NeLI PodSteve Davis on Forensic Investigations, Mobile Data and Generative AI
Listen on Apple Podcasts Listen on SpotifyAbout this episode
Steve Davis of Purpose Legal came to forensics as a certified private investigator with work on both the criminal and civil sides. He explains to Daniel Gold and Brandon Mack how that background shapes the way he runs investigations, how he bridges technical expertise and what clients need to know, why every collection now starts with more questions about devices, apps and where data lives, his concepts of residency and redundancy of data, whether generative AI has a role in forensics yet, whether AI prompts are discoverable, the biggest pitfalls he sees with clients, and advice for anyone starting a career in digital forensics.
What we covered
- How investigative and criminal-side experience shapes civil forensic work
- Bridging technical expertise and what clients actually understand
- Why collections now start with more questions than ever
- Residency and redundancy of data across devices, clouds and backups
- Where generative AI fits in forensics today, and whether prompts are discoverable
- Common pitfalls with clients, including ransomware response
- Advice for people starting a career in digital forensics
Full transcript
Transcript of the published episode, edited for transcription errors, with speaker labels added by Gold Standard Leadership.
And welcome back to another episode of NeLI Pod, the official podcast for NeLI. And with us in the virtual recording studio is Steve Davis of Purpose Legal. Steve, welcome to the program. Thank you, Daniel. It's great to have you here. Steve, why don't you start off by telling us a bit about your role at Purpose Legal? That's where you are. And also, uh, how the forensics group at the company works in general.
Sure. So I came to Purpose Legal about three years ago via an acquisition of a company called Digital Discovery. And Digital Discovery was a 20-year-old company that was pure play forensics based in Dallas, Texas. And I was one of the principals of that company. So we got acquired about three years ago. And since that time, I've served as the vice president of forensics and investigations for Purpose Legal. And Purpose was basically a rebranded name for an entity called Cobra Legal that was out of Austin, Texas. So people that I knew, people I'd worked with before and basically an amalgamation of some people that have been around the industry much like the three of us have. So forensics, you know, tip of the spear. We're the ones that are out there collecting data, identifying where it lives, and then making recommendations about best practices to acquire it, actually utilizing tools and techniques to get different data sources and physical devices, extracting out the wheat from the chaff so that we have the right data going downstream, and mitigating and minimizing all the unnecessary application computer and programming type files, as you all know.
So that's basically what we do. I'm kind of a talking head. I do a lot of education, a lot of CLEs, a lot of presentations, supposed to be a closer of business. But kind of a 30,000 foot guy don't really handle a ton of things day in and day out, kind of get put out on the frontier. So if you see any arrows in my back, that's why. It's good to know. Thanks for that description and for introducing us to how you run things there at Purpose.
One of the things that I noticed about your background is you're a certified private investigator. You've done work both on the criminal and the civil side. I think for a lot of us who are familiar with forensics and the context of your discovery, we think of it primarily with civil discovery. Can you talk a little bit about how your experience in the criminal side and your experience as an investigator, how did those influence the way in which you handle the what we would see as the typical forensics work we do in civil discovery?
Yeah, I come to forensics a little bit of a curved way. I just got back from Greece with my wife and three daughters. If you go there, none of the roads are straight. I mean, they are all hairpin turns everywhere. My son-in-law decided I should be one of the drivers, not sure why. But I think it's very similar to my kind of path to forensics that I've taken because really, I came there as an investigator. I started in the federal government. I was a banker for years and years and then segwayed into the Resolution Trust Corporation which shut down SNL, Savings and Loans, and securities companies back in the late 80s, really 90s. And I was an investigator for them, but in those days, everything was paper-based.
And about 20 years ago, I took my investigation's background and kind of moved into forensics. So I didn't come to it from a lot of people come from a computer science background. A lot of them have picked up the discipline. I kind of got force-fed forensics. So I learned it, but I learned it with the confines of how to do an investigation. I know how to run investigations, criminal and civil very well, but now we change from utilizing all hard copy paper documents. And now we were looking not just at documents in electronic form, but also then the data about the data, the metadata, and then all the various items you can find from forensic artifacts and operating systems. And you think about things from shell bags to link files to jump lists and all the things that are out there and both on the Mac side as well as the PC side, there's just a treasure trove of information that transcends what was available back when we just dealt with paper.
