Episode 3: Bridging Forensics To Review With Data Solutions

The riskiest moment in eDiscovery often isn’t the collection or the production, it’s the handoff in the middle where messy data has to become reviewable evidence. We walk through that end-to-end workflow from the point of view of digital forensics and the data solutions team that has to normalize, parse, and translate real-world exports into something counsel can rely on. Steve Davis brings a kitchen metaphor that lands: you need the right “chef de cuisine” to keep the line moving, even when too many cooks are touching the same case.

Our guest, Mike Johnson from Purpose Legal’s data solutions group, gets practical about what’s breaking legacy workflows right now: Microsoft 365, Purview eDiscovery exports, and the modern attachment problem. We talk about why platform changes ripple into scripts, column mappings, and processing logic, and why the only sane response is disciplined testing. Think sandbox environments, controlled variables, repeatable exports, and documenting what actually happens rather than repeating what you heard somewhere else. We also dig into why Purview’s August 2025 changes can improve efficiency while still forcing teams to adapt.

Then we get into the issue that can make or break an investigation: versioning. When the case needs the file as it existed years ago, “current version” may not be good enough, and retention settings might not have been enabled when it mattered. We close by looking ahead at chat evidence and AI artifacts, from WhatsApp and Telegram to ChatGPT and Claude, plus how client-facing teams can help by looping technical experts in early and collecting what’s needed and nothing more.

Subscribe to Evidence Matters, share this with your e-discovery team, and leave a review. What data source is causing the most headaches in your workflow right now?

Evidence Matters with Bui & Davis is a podcast for litigators, in-house counsel, legal operations professionals, and eDiscovery teams navigating today's complex data landscape. Hosted by digital forensics experts Jerry Bui and Steve Davis, the show explores digital evidence, investigations, mobile devices, AI, defensibility, data governance, and the evolving challenges shaping modern litigation and discovery. Practical insights, real-world experience, and conversations that help legal teams make better decisions when evidence matters most. 

Visit www.purposelegal.io for more information

Transcript

End To End Workflow Basics

Jerry Bui 0:08

Hi everyone, welcome back to another episode of our podcast, Evidence Matters, where I, Jerry Bui, am co-hosting with the uh luminary Steve Davis. We do have a special guest today that we'll introduce in a second, but uh we did want to touch on the entire concept of the end-to-end workflow. Because as forensic examiners and being the tip of the spear or in the front of that workflow where we collect data, not just traditional run-of-the-mill ESI data, but we're often asked to do is tackle the newfangled new frontier of data, which is occurring at greater frequency and at greater speed every single day as data sources are considered as evidence within our very important e-discovery, litigation, uh, investigation, and regulatory response matters. But what you should be looking for in an organization is the ability for those forensics folks to be able to hand off those collections to someone that can handle it and help dovetail it into a common and stable e-discovery workflow. There is a crucial step in that process, a handoff, if you will. And Steve, this is where I want to hand it off to you because you're so good at these analogies or metaphors. And what do you liken this process to and the role of that glue that ties the collection to the rest of the downstream workflow?

Steve Davis 1:49

Yeah,

The Kitchen Handoff Analogy

Steve Davis 1:50

I'm good at it because I'm kind of sophomoric. So if you're not very bright, you can speak to the common man pretty well. So I tend to do okay there. Um, as you know, Jerry and I have spoken before on podcasts, and everyone knows I love streaming stuff and watching. So literally, we were just watching this past week, The Bear. If you haven't watched it before, um, the bear is one about, and I'm from Chicago, so Italian beef is in my blood, literally. And the bear is a show with Jeremy Allen White and a series of other people about running a kitchen. And the analogy to me when Jerry first brought it up to me was this idea of, you know, they always talk about too many chefs in the kitchen. But in this show, in this eight series or this eight-episode series they're doing right now, they kind of selected a chef de cuisine. And I think of the chef de cuisine as what Mike Johnson and Joe and the other people inside data solutions do for us. Jerry and I are part of a club, not a cult, but just a club of kind of forensics. And sometimes we feel like we're on an island. But I really feel like the the brethren or the kin to us is really data solutions. Um, we speak similar languages, we understand technologically what we're up against and what what really the beauty of not just our company, but companies that embrace the uniqueness of data solutions and the fact that you've got to normalize and parse and deal with abstract document types and file formats. And I know everyone, you know, lawyers who are very brilliant will sit down and say, that's all fascinating. You know, get me to the finish line faster. And this is where data solutions or that unique person that can tie things together in a kitchen or in an e-discovery company matters and it's worth its weight in gold, literally. So

