Ask before you collect.

Section 1Opening and ground rules

Set expectations, establish privilege, and confirm the custodian understands why they are here.

1. 1.1Confirm the custodian's full name, any prior names, and preferred contact details.
2. 1.2Explain the purpose of the interview: identifying and preserving information, not evaluating the custodian's conduct.
3. 1.3Deliver the Upjohn warning and confirm the custodian understands who counsel represents.Note the time and the custodian's acknowledgment in the memo.
4. 1.4Confirm the custodian has not discussed the matter with anyone other than counsel, HR, or their manager, and ask them not to going forward.
5. 1.5Ask whether the custodian has any questions or concerns before you begin.

Section 2Role and involvement

Understand what the custodian does and how their work touches the issues in the matter.

1. 2.1What is your current title, department, and location? Who do you report to, and who reports to you?
2. 2.2When did you join the organization, and what other roles have you held here? Give dates for each.
3. 2.3Describe your day-to-day responsibilities during the relevant period.
4. 2.4What was your involvement with the events, transactions, products, or people at issue?
5. 2.5Who else worked with you on those matters? Include colleagues, managers, assistants, contractors, and outside parties.Every name here is a potential additional custodian.
6. 2.6Were any of those people terminated, transferred, or otherwise left the organization? When?
7. 2.7Did you take over anyone else's files, mailbox, or responsibilities? Did anyone take over yours?
8. 2.8Did you use any nicknames, code names, project names, or abbreviations when referring to the matters at issue?Feeds directly into search term development in Section 13.

Section 3Legal hold and preservation

Confirm receipt and compliance with the hold and identify anything at risk.

1. 3.1Did you receive a legal hold notice for this matter? When, and how did you acknowledge it?
2. 3.2Do you understand what categories of information the hold covers? Walk me through your understanding.
3. 3.3What steps have you taken since receiving the hold to preserve information?
4. 3.4Since the hold issued, have you deleted, moved, archived, or overwritten anything that might fall within its scope, even inadvertently?
5. 3.4aIf yes: what was it, when, where was it stored, and is it recoverable from another location or a backup?
6. 3.5Are any automatic deletion, auto-archive, mailbox size, or retention policies running on your accounts or devices that you know of?
7. 3.6Have you been on any prior legal holds that may overlap with this matter? Are they still active?
8. 3.7Is there anyone else who should have received the hold but did not?

Section 4Email

Map every mailbox the custodian used for business, including the ones they should not have.

1. 4.1What email addresses have you used for work during the relevant period? Include prior addresses after name changes, acquisitions, or domain migrations.
2. 4.2Do you have access to any shared, group, or functional mailboxes (for example, a department inbox or a distribution list you manage)?
3. 4.3Does anyone else have access to your mailbox, or do you have delegate access to anyone else's?
4. 4.4Have you ever used a personal email account (Gmail, Outlook.com, iCloud, Yahoo) for anything work related, including forwarding items to yourself?
5. 4.4aIf yes: which accounts, how often, for what kinds of messages, and do those messages still exist?
6. 4.5How do you organize your email? Describe your folder structure and any rules that move messages automatically.
7. 4.6Do you archive email locally, for example to PST or OST files, or export messages anywhere outside the mail server?
8. 4.7Do you use an email client on a personal phone or computer that stores a local copy of your mailbox?
9. 4.8Do you routinely delete email or empty your deleted items folder? How far back does your mailbox currently go?
10. 4.9Do you use encryption, message expiration, or "private" or "confidential" sensitivity labels on any messages?

Section 5Chat, text, and messaging

Messaging is where relevant material is most often found and most often lost. Be specific by platform.

1. 5.1Which collaboration platforms do you use for work: Microsoft Teams, Slack, Google Chat, Zoom Chat, Webex, others?
2. 5.2For each, which channels, groups, or workspaces are you a member of that relate to the matter? Are any of them private channels or direct messages?
3. 5.3Do you send or receive work-related text messages (SMS, iMessage, RCS)? With whom, and on which phone number?
4. 5.4Do you use WhatsApp, Signal, Telegram, WeChat, Facebook Messenger, LinkedIn messaging, or any other third-party app for work conversations?
5. 5.4aIf yes: are disappearing or auto-delete messages enabled on any of them? Since when?
6. 5.5Have you ever changed a retention or auto-delete setting on a messaging app or channel yourself?
7. 5.6Do you back up your phone's messages to iCloud, Google, or a computer? When was the last backup?
8. 5.7Do you use messaging on a smartwatch, tablet, or secondary phone that keeps its own copy?
9. 5.8Have you deleted any threads, left any group chats, or blocked any contacts related to the matter?