For a guy who labels himself as a 30,000 foot guy, not a technical, you definitely seem to not give yourself enough credit, Steve.
And it makes us wonder a little bit, forensics is by its nature in forensic investigation, forensic collection, it'll be very highly technical. Being able to, as you said, identify the facts amongst all of the various different documents or what we're just going to call it data, whichever one we want to call it, it can be very, very difficult to do. And in order to be able to identify who is making the data and what devices the data is being made, et cetera, you need to be able to bridge the gap between technical expertise and knowledge that's needed by clients. How do you do that for your clients at Purpose Legal who don't have the level of detailed understanding and years of experience as you do?
Yeah, that's a great question. I think people say that a lot about me because I wax okay. So they say, boy, you do pretty well talking and people love me on a stand, but then I don't have some of the credibility or some of the chops that people that are more contemporaneous in terms of the latest and greatest operating systems and what's been issued. And just newer things that I haven't been around. Conceptually, I understand it all. As far as practice, so I'm a little bit like George Bush, the younger George Bush kind of surrounded himself with a lot of people that were really good at what they did. So you need to understand it because you need to be able to convey it. And I had a person from Toyota National came up to me after a presentation one day and he said, you know, the good thing about you, not that you're particularly smart or impressive, but you do a really good job of explaining things to layman.
And I think that is the key, Daniel. I think the ability, because everyone's smart, right? Lawyers are smart, but they may not be hyper technical about data. And I, you know, we were talking yesterday, I looked at some of questions that Brandon was talking about. And there's a lot out there that begs a lot of issues like structured data, right? Structured data versus unstructured data, which to us, that are semi scientific, we understand what that means. A lot of practitioners, they don't care. They see the GUI or the mobile user interface and they look and say, well, grab me that document, even though we know it may not exist in that format without piecing it together from various locations. So you have to be able to, you know, you have to be able to educate and you have to be able to understand where someone's going.
It's what my wife always says, like, you know, how long is it going to take to get there? And I'm like, well, where are we going? You know, first thing, like, once you tell me where we're going, I can do a better job of explaining, you know, best practices and how to get there. And I think the same is true with forensics is understanding that what they want is really an end goal. So whenever they come to me and say, I've got 10 gigs of data, I'm like, do you? I mean, maybe you do, maybe you don't, I don't know. But let's talk about what your end goal is. And once you tell me your end goal, then I kind of take a step back and think about, well, you know, what timeframe does it cover?
Who are the people, the custodians that might be involved? And then what data sources and physical devices might come into play that might be salient might have probative value. And then once you do that, you have, you know, you put your chain link fence around it, you've kind of created the confines of what you're going to be dealing with. And then you start to eat the elephant, then you start to take bite by bite to try to get to the solution. But you got to have the answer. It's you can't solve an equation without having either all the variables in the constants or having the answer. You have to have one or the other. So if you have the answer in terms of the goal of the investigation, then we can start to fill in with how do you get there?
One of the things you mentioned there was you were talking about there are others who are more contemporaneous and they might know the latest and greatest operating systems and things like that. What are the big things that you've seen in the world of forensics and the time that you've been in the industry, even prior to touching it in the format of eDiscovery, you know, the technical side of what forensics is, what have you seen change the most over the last 10, 15 years? Yeah, I think that the great thing about forensics are people like you. The great thing about forensics are the community that we have. Like you guys have made a bond and you wanna do a podcast, that's really cool. You wanna talk about latest and greatest and you discover in forensics and different topics.