The Modern Attachment Problem

Steve Davis 3:44

I gave you lots of accolades there, Mike. But maybe, maybe just talk a little bit about, I know, you know, we could pick any topic and we could go through 20, 25 minutes, you know, on one item. But give me maybe a couple of the top things that you deal with day in, day out, you and your colleagues in the data solutions department, that are maybe the most challenging.

Mike Johnson 4:08

Yeah, well, thanks for having me, guys, as your first uh guest on your podcast with you industry legends, but so take it easy on me a little bit. But um yeah, so just real quick, uh the data I'm on the data solutions here at Purpose Legal, as you guys said, and I often find myself as that bridge uh between forensics and downstream workflows, which is kind of a gray area at a lot of places. Um I tend to find myself working at those those kind of difficult edges of processing and ingestion, taking the messy data types that don't fit cleanly into legacy workflows and figuring out how to uh make them reviewable and usable um uh for reviewers downstream and production, etc. Um recently I've spent a ton of time and effort um focused on on the solving for the modern attachment problem that is, of course, just buzzy in the industry right now, um, which is also a move a constant moving target, as as you know. Uh is every time you think you figured something out, it something changes, or Microsoft changes something, or you know, it's just always moving and always shifting, and and we're trying to at least when we can keep pace and maybe even sometimes stay a step ahead.

Jerry Bui 5:33

Um yeah, you mentioned you mentioned, Michael, um uh um Microsoft, and yeah, uh and I think you're alluding to Microsoft 365, the enterprise cloud platform. That's been around for a long time. Why is it still a pretty significant struggle for a lot of our clients to understand, consult or advise and deal with this uh concept? Uh what what what do you think the the main reasons are for any outstanding misunderstandings or problems and complications, failures in the modern attachment workflow as we extract them from M365 and try to rationalize them into a you know document review workflow? It changes. Is it due to like a major shift at all? I know there was a major um change in uh August of 2025. Right. And there's you know, there's tweaks here and there. Yeah. And you said you try to keep pace or stay one step ahead. How do you do

Testing Purview Changes Scientifically

Jerry Bui 6:38

that?

Mike Johnson 6:38

Yeah, well, having uh it it's it's like the scientific process, right? You you see an update, you you test before just saying, okay, this update is gonna work. We know it's gonna work, right? It's almost not trusting everything all the time, you know, and taking it and saying, all right, so here's the update, but but let's let's let's test, let's export, let's observe, let's change this variable, but let's keep these constant. It really is, you know, the way I approach um testing new new data sources and and new updates is is is very scientific in a way, following the say you know, those processes and really scrutinizing and analyzing the results, noticing things, of course, and and noticing differences and and trying to, and when an issue comes up, trying to figure out trace back what that issue is. Um yes, the newest purview update you mentioned in August, um it did introduce some efficiencies, as you know, mainly the one being able to export without going to a review set, but doing direct exports. Um for us in our workflow internally, it it helps our workflows because of differences between what a review set is, which kind of pushing to a review set processes the data in a way it extracts attachments, it extracts containers, etc. Causes more of a data explosion than just going from the uh the X the query you know direct from the query itself. So for us that was an improvement. Um at the same time, all the the CSVs that we were used to working with, the field names, the order of those fields, you get so used to seeing things, you know, repeatedly for a year or two or six months, whatever they give you, and you get used to going to the same, you know, column DG, let's say. It's weird how these things get so stuck in your mind and suddenly they change it. And tools which are you know built around locations and field names and things like that all need to change accordingly, right? Workflows need to change. Um so those are the kinds of things trying to trying to keep up with. Um and as soon as it you you get there, like I said, it seems like there's something around the corner, right? There's always something. And it and not just with with purview, you know, or uh looking at relativity collect and and other options like that as well.

