Effectively Managing eDiscovery of Hyperlinked Files

For good reason, applications that enable greater collaboration have grown tremendously as hybrid work and remote work expanded. Hyperlinked files−around since Lotus Notes− let users share and work together on larger files more efficiently than on FTP sites or email. From a productivity standpoint, that’s a real boon. From an eDiscovery standpoint, this can lead to headaches. In this article, we address the headaches along with the tools and techniques that can provide some relief.

Data is Everywhere and Growing

Hyperlinked files aren’t tied to a single application or storage site which can present eDiscovery issues. Some of the challenges we’ve had to address include:

• The need to purchase an add-on software product to grab hyperlinks using the targeted product’s API

• Data volume explosion of 5-20x on average

• Frequent duplicate hyperlinks within a single custodian’s emails and across multiple custodians’ messages

• Permissions that prevent preservation

• Hyperlinked files that no longer exist

No Single Go-To Tool

Not every hyperlinked file is a nail, so we can’t rely on a single eDiscovery hammer to do the job. The three preservation and collection tools for hyperlinked files that we use the most are Google Vault, Microsoft Purview, and Metaspike’s Forensic Email Collector (FEC). With the dominance of Google Suite and Microsoft Office collaboration suites, it’s no surprise developers have responded to the demand for tools that support preservation and collection. FEC offers some features that provide advantages when collecting from the Google Suite. As with any area of technology, this is far from an exhaustive list of available tools, with new tools continuing to emerge. Here are some highlights for each:

Google Vault

• Google Vault – eDiscovery tool for Google Workspace

• Integrated ability to retain, hold, search and export user data

• Google Vault requires a license, included in:

• Frontline Standard

• Business Plus

• Enterprise Standard and Enterprise Plus

• Education Editions

• Enterprise Essentials and Enterprise Essentials Plus

• G Suite Business

• Non-Profit Organizations

• Vault Add-on Licenses available

• Hyperlinked Drive files shared in Gmail messages are not retained, held or searchable as part of the messages itself. However, you can export linked files based on the hyperlinks found in the body of the exported message.

• Vault will only provide the hyperlinks shared by the custodian, not those sent to the custodian by others.

• Vault will support the most recent version of the document.

• Vault is not supported for personal Gmail or GoogleOne accounts.

Microsoft Purview eDiscovery (Premium):

• Available with Microsoft 365 Plans E5 licenses or E3 license supplemented by the E5 Compliance add-on option.

• Purview collects only the most recent or live version of a hyperlinked file (also called cloud attachments).

• Purview must have version retention enabled to retain the original shared file.

• Purview will export both the original and recent versions−when preserved−with the same FamilyID as the parent message to facilitate reviewing the files as a group.

• Purview’s cloud attachment retention policy only applies going forward from the time it is implemented. Microsoft has shared that it is developing a feature that will allow for automatic preservation hold of all versions based on user – estimated for release by September 2025.

Metaspike Forensic Email Collector

• FEC supports collection of hyperlinked files from Google’s API (email may be collected from other providers but will exclude hyperlinked files).

• FEC Gmail collections with hyperlinked files require custodians to grant access to both their Gmail and Google Drive accounts.

• FEC, by default, will acquire the most recent version available of the referenced hyperlink, which may be different from the version of the file at the time the email was sent/received. Note, the versioning collection options are different between enterprise and personal accounts.

• If Drive folder contents are collected, some folders may contain voluminous data, which could significantly increase the time it takes to complete the collection.

• If duplicate Drive items are excluded, then only the first, single copy of a file will be downloaded, even if it is referenced in multiple emails.

• If attachment revisions are included in the collection, individual files will be downloaded for the entire version history. This may explode overall data collected to over 20x.

• The metadata field “Sharing User Name” or “Sharing User Email” will reveal which user had what files shared with them or evaluate the Permissions metadata.

• Duplicates will still exist unless de-duplication happens after exporting as the messages containing hyperlinks will be in a zip file with the corresponding hyperlinked files. The same messages will be in the export for messages.

Just the Surface

What we’re covering here is just the surface of when it comes to eDiscovery of hyperlinked files. If all this has you scratching your head at the complexity and options of preservation and collection of hyperlinked files, we understand. In fact, hyperlinked files are one of the top eDiscovery areas for which Digital Mountain is engaged because we’re known for our experience with these “tricky little buggers.” So while our aim here was to acquaint you with the complexities of managing eDiscovery of hyperlinked files, we also want to assure you that if you find yourself experiencing the pain of preservation, collection, processing and production of hyperlinked files, we’re here with reliable relief.