The forensics community is very much like that. It's very open, it's not cloistered, it's not shut out. It's an environment where everyone, you don't need to know everything because you can't. So there's a ton of sharing going on. So to me, it's parallel. There's more and more information. I mean, things like shell bags and jump list and link files and things like that are newer artifacts. They move the residency of data with deleted content within the iPhone like a year or two ago, Apple security did, right? And I didn't know that until someone told me about it. So if you read and you meet and you go to conferences, you learn as much as you give at any of these things you do. And I think with forensics, it's just a constant churning of additional information, whether it's SANS or whether it's the forensic focus or name it, there's lots of people out there that are probably in part self-promoting but also educating as they do it.
And there's tons to learn. You never learn everything you can. And when people come to me, it's like, you think about Celebriot and mobile device, they're the 800 pound gorilla in that area. And yeah, there's other products out there that also parse data from SQLite databases. But they're out there constantly tackling the latest and greatest and what's been issued in the new model and the new Android that's out there. And it's a little bit chasing our tails but we're also constantly enriching by sharing and exchanging information.
I love what you're talking about there. One, the sense of community. I think the sense of community is obviously very important. But there's also something else that you said and I also want to go back to your answer before, Steve, because you're talking about being able to really understand what is the purpose of this investigation? And I think that's not only one really important, but two, understanding the purpose of the investigation like, hey, I need to go collect from three custodians. Okay, well, what does that mean? Or like you said before, I think I've got 10 gigs of data. Well, do you really?
But then you layer on the challenges that you didn't have 20 years ago. Frankly, you didn't have 10 years ago. I need to go get this data from these custodians. They've got mobile phones. Okay, but now there's a litany of questions. Did they use WhatsApp? Did they use Signal? Were there any other ephemeral? Signal messaging apps, right? Which iOS device? Did they have iOS sync on or not sync on, right? Did they have it all? Which Android operating system models? Which device? What hardware, right? So we would go on and on and ask various different questions.
So the ability to be able to be well informed today is different than it was. And you're talking about, well, you know, the community is really good. But even when you're talking with your clients, you have to be able to get to a point where it's like, all right, let's understand the heart of it and let's understand more about who is communicating with who. Do you find yourself, you're asking more questions today than you ever did?
Yeah, well, I said that yesterday in a presentation that sometimes all I do is ask questions in presentations. I don't provide very many answers. And you just stole about 80% of my presentation at NeLI here. It's on third-party apps. And it's great, Daniel, because think about it. Like people will say to you, we want to collect from a mobile device. And just to us, that's like, well, okay, you've given me like one 30th of the information necessary. Cause, okay, a mobile device is great. Well, first of all, iOS or Android, okay? And then like what model make and what operating system is it running? And is it the latest, greatest? And then is it third-party apps, right? And then we talk about two Lynch pin or foundational things to me that I use all the time.
I don't know that I coined them, but I came up with them one day a few years ago, which is residency of data and redundancy of data. So residency of data is exactly what you think it is, where it lives, right? Does it live on the physical device? Does it actually live in a browser somewhere that you have to go through a desktop to get to? Is it in the cloud, right? Is it in a sync or a backup? So residency is one thing, but then redundancy is equally important. Like, you know, you talk about ephemeral messaging platforms and Discord and Signal and Telegram and things like that. Like it's there one minute and it's not the next. Well, is that because of a configuration and setting?
Were there any interim syncs or back? where you could get data that did exist. You know, there's other questions out there and is it encrypted peer to peer? Is it encrypted where it lands? Right? Is it decrypted by Apple because Apple development makes you do that? It's like there's a whole bunch of questions to ask. And so when people say, I want to get text messages off a phone, I'm like, okay, I actually have a list of six questions that I snip, cut out, you know, cut and paste, send out to clients. When they call and say they have a mobile device thing, I'm saying answer these six questions and they hate that. But it gets you to, are there third party apps? Because the third party app, as you may know, in Android, you can't even get necessarily from the phone, right?