Jerry Bui 9:07

And you're not just you're not working with production data. When you're doing experiments, obviously you have a sandbox that you're working with, right? How is it how important it is it for an organization like ours and others in the industry to have a sandbox and and do very scientific experiments so that you can be cr crisp and and clear with your answers to the client when they have questions.

Mike Johnson 9:31

Exactly. It I'm in a position where I'm trusted and I've been given access to the things I need to do the work I need to do. It's having that kind of open um ability and trust to go out there and test what I need to do and have access to almost every back-end tool and system I need to do is invaluable, absolutely. And purpose has has has given me that. Um so I can I can get in there in purview, I can generate test data, I can do PowerShell scripts to test legal hold behavior, and and you know, I'm I'm able to get in and and do what I need to do, and I'm supported and enabled in that way, which is which is a total game changer.

Steve Davis 10:16

Yeah. And I would say that it's a little counterintuitive because we're a little bit of a fast food restaurant. I mean, people wheel up with their latest case, they want it done right right away. You know, you can't go to a lawyer and tell them, hey, try my case faster, but they will, in e-discovery, come to you and say, I want data collected, parsed, normalized, and you picked the best tool to get it done, and I need that yesterday, you know, by noon. And so it's a little weird or counterintuitive, like I said, for a data solutions area to be afforded the opportunity to do empirical testing. And I mean, you're talking to three guys that all three of us come from that science background. I mean, all of us love that. And that to me, whenever people say anything, I'm like, you know, show me Missouri, right? Prove it and empirically prove that that's the way it works. We get a lot of people in the e-discovery industry that get out over their skis and start saying things or repeating things or even hearing a podcast like this and just regurgitating what they heard. And it's kind of comforting, but it's also probably a little scary because you have a day job, right? You got to be producing stuff day in and day out. So it's kind of a unique thing to be afforded the opportunity not just for a sandbox, but also have the time to underwrite and develop decision making around what is truly the best. We're,

Tools And The Versioning Trap

Steve Davis 11:39

you know, you talked about modern attachments the other day. There used to be the plug-in FEC, right, that dealt with all the Google workspace and Google Suite before that. But now, isn't that also one of the tools we can utilize along with several others to deal with the M365 ecosystem?

Mike Johnson 11:56

Yes, absolutely it is. Um, and FPC is a great one. We really like on on for the data solutions team. Um, so much again of what we're trying to do is is bridge that gap, the forensics to processing review gap, which is to make sure we're getting the format that works best for us, which is difficult, you know. Um, and having that experience downstream to understand what needs to be done upstream, right? And that's again that unique position I'm in. But yes, FEC create puts it in a format that makes things easier for us. It's you know, it's difficult enough to deal with modern attachments, but FEC is great. Um we've also recently, I guess we we're still in the midst of developing um and vetting and putting it through its paces, but we're working also on a custom tool internally to take um purview exports in their in their native format. Um and then of course the versioning question, which I I might have alluded to earlier. That's that's kind of the the uh next layer, right? That's whatever you talk, you start talking about modern attachments, and suddenly someone is gonna ask about versions, and a lot of it is a lot of people when you talk to them, they're assuming they're getting the contemporaneous version a lot of times. Um, and we have to educate them right on the that it's not or it is, depending on the tool and things like that. So that is also um definitely part of our thought process as we're going about this new tool as well, because we'd love to solve for that.

