Do you remember the kid’s game “Where in the World is Carmen Sandiego?” The goal of the game was to track Carmen's villains around the world, arrest them and then ultimately arrest Carmen herself. The player begins the game by first going to the country where the crime took place and then obtaining hints from various sources on where the thief went next, leading to a chase around the world to find the thief before time runs out. (Source: Wikipedia.org)
Understanding where your custodians are (or were) located can be a similar exercise to this 80’s game because in order to understand your case, you need to understand the custodians involved:
- Who are the custodians involved in the case?
- What are their job title(s)?
- Where are they located?
- When were they employed?
- Who did they each report to?
- How often did they each move around the organization (i.e. between departments or offices)?
With the help of your Human Resources department, your goal will be to get all of this information gathered and laid out in a format that will allow you to verify that you have everything you need for "Custodian X".
Unfortunately, it’s not as easy as simply gathering the custodian’s email, or network file shares. In a totally Centralized IT Environment, this information may be easily accessed and collected, your job done in a matter of hours. However, in a Decentralized IT Environment, this could take days… and depending on the Custodians employment history, it could turn into weeks.
So, before you start panicking that you’ll have to provide every scrap of data from wherever the custodian was located, let me clarify; the date range of the matter will play a significant role in helping to scale down the data when you actually start Identification and Collection.