)
"Thank you for your time. I'm here to walk through the systems and devices you use for work — and any personal accounts that occasionally overlap. This isn't an accusation. We're building an accurate map so we can preserve what needs to be preserved and leave the rest alone. If you don't know an answer, that's fine — say so. If you're unsure, say that. If something occurs to you later, email me and we'll add it. Any questions before we start?"
Section C · Devices
C-01What company-issued devices do you currently use — laptop, desktop, tablet, phone?
Model / serial / where it lives when not with you.
C-02Have you had any prior company devices during the relevant time period?
Get approximate dates, model, and what happened to it (returned, wiped, still have it).
C-03Do you use any personal devices for work — even occasionally? Personal laptop, personal phone, personal tablet?
If yes, we'll come back to this in Section G.
C-04Are any of your devices set to auto-delete or clear history on a schedule?
e.g. laptop disk cleaner, phone auto-clear.
C-05Have any devices been lost, stolen, or replaced during the relevant time period?
Section D · Email & Calendar
D-01Which email account(s) do you use for work? Company email, alias addresses, distribution lists you monitor?
D-02Do you use any auto-forwarding, rules, or filters that move mail out of your Inbox?
These sometimes route mail to obscure folders or personal accounts.
D-03Do you keep mail in local PST files or archives, on your laptop or a network share?
D-04Do you delete mail regularly? Have you ever done a bulk delete?
Section E · Messaging & Collaboration
E-01Which messaging apps do you use for work? Include company-provided and any you use even occasionally.
Teams, Slack, iMessage, WhatsApp, Signal, Telegram, Zoom chat, Webex, SMS, Wickr, others.
E-02Are any of those set to auto-delete messages after a period of time?
This is important — read the setting with them if unsure. Do not ask them to change it.
E-03Do you have any group chats — work-related or with a mix of work and personal contacts — that we should know about?
E-04Have you moved any conversations off company platforms — to personal text, WhatsApp, Signal — for any reason?
Neutral tone. There are legitimate reasons, and there are illegitimate ones. We just need to know.
Section F · Storage & Applications
F-01Where do you save documents? Company OneDrive / SharePoint, Google Drive, network share, local Desktop, external drives?
F-02Do you use any personal cloud storage — Dropbox, iCloud, personal Google Drive — for work files, even sync?
F-03What software or SaaS applications are central to your role? Include CRM, project management, design, finance, industry-specific tools.
F-04Do you use any AI tools in your work — ChatGPT, Claude, Copilot, Gemini, others? Company or personal accounts?
Increasingly relevant. Ask what prompts or documents they've uploaded.
Section G · Personal Accounts & Devices
G-01To the best of your knowledge, is there any work-related communication or document on a personal device or account that is not also on a company system?
G-02Have you used a personal email account for any work-related communication?
Include personal Gmail, iCloud Mail, ProtonMail, etc.
G-03Are you willing to provide access to a specific personal account or device for the collection team, understanding that we will limit what we take?
If no, note that and escalate — do not press. Consent conversations belong with counsel, not the interviewer.
Section H · Preservation
H-01Have you received the preservation notice? Do you understand what it asks you to do?
H-02Since receiving the notice, have you deleted, moved, or altered any work-related data? Even routine cleanup?
H-03Is there anything you're not sure how to preserve? (Auto-deleting apps, expiring links, ephemeral messages.)
Section I · Closing
I-01Is there anything I should have asked but didn't?
I-02Anything you'd like on the record for accuracy or context?
Interviewer follow-up
Within 24 hours: complete the "What we took and why" leave-behind for the custodian, log any escalations from Sections G and H, and update the Collection Protocol (DLC-M01-002) source table to reflect what was learned.