Steve Davis 13:43

That's a that's a big one. And Jerry and I have both, you know, um been besides podcasts, the reason we've allowed to be doing pro podcasts, we've been sitting on stands for you know many years of our lives doing testimony, and people will gotcha, right, about whatever issue they can. They'll argue about facts, they'll argue about law, they'll argue about process, whatever. And when it comes, this is a huge one versioning, but you know, as investigators, Jerry and I, it may be about a contract document that existed in 2000, you know, 2020, and it mattered how that document existed. Yeah, a lot of times those documents are static and they never change, but a lot of times they're collaborative and dynamic and they do change. And so I would argue that it's not, you know, absolutely acceptable to just you know take the latest version unless you understand all the track changes that have occurred over time, or you can revisit. And so that's a great one because I know there's not an easy answer for every platform in terms of going back four or five years to when the actual dissemination of the information occurred. What how do you deal with that? Let's say it's an investigation, you need to go back four or five years. Does that render some of the tools useless or lesser?

Mike Johnson 15:03

Yeah. Yeah, exactly. I mean, and that's the perfect use case. We're actually in the midst of consulting and collecting for a case for that exact reason. I mean, frequently, as you know, uh the advice when it comes to versioning and purview, because of the explosion of data versions, we you know commonly we end up with the current version, right? But there's there's times like the contract disputes where it's it's not an option. That is it's needed. We need to find that version and and we need to get all of them. Um so so yeah, it it it depends on the use case. Um and and targeting that version is custom and it's you know, if things like retention policies, clients can um, Jerry, as you know, they can set certain retention policies in purview, but it all has to be proactive, um, you know, ahead of the game, which five years ago no one turned on that setting, and you need that version from five years ago, you're gonna have to find it a different way, right? So uh yeah, it's it's a case by case, and it's uh it's one of those things to talk through, and and it's definitely exciting, and that is that is a lot of a lot of what we're thinking about these days, is trying to get that one. That's what everyone wants, right? That is what people want. If there's one version they want, it is the contemporaneous version.

Jerry Bui 16:30

And you mentioned exciting. I think that's the right attitude for us here uh on this podcast is that we look at these challenges as exciting. Um, and so you gotta have an optimistic, positive attitude when you're dealing with this sort of thing and not a defeatist one. Um and you mentioned like the perfect case use case, but not everything's perfect, right? It's kind of mixed use cases, and you talk you and you mentioned talking things through.

Consultative Calls That Prevent Rework

Jerry Bui 16:54

That implies a consultative attitude. And Steve, how great is it to have someone like Mike be able to join our client calls early, which we often do. We we include Mike on these early um stage calls so that we can talk through these issues because even though there's case law, even though there's industry best practice, they're always what always matters is what are the needs of the case and what have parties negotiated. And so there's all these input variables into what the right size solution is. So if we have purview exports and we can massage those things manually as we do through various scripts, or we're working on automating that. We have FEC, forensic email collector from Metaspike as an option. We have rel collect as an option. And of those templated workflows, those solutions that we've vetted, the input variables dictate which one would be the optimal solution. So the consultation really matters. How valuable is it, Steve? Because I know you do a lot of these um sales consultations uh to have a sales engineer like Mike available for these calls.

