Digital Forensics and eDiscovery case study: A multi-jurisdictional trust dispute

Our in-house Digital Forensics and eDiscovery team provides multi-jurisdictional litigation support and specialist expertise in forensic data collection and analysis, data investigations, in-house digital investigations, and electronic discovery (eDiscovery) services.

This contentious trust and disclosure dispute case study involved cross-border data collection and court-ordered digital forensics mostly sourced from inside the Philippines.

The case centred on the care of a deceased high net worth individual and the dispute of his assets between his ex-wife and current wife. The dispute concerned the administration or oversight of a trust, with the court mandating the collection and review of emails and device data, including many webmail accounts.

Challenges

From the outset, the case presented a number of difficulties. The data was scattered across various custodians, including the client, personal assistants, and legal advisers. Each custodian used different devices and platforms, many of which were in the Philippines. Some email accounts had been long forgotten, with passwords lost and recovery options linked to inactive phone numbers. This made access and retrieval particularly challenging.

The devices themselves posed further complications. We had to deal with a mix of iPhones, Android phones, and laptops, each with different operating systems and storage formats.

Some devices lacked the necessary applications, such as messaging app Viber, which is popular in the Philippines, while others had limited synchronisation settings, affecting the completeness of data extraction.

Additionally, forensic tools like Verakey could not be used in the Philippines due to regional restrictions, which meant that devices had to be physically shipped to the UK for processing.

There were difficulties in obtaining passwords or physical access to devices. The custodians continued to use their devices daily, increasing the risk of accidental data loss or overwriting. All of this was compounded by the pressure of strict court deadlines, which required our team to act swiftly and decisively.

Solutions

Despite these challenges, our Digital Forensics and eDiscovery team implemented a series of well-considered and effective solutions that ultimately enabled the legal team to meet their obligations.

The first step was to arrange for the forensic collection of data. Where remote collection was not feasible, the team coordinated the shipment of devices to a forensic lab in the UK. The team worked closely with local counsel and client representatives to ensure that the devices were securely packaged, cleared through customs, and delivered on time. This approach allowed the team to bypass the regional restrictions that had initially hindered the use of forensic tools.

In parallel, efforts were made to recover access to email accounts. The team liaised directly with our client’s IT personnel and attempted password resets using recovery emails and phone numbers. In cases where recovery was not possible, webmail access was used to extract data directly from the accounts. For example, one Gmail account was successfully accessed and synchronised, resulting in over 67,000 documents being processed and loaded into the review platform.

Where access could not be restored, the team documented all recovery attempts and included this information in affidavits to maintain transparency with the court.

Results and impact

Once the data was collected, the team established a structured review workflow. Review pools were created based on date ranges, file types, and keyword searches. Deduplication and email threading were applied to streamline the review process, and tagging protocols were set up to ensure consistency.

Irrelevant domains, such as spam and newsletters, were excluded to reduce noise in the review set and keep the investigation focussed. Reviewers were onboarded and trained on the platform, and ongoing support was provided to ensure that the review progressed smoothly.

Where data could not be recovered, such as the Yahoo email account with an obsolete recovery number, the team documented all recovery attempts and included this information in affidavits. This ensured transparency with the court and opposing counsel, demonstrating that all reasonable efforts had been made.

Key takeaways

The matter highlighted the complexities of cross-border eDiscovery in contentious trust litigation. Despite numerous obstacles – including technical limitations, jurisdictional barriers, and client-side delays – our team successfully collected, processed, and reviewed a substantial volume of data.

Their proactive approach, technical expertise, and commitment to transparency enabled our legal team to meet court deadlines and fulfil their disclosure obligations.

This case serves as a strong example of how adaptability, early planning, and clear communication can overcome even the most challenging circumstances in digital evidence management. The solutions implemented not only ensured compliance but also demonstrated the value of a well-coordinated eDiscovery strategy in high-stakes litigation.