We got to get the QR code. And then we have to use like an AXEM product to go and get the last one year only of the data. So it's not the same as it is in iOS, because with iOS, the developers forced them, Apple forced them to decrypt it as part of the deal where you have a plugin with the app and in the end you get the data that's there. So it's very important to know how are people communicating? Are they using WeChat? Are they using WhatsApp? Are they using Viber? You know, Kik, whatever, there's a whole, 308, I was looking at it yesterday, 308 different app support that celebrate, delineates on their website and what's available from either an Android or an iOS iPhone, which is amazing.
That's a lot to digest and chew on when you think about a guy, a practitioner coming to you and saying, I have a phone to collect. Instead of saying, great, we'll do this or we'll send out an agent to collect it or we'll use this product to do it. I mean, there's so much more to it than that. It's like the proliferation of those third party apps as well as mobile data in general and collaboration data have been the biggest explosions in what we've seen in data over the last five years or so.
And in the last 18 months, I think the biggest headline we've had in technology in general and in eDiscovery is these new forms of artificial intelligence, generative AI specifically. Does AI play a role in forensics? Does Gen AI play a role in forensics and what roles do they play?
I think we've learned a bit about where they work in other factors of eDiscovery, and I'm curious how that touches forensics. You know, I don't know. I'm a little bit of a skeptic. You know, first of all, my background was semi-scientific. It was statistics when I got my graduate degree. So, you know, not computer science, but at least some type of advanced thinking about how things work. And so, you know, I get AI. AI is basically computer programming, right? It's, you know, that's what Marla would say is that it's basically an advanced type of computer programming. And somebody's got to teach it what to do. I mean, it's kind of cool. My kids all use it, you know, the chat, GPT, and they write their resumes and they write letters and all that.
And I think there's functionality that's cool there. I can see, like, from a deposition summary standpoint, how it can be super useful. I can see from a review standpoint, how it can be useful. From a forensic standpoint, currently, I don't know that I've seen it be super useful, maybe in terms of making suggestions, but is that better than Socratic thinking? I don't know that it is. I don't know that I'm seeing application of it today beyond. I mean, just like when you go to Amazon and you pop up and yesterday I was buying, you know, blind. So everything I see are blind for my steel door across the house, right? Cause that's what they know you were looking at or when I get on to see what the flight is going to cost me to go to San Francisco to go see Everlaw.
And so I didn't buy it. The next day I come up and all I got is in my inbox and my email is stuff about San Francisco flights. So I get it. I get that it's out there. I get that it's used. I don't see it in my life currently. And this is really jaundiced, but I've been around a long time doing this a long time. I think we'll see application and functionality and use of it in eDiscovery, but I have a huge concern, not concern, but I just wonder how much it's gonna be adopted by the courts. Like you think we're slow. Think about the court system. You know, there still, some of them are still doing paper filings and they haven't even got to electronic filings.
And now you're gonna put on them, like we're all having agreement. They can't even do a meet and confer barely in terms of agreement on data types. And now we're gonna throw generative AI at them. I think that's why a lot of the big review platforms, some haven't like rushed to lay out what it is as much as they're starting to build a foundational understanding of how it might be used in the future. So I just don't know how fast it'll be applied. Yeah.
Well, and that actually leads into a followup question for me as you were talking. One of the other things that I think about it is, we are slow. as an industry. The legal industry is slow and therefore the discovery industry is a little bit slow following after that, the courts of course, but the places that aren't slow, the world of corporate America, where we're seeing adoption of these tools much, much more quickly than we're doing it in our industry. So for instance, Microsoft Copilot baked into everyone's 365, now people are starting to experiment with it. And I am on a weekly basis making discoveries about the different types of artifacts that tools like this create. Have you given thought to what does it look like for a forensic practitioner to start trying to map out and figure out what new data types are being generated by the types of tools that we're looking at that use generative AI and do corporations really know what they're doing when they're using these or implementing them?
Yeah, great question. I think it's true of any tool or technique that you acquire. Do you know what you're doing or is it the Lamborghini sitting in the you know, garage in New York City and it never gets used? Like a lot of people go out and buy products and then they don't, you know, they use one 80 of the ability of the product only. They use the bare bones of it and they wonder why they spend so much. Corporations are adopting faster, but I don't know that corporations are necessarily always the best decision makers when it comes to acquisition of technology and choices. I've always told people like, let us make those choices. Let us be the ones that test 20 and 30 and 50 different products and pick the best of the market because we all know that something that works today may not work tomorrow.