Steve Davis 18:08

Well, I think I think it's a tremendous point. And I think we're very blessed. Um, all of us, it's funny when you think about, you know, going back 20, 25 years in our careers, and you think of the dichotomy between people that are allegedly salespeople that, you know, talk a lot, and sometimes we get bucketized if that was a word up there. And sometimes then there's the hyper-technical people that understand parsing and normalization, structured data exports, and things like that. And and so typically those are people that you find in a cave, right? And they don't, you know, communicate or they don't come out for sunlight. But but what we have done here is kind of bridge the gap. And I think one of the beauties and the reason I do think we have positivity and we enjoy what we do, Mike's a good dude. I mean, Jerry's a good dude. These are people that when you get on the phone, we can speak technically with people, but we also kind of tear down some of the inherent defenses that occur. Because you know what I love and and I know Jerry loves, and and Mike's the same, cut out of the same cloth, is that we're problem solvers. We love problem and people that are scientists that like, I love equations. I used to get excited about math tests. People think I'm an idiot. That's okay. But but I did, I love that stuff because I like testing what I do and whether I understood and and could come back later. And I think that's where Mike tears down defenses and the entire data solution staff. I mean, the other people on that staff as well, you can get them on the phone. They're not speaking a different language, it's not Greek to the end user or the client that's listening to it. And they're interested. They're interested and they want to solve a problem. So bridging the gap between what sales rhetoric can be and then hyper technical hyperbole can be and bridging those together so you have someone that understands challenges, but can also communicate with people and understand getting to a goal line or an end result. I think it's huge. And I think it's why this is kind of a free-flowing convo, is that, you know, that's how we kind of deal with each other on cases, is the same way we kind of communicate on these podcasts.

Jerry Bui 20:15

Yeah, and there's not been a single call where the client has not had an aha or eureka moment from Mike being on there and explaining things in a very crystal clear way. I that's just really telling on the impact that Mike and the rest of the data solutions team has.

Chat Data And AI Evidence Growth

Jerry Bui 20:33

And Mike, I have another question for you. I know that there's some days, since you've been so heavily steeped in solving from M365 um issues um and uh crafting solutions, I know there's days where you feel like, am I going to spend the rest of my life in my with Microsoft Purview? What else are you solving for as part of your um as part of your um you know, to-do list and the rest of the department's to-do list? What are some of the other challenges that you're seeing that um are important to clients? And what is like the other very uh uh important priority for clients that you see solving for in the near future?

Mike Johnson 21:14

Um to answer your question, what else is out there? Uh well, chat data, I think we we briefly touched on that at the beginning, but that's uh you know evolving and rapidly changing, and you know, we've got project management platforms and we've got collaboration platforms, we've got chat data sources seeming to pop up every day, you know, Telegram and WhatsApp and all this other stuff, or Notion AI, that's you know, that's another one. Everything chat bot AI chatbots, of course, is huge. You know, data's being generated everywhere outside of email, it seems like. So that's that seems to be the other the other thing that you know is constant. Changing and we're constantly testing and and trying to figure out what artifacts from these tools do we are you got, you know, your team specifically forensics, what's available, what can we get, and with that, how do we turn it into something that's usable at the end, right? And that is that's something that we're always trying to keep up with. Um a lot of it we do that, you know, we like I said, we try to stay ahead of it, but every day you might get a new thing on one day and you gotta figure it out, right? And and and and that's again back to what's great is we have the ability to test and and there's a great we have a lot of communication with you guys and and testing outputs and and everything like that. So um yeah, I would say chat data. I'm trying to think of something else that's that's just forefront right now. Can you think of anything?

Steve Davis 22:55

I mean, obviously I was gonna say the you know, the third-party app that you're talking about and you allude to with chat data. Um, you know, I always say a phone is not a phone is not a phone, like they say the old saying from Gertrude Stein, a rose is a rose is a rose. Well, we all know that a phone's not a phone. And when a client comes to us and says, Can you do this? The first question we, and I heard you say it earlier in the podcast is it depends, right? Jerry and I have beaten that phrase to death over the years using it, because it does depend. And it matters whether it's an Android, and it matters whether it's from iOS, and it matters what the flavor of the third-party app. And is that encrypted data? Is it ephemeral data, right? Does it still exist? Is it synced or backed up somewhere else? So I know that whole category of information, you've got to have, I was thinking while you were speaking, eyes wide open, right? You got to have your eyes wide open. You got to be when you're 15 years old and we're teaching the kids how to drive. It's not just what's in front of you, what's on the side, and then what's in back. And then again, check that one to the right, and then make sure the animal hasn't run out in the road. And I mean, there's so many different things going on. It kind of feels like that's what you're up against every morning. Does the API work today? Right. Oh, did they disengage that where it's not? Or you could be able to get one year's data out of WhatsApp utilizing an off-the-shelf tool, and then you know what? Not today. So I think that's the type of flexibility that we talked about that you've got to have to succeed in your role.

