Identify the right custodians and data sources early

See the identification workflow Explore CaseFusion

A custodian list is only a starting point

Most matters begin with a list of likely custodians based on current records and team knowledge. That list is necessary, but it rarely captures historical roles, shared repositories, or activity outside named accounts.

Historical roles change the picture

Current records may not show a person’s role during the relevant period, former employees who held responsibility, or moves between departments.

Relevant ESI extends beyond custodians

Shared repositories, non-custodial sources, and content associated with people outside the initial list may also be in scope.

Uncertainty expands scope

When information is missing, teams compensate with broader holds, more repositories, and longer date ranges.

Broader scope increases downstream cost

Broader scope may be appropriate, but it sends more ESI into processing and review without necessarily resolving the uncertainty that caused it.

Identification is where defensibility starts

Identification determines who receives a hold, which repositories are investigated, what is preserved and collected, how much ESI enters review, and whether the legal team can explain any of it afterward.

Explore CaseFusion

Missed scope creates risk

A missed custodian, repository, or linked document creates discovery risk, and the gap may only surface after preservation and collection have already moved on.

CUSTODIANS People with relevant ESI

REPOSITORIES Sources never investigated

DOCUMENTS Linked files left behind

Broad scope creates cost

An unnecessarily broad scope creates cost and operational burden. Once ESI enters processing and review, the consequences of the original scoping decision are difficult and expensive to reverse.

HOLDS More people than necessary

PROCESSING More ESI to handle

REVIEW Hard to reverse later

Scope is revisited as the matter develops

Context-Aware eDiscovery™ treats identification as a continuing, information-driven process. The scope set at the beginning is inherited by everything that follows, and it should be revisited as the matter teaches the legal team more.

START An informed first scope

REVISIT As the facts develop

INHERIT Every later stage builds on it

Combine system information…

No single source answers the identification question on its own. System information shows who people were, what they did, and how documents connect.

Identity over time | Historical titles, departments, managers, reporting relationships, and employment status, with the dates each was in effect.
Activity and document context | Indexed Microsoft 365 audit activity, sharing and collaboration patterns, files referenced in communications, and the people connected through access.

…with human knowledge

System-derived information supports legal judgment, which stays with the legal team. CaseFusion® brings every input into one place so they can be weighed against each other.

Custodian knowledge | Business processes, informal working relationships, terminology, and matter-specific facts, gathered as structured information.
Legal judgment | Whether a person is a custodian, whether a repository is reasonably in scope, what can reasonably be excluded, and how proportionality shapes the plan.

Identity over time

Current profiles show who a person is today, not necessarily the role they held during the relevant period.

Who held the role

Historical identity data shows who held a role, who managed the team, and when responsibility changed.

One person, many identities

Names, addresses, and accounts from different systems may belong to the same person. If they are not connected, relevant ESI can be missed.

Resolve identities carefully

Match records to the correct person and keep uncertain matches separate. Missed matches can omit ESI, and incorrect matches can add unrelated data.

What each signal can and cannot tell you

Identification goes wrong most often when a legal team relies on one signal to settle a question it cannot support.

INTERVIEWS What custodians know

Interviews reveal business context, informal collaboration, and people or systems that records may not show.

PERMISSIONS Where a person could go

Membership and permissions show which sites and repositories a person could access.

AUDIT ACTIVITY What was actually used

Recorded activity can show interactions with files and repositories during the relevant period.

INTERVIEWS Memory has limits

Custodians may not remember every repository, file, or interaction from the relevant period.

PERMISSIONS Access is not use

Permission does not show whether the person actually used the site or repository.

AUDIT ACTIVITY Activity shows interaction

An audit event records an interaction, not its legal or business significance. Coverage depends on the activity retained.

Common identification scenarios

When the record and the starting assumptions differ, the context-aware response is to investigate, connect the evidence, and record the decision. A gap between what a custodian remembers and what the record shows is information to act on.

The former role holder: Historical organizational information shows a different employee held the role through most of the relevant period. Evaluate that person with their manager, direct reports, and associated repositories, then decide what action is warranted.
The forgotten repository: A custodian doesn't recall a SharePoint location that indexed activity shows they used repeatedly. Treat the difference as a prompt for investigation, and connect the interview, activity, and scope decision so the reasoning survives the matter.
The acquired account: A custodian who joined through an acquisition holds ESI under an account from the acquired company's directory as well as their current one. Resolve both to the natural person so the repositories behind them belong to one custodian.
The scope that reopens: Interviews surface people the list missed, activity surfaces repositories that went unmentioned, and collected ESI raises new questions. Each pass is recorded, so the matter keeps a history of what changed and why.

Carry identification decisions forward

Identification produces two things a matter needs later: a scope, and the reasoning behind it. Both are recorded during the matter, so the scoping decision can be explained afterward.

The scope

The scope moves into legal hold and preservation, where custodians and sources are protected and the record of what was included continues to build.

The reasoning

Which custodians and sources were included or excluded, on what information, and when. Each later pass is recorded, so the matter carries a history of what changed and why.

Identify custodians & data sources FAQs

What is custodian identification?

Custodian identification is the process of determining which people may possess, control, create, receive, access, or have knowledge concerning potentially relevant ESI in a matter.

Why is a current employee directory insufficient for identification?

Employees change roles, teams, managers, departments, and responsibilities. A current directory shows who a person is today, not the role they held when the events occurred, and it does not show former employees who carried relevant responsibility.

Does CaseFusion decide who should be a custodian?

No. CaseFusion supplies identity, organizational, interview, activity, repository, and document context for the legal team to evaluate. The legal team determines who should be treated as a custodian and which sources are reasonably in scope.

What is identity over time?

Identity over time uses effective-dated employee and organizational information to establish a person's role, department, manager, team, employment status, and responsibilities during the relevant period, rather than as they appear today.

Do permissions show which repositories a person used?

No. Permissions show where a person could reach. Indexed audit activity shows recorded interaction with files and repositories. They answer different questions, and nominal group membership routinely exceeds meaningful use.

Does an audit event establish that a file is relevant?

No. An audit event reports an interaction. Whether the interaction matters is a judgment the legal team makes against the matter's facts, issues, and proportionality, and the coverage of any activity record is bounded by what the organization retained.

How do custodian interviews relate to system activity?

Interviews supply business and matter knowledge that no system holds. Activity supplies recorded use that no custodian recalls completely. Where the two differ, the difference is a reason to investigate rather than a result to accept.

Does Cloudficient guarantee that every custodian and source will be identified?

No. No technology can guarantee that every potentially relevant person or source is found. CaseFusion helps legal teams use available information more effectively and maintain a documented, explainable process.

Give every matter a better starting point

See how CaseFusion establishes who belonged to the matter when it happened, which sources they used, and why each one is in scope.

See the identification workflow Explore CaseFusion