Right? Like there are products, I'm not going to name them that work in a tremendous fashion to gather information from social media or from mobile devices and then all of a sudden an API changes and all of a sudden it doesn't work anymore. And so you can cast aspersions and say, well, that's a cruddy product. I don't think so. I mean, I think we're as much an art as we are a science. So I think I don't like people taking the position of I'm going to invest in this platform or I'm going to invest in this engine or this tool, whatever it is, and then things change, the wind blows a different direction and all of a sudden it's not doing what you thought it could do.
So I will answer the first part, Brandon, to your question, which is we keep up with that and I force our staff to do constant and we're in Texas. So we're required to do about 30 hours of continuing education, not CLE, but CE. So we've got to do continuing education. So I force our people or at least suggest that we use that across the year instead of worrying about the private investigator's license at the end of the year. Let's worry about our education about what's out there, what we don't know, right? The hill beyond the hill that we're not even aware of yet. Let's find out what's going on and that's one of the topical areas that literally we discuss and we have a morning meeting every day at 8am, central time, where we go over the 50 to 100 cases we're working on and we don't talk about each one of it and obviously in detail because you could never finish the meeting.
But we look at things that are in red or in yellow that need to have a discussion about it and then we also talk about conceptually what should we be doing on a go forward basis? Who's training this week? Who's taking? We're not working our people 68 hours, you know, 60 to 80 hours a week. We could, but I want them working, you know, 30 to 40 unbillable stuff and then 10 on enrichment, corporate enrichment and personal enrichment because I always tell them, listen, this is helping your resume as much as you're helping the enterprise and it makes you better. So get certified, get acumen in these different areas including and we have a, you know, Purpose Legal has defined a group of six people that is our AI group and it's from all different disciplines inside the company and they are constantly vetting and looking and meeting and talking with people about application across the whole EDRM.
This idea of contribution is great because defining one's value based on just upon utilization alone, you know, doesn't really define or give a holistic approach to how the individual is helping and it sounds like their purpose. You are living with intention, living with purpose and making sure everyone's up to date.
I think that's fantastic. The, the, I'm going to dovetail on something that you said and also Brandon asked you as well, not to stick with GenAI, but I'm going to stick with GenAI just for a second. I'm curious, when a custodian is inputting something into their phone, it's discoverable, potentially, right, potentially discoverable, right. When somebody's inputting something into their work computer, it's potentially discoverable. When we're inputting something into a generative AI tool, wouldn't you agree that it could potentially be discoverable, i.e., let's say a custodian says, I wanna know how I can rip off my employer. I wanna know how I can come up with a RICO scheme in which I am not going to get in any trouble. Then the guess the question becomes really twofold, Steve, because we're entering this inflection point in this industry, it's all brand new.
One, do the prompts become discoverable? Number two, does the AI tool, those that created it, do they then become potential custodians as well, because their large language model gave an answer which could potentially put the company at risk and jeopardy.
Yeah, great question. I would analogize the first half of the question, which is the prompts or the input of the queries. I think that's no different than browser history. So think about like, how do you build a bomb? Or how do I rip off my boss? Or how do I steal data without someone saying a USB connected? So yeah, those are not dissimilar. Now you're using a large language model to ingest it instead of using a browser. So I think those are synonymous. And so yes, absolutely discoverable. As far as reverse engineering, the way a certain generative AI product works, that's a bigger task. I think you have a lot of fights about that. You will not have an agreement and meet and confer on that.
And so I think intellectually, yes, I think that's an area of interest. I think we've seen, and I think last year at NeLI, we talked about, somebody was talking about this, I think Dave Cohen from Reed Smith was, was talking about this idea that, some of these AI products were quoting case law that didn't exist, right? It was the whole, what do they call it? Not phantom or ghosting, but what's the hallucinations? Hallucinations, yeah. The hallucinations, right? And they were talking about that concept and it was literally they had like case law that someone else then relied on, that case law in a brief and didn't check their sightings and all that. And they're like, the other side called them and they're like, you know, this isn't a real case, don't you?