Section 6Documents and file storage

Locate the working files: drafts, spreadsheets, presentations, scans, and the places they are kept.

1. 6.1Where do you save your work files? Walk me through each location: local drive, network share, SharePoint, OneDrive, Google Drive, Box, Dropbox, iCloud, others.
2. 6.2For each location, what is the path or site name, who else has access, and how is it organized?
3. 6.3Do you use any personal cloud storage, personal computer, or personal external drive for work files, even temporarily?
4. 6.4Do you use USB drives, external hard drives, SD cards, or other removable media? Where are they now?
5. 6.5Do you sync files between devices with a tool like OneDrive, Dropbox, or iCloud Drive that could hold an offline copy?
6. 6.6What types of documents did you create or handle on the matters at issue (contracts, reports, models, presentations, images, CAD, source code, lab notebooks)?
7. 6.7Do you keep versions or drafts, or overwrite the same file? Does the system keep version history?
8. 6.8Do you use document management, contract management, or e-signature systems (iManage, NetDocuments, DocuSign, Adobe Sign)?
9. 6.9Do you take notes in OneNote, Evernote, Notion, Apple Notes, Google Keep, or similar apps?
10. 6.10Do you have any files that are password protected, encrypted, or stored in a container you would need to unlock for us?

Section 7Devices

Every device the custodian used for work during the relevant period, including replaced and personal ones.

1. 7.1List every computer you used for work during the relevant period: make, model, asset tag if known, and whether it was company issued or personal.
2. 7.2List every mobile phone and tablet you used for work. Which numbers were associated with each?
3. 7.3Have any of those devices been replaced, upgraded, reimaged, wiped, lost, or returned to IT? When, and what happened to the old device and its data?
4. 7.4Do you use a personal device under a bring-your-own-device policy? Is mobile device management installed on it?
5. 7.5Do you work from a home computer, a shared family computer, or a virtual desktop?
6. 7.6Do you back up any device to a local drive, Time Machine, iCloud, Google One, or another service?
7. 7.7Do you have any devices at home, in a car, in a storage unit, or in another office that could hold work data?
8. 7.8Are any devices protected by a passcode, biometric lock, or encryption that we would need your help to access?

Section 8Business systems and databases

Structured data is easy to overlook. Ask by function, not by system name.

1. 8.1What business applications do you use in your role? Consider CRM, ERP, accounting, HR, ticketing, project management, engineering, laboratory, trading, and clinical systems.
2. 8.2For each, what did you record there relating to the matter, and can it be exported or reported on?
3. 8.3Do any of those systems store attachments, notes, comments, or free-text fields?
4. 8.4Do you use internal wikis, intranet sites, SharePoint lists, or knowledge bases?
5. 8.5Do you use analytics, reporting, or data-warehouse tools (Power BI, Tableau, Looker) where you saved dashboards or queries?
6. 8.6Do you use source code repositories, issue trackers, or DevOps tools (GitHub, GitLab, Jira, Azure DevOps)?
7. 8.7Have you used generative AI tools (ChatGPT, Copilot, Claude, Gemini, or an internal assistant) for work relating to the matter? Are those conversation histories retained?
8. 8.8Are any of these systems hosted by a third party, and who administers them internally?

Section 9Meetings, voice, and calendar

Recordings, transcripts, and calendar entries that document who met whom and when.

1. 9.1Were any meetings about the matter recorded or transcribed (Teams, Zoom, Webex, Otter, Fireflies, Gong)? Where are the recordings kept?
2. 9.2Do you use AI meeting assistants or note takers that generate summaries? Where are those stored?
3. 9.3Do you receive voicemail? Is it delivered to email, kept on the phone system, or both?
4. 9.4Do you use softphone or call-recording tools? Are any of your calls recorded for compliance or training?
5. 9.5Which calendar do you use? Do you maintain a separate personal calendar with work entries?
6. 9.6Do you keep handwritten or typed notes from meetings? Where?

