The debate over hyperlinked files continues! Craig Ball discusses cloud attachments and versioning in his latest post on the topic.

In his excellent Ball in Your Court blog on Monday (Cloud Attachments: Versions and Purview, available here), Craig attempts to eclipse other arguments (see what I did there? 😉 ) about the issue of hyperlinked files (a.k.a. modern attachments or whatever else you want to call them). As Craig noted in his previous post: “Microsoft calls them ‘Cloud Attachments,’ which is good enough for me.”

So, for this post, I’ll stick with calling them “cloud attachments” because Craig does and (hello!) Microsoft does.

Craig revisits the LinkedIn post from Rachi Messing, where he asks the cloud attachments and versioning question – “what VERSION is the correct one to collect and search”?

“Is it:

1. The version that existed at the time the email was sent (similar to a point in time capture of a file that is attached to an email the traditional way)
2. The version that was seen the first time the recipient opened it (which may lead to multiple versions required based on the exact timing of multiple recipients opening at varying times)
3. The version that exists the final time a recipient opened it
4. The most recent version in existence”

As Craig notes: “I’d reframe Rachi’s question: Once collected, searched and determined to be responsive, is the possibility that the version of a cloud attachment reviewed differs from the one transmitted a sufficient basis upon which to withhold the attachment from production?”

His response to Rachi’s post was as follows:

“The industry would profit from objective analysis of the instance (e.g., percentage) of Cloud attachments modified after transmittal. I expect it will vary from sector to sector, but we would benefit from solid metrics in lieu of the anecdotal accounts that abound. My suspicion is that the instance is modest overall, the majority of Cloud attachments remaining static rather than manifesting as collaborative documents. But my suspicion would readily yield to meaningful measurement.  … May I add that the proper response to which version to collect to assess relevance is not ‘none of them,’ which is how many approach the task.”

Craig proceeds to discuss how the collection of cloud attachments works in Microsoft Purview, which includes this embedded screen shot:

To which Craig states: “Looks ‘one-click easy,’ right?”

It does. Microsoft also addresses how they address the challenge of what they call “cloud attachments”, as follows:

“But cloud attachments present challenges during the eDiscovery workflow because only the cloud attachment link and not the actual content in the shared document are returned in an eDiscovery search. To address this challenge, eDiscovery (Premium) provides two solutions for collecting cloud attachments:

• Collecting the live version of a document that is linked to in a cloud attachment.
• Collecting the version of the document at the time it was shared in a cloud attachment.”

So, what’s the problem? There’s at least one that I know of: It’s only available in the Premium (“E5”) version of Purview – which is expensive and out of the reach of many organizations from a cost standpoint. C’mon Microsoft! 🙁

As I understand it, there’s also a question of how far back the cloud attachments collection capability goes for your documents. Earlier legacy cases may not be able to use this feature. I say “as I understand it” because I’m one of those people who can’t afford “E5”. 😉 It would be great to hear from someone actually using it to get specificity on any limitation there.

Regardless, Craig’s post does a great job of illustrating how the cloud attachments and versioning collection capability works in Microsoft Purview while stating his case as to why these should be considered “attachments”.

Craig also kindly references my five assumptions post on the issue, where he states: “The need to integrate cloud attachments in eDiscovery is not a need to chase every hyperlink in an email.”

My point exactly. I was disheartened after my last post that several people were trying to push it back to a discussion about all hyperlinked content, which I think is expanding it way too far. I prefer to employ the KISS principle here – “Keep It Simple, Stupid”. Solving the hyperlinked file issue is challenging enough without going down the “rabbit hole” of every conceivable type of content that could be linked in a message. That’s always been a problem. Hyperlinking to files – at the volume that many organizations are doing today – is the issue I’m focused on.

BTW, I’ve written enough posts on the topic now that it doesn’t make sense to link to each one individually anymore. So, I’ve tagged the hyperlinked documents themed posts and you can retrieve the series of them in a single search here!

So, what do you think? What should we call those files linked from messages? Please share any comments you might have or if you’d like to know more about a particular topic.

Image created using Microsoft Bing’s Image Creator Powered by DALL-E, using the term “email AND hyperlinks”.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.