And they literally had gotten it out of AI. So yeah, we're gonna have to tear down and look at and absolutely those could be items that could clearly be discoverable in law. I mean, anything that's gonna be the predicate for either a position or an opinion or anything downline, absolutely could be something as discoverable as part and parcel of the discovery. Just so I could elaborate on what you said for all of our listeners. So you were talking about hallucinating, the GenAI hallucinating and then attorney citing it. Since Dave Cohen talked about that last year, there has been now four additional cases in which lawyers have cited hallucinated cases, cases that did not exist. They simply copied and pasted the language into briefs. Now I would like to of course take this opportunity to remind every lawyer that's listening to this that under the model rules of professional responsibility under rule one, they have to be competent and understand the relevant risks and benefits of it.
And I'd like to also remind them that under rule 5.3B, there's an obligation as attorneys to make sure that non lawyers are doing what they should. And I'm gonna call GenAI a non lawyer since it's citing case law. So there's my little public service announcement.
Yeah, and the interesting thing there was, remember that was a case where there was a co-counsel involved. Co-counsel received it like either 4.30 or five, whatever the time was within like a half hour when they had to hit the button to submit it. And so then the question is, what are the requirements for them as co-counsel?
They just got hired, probably got paid a modicum, not a lot of money, compared to the people that were fighting the real battle, they have to file it because they're local and they have the ability to. And do they take the word of someone else? It's done a brief and in the last 15 minutes when they receive it, and we all know we're making jokes earlier today about what's gonna happen later today, Friday at five o'clock, what's gonna happen to each one of us. But the same things happen into practicing lawyers where they receive them from co-counsel and what are their requirements, what are their duties? I mean, I don't think they change necessarily, but it's a ethical question that then has some layers to it with real life, which is I've got 15 minutes to either, make a decision or punt, one of the two.
It's interesting. And I think we're obviously just the beginning of seeing how this evolves, what new problems we discover with this and how we figure out how to solve those problems. And I'm curious as well, if we rewind the clock a bit, take Gen AI out of the picture, just your general, you mentioned corporations and how quickly they might be adopting Gen AI or whether. they know what they're getting and things like that. In your experience in working with large organizations, where do you see as a forensics practitioner, the biggest issues with how people and how organizations understand what it really means to take care of their data? How they store it, how they map it? Where do you see the biggest pitfalls that you've had to deal with your clients?
Yeah, I mean, I guess it depends. I use that concept all the time. It depends. It's one of my CLEs. People hate it. When I first broke into the business 30 years ago, and I would ask older people that were experienced about stuff, and they said it depends. I'd say, that's a crappy answer. Really, it's a cop out. Just take a stance, black or white, whatever you want to say. Don't gray me to death. Tell me what you think the answer is. They're like, well, it depends. I'm like, will you? And then all of a sudden, I've adopted that. And so now I've become that guy that says it depends because it does, just like Daniel's comment about all the litany of different things with a mobile device, right?
Third-party apps and Geo stuff. And whether it's on this OS platform or whether it's in an Android and whether the data is resident there or it's just syncing and mirroring, just like an email might be, there's so many layers to it. And I think the same thing goes for an answer to this question, which is the corporation. Like, you know, corporation, I had one. I had a call two months, almost three months ago. And buddy of mine called us, coming back from the gym. And he's like, hey, you do me a favor, talk to this guy down in Houston. He's got a ransomware deal. You know, can you be any help? And I was like, yeah, maybe. So I got him on the phone. He got me his IT guy.