Section 10Paper and physical media

Hard copy still matters, particularly for signed originals, annotated drafts, and notebooks.

1. 10.1Do you keep paper files relating to the matter? Where: office, home, offsite storage, a colleague's office?
2. 10.2Do you keep notebooks, day planners, or legal pads with handwritten notes?
3. 10.3Do you have printed documents with handwritten annotations, sticky notes, or signatures that do not exist electronically?
4. 10.4Do you have CDs, DVDs, tapes, old phones, or other physical media in a drawer or storage box?
5. 10.5Have you shredded, recycled, or sent any paper to offsite storage since the hold issued?

Section 11Delegates and third parties

Information the custodian controls but someone else physically holds.

1. 11.1Does an assistant, coordinator, or delegate manage any of your email, calendar, files, or expenses? Under whose account?
2. 11.2Do outside vendors, consultants, agencies, law firms, accountants, or contractors hold documents you created or received on the matter?
3. 11.3Did you share files through external links, shared workspaces, data rooms, or client portals?
4. 11.4Have you provided documents about this matter to anyone outside the organization, including regulators, auditors, or the press?
5. 11.5Are there former employees who would have had relevant files, and do you know whether their accounts were preserved?

Section 12Deletion, retention, and departures

Understand what has already been lost and what is still at risk of loss.

1. 12.1Describe your personal habits for deleting or cleaning up email, files, and messages.
2. 12.2Are you aware of any organization-wide retention or auto-deletion policies that affect your data? Have any been suspended for this matter?
3. 12.3Has anyone asked you to delete, alter, or move documents relating to the matter?
4. 12.4Have you experienced a device failure, ransomware event, account compromise, or data loss during the relevant period?
5. 12.5Do you plan to leave the organization, change roles, or replace any device in the near term?Triggers an offboarding preservation protocol if yes.
6. 12.6Do you know of backups, snapshots, or archives that may contain earlier versions of your data?

Section 13Search scoping

Gather what you need to build date ranges, search terms, and a targeted collection plan.

1. 13.1What date range best captures your involvement with the matter? What events mark the beginning and the end?
2. 13.2What words, phrases, product names, project codes, ticket numbers, or acronyms would appear in relevant documents?
3. 13.3Are there common terms that would produce false hits we should exclude?
4. 13.4Who are the key people whose names or addresses would identify relevant communications, including external domains?
5. 13.5Do you communicate in languages other than English on the matter? Are there transliterated or mixed-language terms?
6. 13.6Are there specific folders, channels, or repositories where relevant material is concentrated, and others we can safely exclude?
7. 13.7Roughly how much material do you expect: a few dozen documents, thousands, or more?

Section 14Privilege and sensitive data

Flag material that will need special handling before review or production.

1. 14.1Did you communicate with in-house or outside counsel about the matter? Which lawyers, and through which channels?
2. 14.2Do your files contain personal data of employees, customers, or patients that may be subject to GDPR, CCPA, HIPAA, or similar rules?
3. 14.3Is any of your data stored in or transferred from another country?
4. 14.4Do your files contain trade secrets, source code, financial data, or third-party confidential information governed by an NDA?
5. 14.5Do your work devices or accounts also contain personal, medical, financial, or family information that you would want segregated?

Section 15Close and next steps

Leave with consent for collection, a list of follow-ups, and an open line.

1. 15.1Is there anywhere else relevant information might exist that we have not covered?
2. 15.2Who else should we be talking to?
3. 15.3Confirm the custodian consents to collection from each identified source and note any device or account they need to make available.
4. 15.4Explain the collection process, expected timing, and that the custodian should not self-collect, reorganize, or "tidy up" beforehand.
5. 15.5Instruct the custodian to contact counsel if they remember anything further, receive a related request, or plan to change devices.
6. 15.6Confirm the best way to reach the custodian for follow-up and whether a second interview may be needed.

WorksheetData source map

Complete one row per source identified during the interview. Reconcile it against IT's system inventory before finalizing the collection plan. The entries below are the usual starting points for each column.