Jerry Bui 24:31

Absolutely. Yeah, it's chat chats with real people and chats with um AI are definitely um on the forefront. I'm seeing a lot of chat GPT and Claude artifacts being um you know being collected and analyzed and wanting answers on that front because so many knowledge workers are relying on that. Um, but maybe to shift the lens or the um microscope a little bit here, are you using AI for the uh for your own work? Is it helped you solve these problems? And and um, you know, I know you're careful about feeding it any kind of client data. That's a big no-no. But in general, in terms of like building utilities or workflows or solving code, um, is it is it actually accelerating that process so that we can keep pace with handling the um you know the data and transforming it to something um that fits into what you call the legacy workflow?

Mike Johnson 25:32

Yeah, yeah, definitely. We're not we're not um we're not avoidant, that's for sure, uh of AI. Um it to an extent, uh yes, for certain coding, you know, it is it is being used, something like Claude uh to help with that. But fortunately, I it you know, I'm here, but I have my team and specifically um Kevin Harm on my team, who has a lot of uh coding, previous coding experience, which I'm fortunate to work with him on. Uh he's he knows most of that, fortunately. But yes, I I think there's a little bit of use, yes, uh to assist in those ways. But outside of that, um we try to rely on on internal skill set, but as much as possible. But yeah, when needed, absolutely, we will tap that as a resource.

Jerry Bui 26:27

Great. Yep, you're not scared of technology because you have to confront it every single day.

Steve Davis 26:32

Exactly. Well, you know, Jerry and I, in part, like what we do is is we want serial work. In

Targeted Collections And Better Communication

Steve Davis 26:41

other words, we're out there and we want to become known to be problem solvers because we want people to come back, right? We hate to kill our clients, do a job and they're like, thanks, hope I never see you again, right? You want to be able to work with people so that they do come back again and again. What can people that are out there that are client facing day in and day out, how do we help you and the people in data solutions do their job better? Like maybe where do we fall short, or or maybe where do we excel or at least meet your expectations? Like what can people in our roles that our client facing all the time do to kind of help you?

Mike Johnson 27:19

Yeah, got it. I it's yeah, exactly. You guys are you guys are the first point of contact frequently, right? And not only you, but your your forensics teams, she's doing the collections. Um I think making sure when when when someone on my team or myself is kind of looped in as early as possible, especially with new data types and unknown things of how things are uh gonna turn out in the end, and what what is what what are we gonna be looking at at the end? I think understanding and not assuming um what the client says or assuming what um what the output is gonna be or or saying, you know, let's just instead of trying to isolate exactly what's needed and saying, you know what, let's get it all. Let's get it all, right? Let's throw it there and data solutions is magic and and they wave their wand at it and suddenly the data's fine, right? I think um being more at times uh uh more um targeted and strategic, and I know that is a focus of your guys's, uh, but just making sure you know we'll get what we need and nothing more when possible, and and making sure that downstream this will be the best uh for the client and and ultimately you know for productions and and and defensibility overall. So I think just communication and consulting, right? That is that's the takeaway, is just staying staying in touch, um, communicating and and not assuming.

Jerry Bui 29:01

Thanks a lot, Mike. You are an absolute superstar, purpose legal, and we and we um enjoyed uh interviewing you for the show today. Um, so really appreciate the participation. Thank you, everyone, for joining us, and especially big thanks to you, Mike, for joining us as our guest star on the podcast. And do look out for our next upcoming episode. Evidence Matters is available on all your favorite podcast platforms. So please look at the show notes, look at the links, and on behalf of Steve Davis and I, your co-host for Evidence Matters, goodbye and good day.