And I'm like, so tell me, you know, there's a thousand person in company manufacturing said, tell me about your backup stuff, how you redundancy and what you do in case of DR disaster recovery. And he's like, you know, we're getting there. We're gonna, you know, implement something here soon. And I'm like, dude, I'm like, the horse is out of the barn. Like you've been ransomware. And I'm like, how serious is it? He will, you know, pretty much every server has been shut down. And I'm like, okay. And you have no way to, you know, there's nothing backed up. There's nothing synced. There's no, you know, no, not really. And like, what can you do to help? And I was like, well, you could pay. I mean, they tend to be pretty ethical people.
I know that sounds crazy, but they're in the business of if you pay, they'll probably give you your key to the data. But we were able to figure out something which was interesting, which is we actually went in, found email archives and we're able to strip all the attachments out of the email archive and rebuild and large part of the server system. Cause no one just creates an email for a document for the fun of it. Like all of us create documents where I can send it to you guys, have you review it, send it back, we collab on it, whatever. And so we're able to deal with it. So there's a corporation where the answer is, they ain't sophisticated at all. Like that's bad, that's enough.
You get enough on that one, F minus, because you didn't even have basic redundancy. There's other ones that have got everything under the sun, but don't kid yourself and you all should know this as well as I do. There is no one who's immune. Like we can all pretend there is, but there's these things called humans involved. And humans are really average. Like we make mistakes all the time. I love my wife to death. She'll hit a link as soon as, I'm like, honey, don't ever hit a link in an email. Like if you think it's Chase Bank, go to the Chase Bank website, the URL, and see if there's a message there, but don't do it on your email. But humans are humans. And so same thing with like herding cats, we're dealing with humans.
And so malware has hit the biggest companies, the biggest corporations, the biggest service providers, and anyone who runs around and says, oh, we're immune. We've got all the firewalls. We've got all the installation of malware protection. Do you though? Because tailgating in the old days where we followed people into buildings is still allowed electronically. And there's almost no way what you really need to do is redundancy. I don't think you can build the fortress good enough. So corporations may fancy themselves that they have all the solutions. They have all the abilities to stop the bad guys and they make it all the red lights and the green lights on their logging stuff. But I would submit that anyone that employs humans, that you have that element that you cannot control at the same level.
And so it was very roundabout way to answer the question. I don't think there's a uniform answer across. I don't think it's predicated only on size of company. I think that it's an it depends and I don't necessarily trust anybody that tells me they've got it figured out or fixed.
Yeah, I would agree with that. Usually people who start off saying, but trust me, I've got this. Usually we have to ask additional. questions. Steve, when I think about where we are as an industry today, both forensics as well as eDiscovery. And I look back at how long we've been at this. I've been at this over 20 years, branding the same. I'm going to take a shot in the dark saying you've been at this more than a year, Steve. When we look back at this industry, though, I mean, we sort of made this industry with shoestring and duct tape, right? It wasn't eDiscovery, right? And it wasn't, you know, e-collections or what have you. It was a lot of paper-based discovery. And things have evolved.
And so much so that we now have people coming into the industry that actually want to be here and want to be involved in eDiscovery or in all fronts of collection. What advice would you give to someone that's starting a career or thinking about a career in digital forensics?
Yeah, a lot to unpack there. Because I think first of all, I'm really blessed and happy that I came to this business as an investigator because I learned how to run an investigation with very limited resources and evidence. So you had to go out there, you had to search for stuff, you had to collect it, you had to read it, you had to define it, you had to then physically enter it into a system since it wasn't just scan and stuff like that. And then all of a sudden, we had this wealth of information available via ESI and then lots and lots of different flavors. And now the last five, seven years, like Brandon said, now we have all the messaging and communication-centric aspect of it through mobile devices.
We have all the collaboration sites that are there. I think it's hard to just jump in and go from zero to 100 or to, you know, cross the finish line and get into forensics without understanding some of the bigger picture stuff about how businesses run. My first job was the banker. I got out of graduate school and I wanted to go to work for a bank because I wanted to see how people lent money to people. I had no interest in being a banker. I wanted to know what the heck it took to get the loan someday. So I went and went into the program for a few years and then got out and went into private practice and had my own company for 17 years.
