In the days of snail mail, people would use a paperclip to attach additional documents or material to a letter. Flash forward to the dot.com boom, and we described electronic mail and attachments using the same terms. Even icon for email attachments harkens back to the paperclip days! At the outset, email attachments did not differ much from their snail mail predecessors. An OG email attachment was simply a static copy of a document, image, or Portable Document Format (PDF).
But modern attachments flipped the script. Originating in programs like BOX, GSuite, and Outlook OneDrive, these new attachments differ significantly from traditional attachments. Optimized for real-time collaboration, modern attachments are dynamic, hyperlinked documents.
The modern attachments ushered in a wave of new collaborative functionality but can also create a host of eDiscovery headaches. Knowing the lay of the land and what pitfalls to avoid is the first step to mastering modern attachments across the EDRM.
What Exactly is a Modern Attachment?
Think of modern attachments as the evolved, trickier cousins of traditional attachments. Heck, today, an “attachment” might not even be attached to an email message! A modern Attachment could be a link to a cloud document in Google Drive or Dropbox, an embedded spreadsheet in Teams, or even a live database that updates in real-time. These aren’t your grandpa’s attachments; they’re livelier, more dynamic, and more challenging to capture accurately.
These aren’t your static PDFs or trusty old Word docs. Modern attachments are a whole new breed, popping up in everything from cloud links to live collaborative spaces.
- Cloud Document Link – Forget local storage, now we have cloud attachments. These babies live in Google Drive, SharePoint, or OneDrive, constantly updated and edited. Capturing the “right version” at the “right time” is like herding cats.
- Embedded Spreadsheet – These could be Google Sheets or Excel links embedded in chat threads with real-time updates. Every keystroke, every formula tweak—is live, and it’s all a nightmare to track.
- Linked Presentation – You think you’re just getting a PowerPoint? Think again. These are live presentations hosted on the cloud, or evolving with each edit in Google Slides or Office 365 PowerPoint Online. Good luck finding the version used in that critical meeting six months ago.
- Live Database Link – Links to live tables and databases like Airtable change every time someone logs in. It’s data on steroids—and it never sits still.
- Audio Clip – Voice notes, call recordings, or snippets embedded right in the chat. If you’re not capturing metadata on who played it, when, and for how long, you’re already behind.
- Video File Link – A link to a Zoom recording or YouTube video embedded in a message. Now you’re not just finding the file; you’re tracking who accessed it, at what timestamp, and what was said.
- Interactive Form or Survey – These might be Google Forms or SurveyMonkey surveys, they are live data-collection tools embedded into threads or emails. Your job? Capture it all, plus every single response.
- Collaborative Whiteboard – Miro or Microsoft Whiteboard, where users scribble and brainstorm in real-time. Try capturing this without losing context—it’s like photographing a moving target.
- Task Board or Project Management Link – Links to Asana, Trello, or Monday boards with tasks, comments, and updates flying in every minute. Good luck tracking all that change document history.
- Versioned Code or Scripts – Repos from GitHub or GitLab linked in chat, with code updates constantly rolling in. It’s not just an attachment; it’s a living, breathing data source that evolves with every commit.
Why Should I Care?
Clearly modern attachments are a whole new ballgame. Why does this matter for eDiscovery pros?
These modern attachments make eDiscovery way more interesting—and not always in a good way. Collecting, preserving, and analyzing these modern attachments is a massive discovery headache. It means we’re dealing with data that’s constantly changing, living across different platforms, and sometimes hard to pin down. Miss a step, and you could lose critical evidence or end up with incomplete data. In a high-stakes case, that’s the last thing you want.
Here are a few headaches to watch out for:
Its Alive!
Say you open your Outlook, and you get a link to a Google Doc or OneDrive file. Simple, right? Wrong. This isn’t a static file. Oh no, it’s a live document that can be edited, commented on, and accessed by multiple people at any time or at the same time. In eDiscovery, you’re not just collecting this single document; you’re capturing a moving target. Tracking versions, permissions, and edits is crucial here.
It’s Messy
Ever work in Teams or Slack where someone drops a document right into the chat? That’s an embedded live document, and it’s a whole new level of fun. These embedded files can merge chat data with document content, making it tough to extract and organize. And don’t forget about tracking who accessed or edited it!
It’s Alive, Messy & Math, Oh My!
Modern attachments of Spreadsheets like Google Sheets or Airtable files have formulas, real-time updates, and collaboration galore. Imagine a spreadsheet that changes every minute—good luck capturing that. You need to keep an audit trail and preserve snapshots of this data at different times. Oh, and those fancy formulas? They can mess with what’s displayed, so you better know what you’re looking at.
Beyond Words and Phrases
The fund does not stop with documents and the written word or number. GIFS, Emojis, and audio or video clips are often embedded in messages. Those files often link to cloud storage and come with unique metadata. It’s not just about downloading a file—you need to capture who accessed it, any modifications, and maybe even transcribe it for review.
What Can I Do?
Modern attachments are a daunting challenge for information governance, preservation and discovery. But fear not my legal eagles! There are things eDiscovery practitioners can do to manage the electronically stored information on these hyperlinked files!
How to Handle Modern Attachments Like a Pro?
- Collection Tips: You’ve got to capture the actual file, not just the link. Use tools that support cloud integrations to grab the real content.
- Review Tips: Ensure you have access to all versions and activity history. It’s not just about seeing the latest version—you need the story behind it.
- Upgrade Your eDiscovery Platform: Make sure your platform can handle Teams, Slack, and cloud-based files. If not, consider an upgrade.
- Collect Full Metadata and Permissions: Capture user access levels, timestamps, and permissions to track who viewed, edited, or commented on each file.
- Preserve Change Logs: Document every edit and comment. Change logs create a clear audit trail of document evolution, which is essential for case reconstruction.
- Embed Permissions Tracking: Know who had the right to view or edit files—this can affect evidence admissibility and understanding of influence.
- Context for Embedded Media: Capture who accessed audio or video files, plus any comments or interaction timestamps, for complete context.
- Automate Version Control: Set up automatic snapshots of document states to preserve evolving data and support investigations.
- Maintain Chain of Custody: Track every interaction with the file, maintaining a robust chain of custody for admissibility.
Modern attachments are in the discovery process to stay, so it’s time to get savvy. Knowing how to handle these “advanced attachments” with defensibility will set you apart in eDiscovery. The complexity isn’t going away, but with the right tools and workflows, you can tackle these files with confidence.