That's the sole reason I did it. And I think there's got to be some interim step. Forensics is great and I think they'd be very careful to go to a service provider right away because that'll be a baptism of fire and you're under the gun immediately, having to produce the chargeability utilization comment you made earlier, Daniels, is a valid one. I know a good buddy of mine that worked with me that ran a lab with us for years, went to work for like a Exxon. I don't think it was Exxon but I'm just saying a name, Big Oil Company and he didn't like it at all because now he was one of 100 people that were just doing the go collect the phone, come back and hand it to us.
He wasn't baking the whole pie. He wasn't designing the room. He wasn't painting the picture. He was doing one little tiny aspect of it. There's a lot of opportunities and there's a lot of good education vehicles that are out there now to learn about forensics. It didn't exist 20 years ago. I could name a few of the universities, some that are online that are fantastic resources. So there's lots of ways to do it and then I think you need to get tapped into some of these organizations that are out there that are supportive like SANS of Education that teach you tons of stuff and DFIR and all that. I mean there's a lot of good things that are out there but I don't know that I would get involved with the eDiscovery service provision because I'm afraid that's a rapid fire.
That puts you in there and they're working you to death and you get very pigeonholed and I think you miss out on bringing a more thoughtful approach to a problem and I think problem solving is big. So whether it's doing something, I don't know that it makes a ton of sense to just come out of undergraduate school or a juco and have a forensic thing and then go work for a service provider. Go work real world. That's what they told us out of grad school, get an MBA and you know we got done and they're like okay well go do something real for a while. Like in fact they wanted that before you went to MBA school so you actually had an idea what you were talking about when solving problems.
That's an interesting answer to the question and it's interesting to hear you talk about the difference in you know both culture and operations between an eDiscovery service provider and some of the other you know what you might call more specialized or more targeted shops where you can really cut your teeth in the world of forensics.
But purpose specifically and I know purpose isn't all forensics but you know purpose legal as a gold sponsor of NeLI you know we want to give you a chance to talk a little bit more about what the practice is like there. You have heard some of the elements that you feel about the forensics practice. It is very high-paced, it's very demanding. The way that someone's skills develop and their work life develops is very different within an organization like that. But what more can you tell us about Purpose? And also as a compound question here, when you were mentioning earlier about focusing your team, you know, 30 hours of real billable work and then 10 hours of personal development, how does the company approach that? And where do you find your sources for that sort of personal development, not just for forensics, but for the discovery professionals in general?
Yeah, I think, you know, Purpose Legal is a very unique company in that it's not one of the biggest. And so a lot of people are afraid of that. Like some people just love big. They wanna work for, you know, American Airlines. They don't wanna work for a smaller airline or they, you know, name the industry. And then some people just wanna be a two person shop and nothing wrong with that either. I've worked in both environments. I really like where we are. We're kind of a sweet spot. We're not small. You know, like I said, we are managing somewhere in the neighborhood of 50 to 100 cases just in my vertical every day. So it's not like we only have once in a while.
I mean, we're getting projects every single day and we're finishing them every single day and then some are going on for months, if not years. But the cool part of it is the collaboration. It's a much more like there's probably, I'm not gonna name other service providers, but there's probably other larger ones. And I would say intellectually we're on par. We might not have 38 or 55 PMs. You know, maybe we have 15 or 20 of them. Like maybe it's fractional that we have 10, you know, forensic people and they got 25. So does that make them better necessarily? So what we do is we're heavy, heavy interaction collaboration. I would say I've been blown up probably, I'm looking over to my left, maybe 10 times so far on teams since I've been on this, use this chat, this podcast.
But that's good that those are constant questions. And I love for an investigator or a forensic analyst not to assume, not to assume they know the answer, but to constantly bounce things off. Like when I had other people come into the company, you know, after we were acquired, they're like, why do you meet every day? Like can't you just meet once a week with your whole forensic staff? And I'm like, no, like I like every day. I mean, I am retentive beyond retentive. So I am, people call that old school. I just think it's paying attention. And I love being involved, not too much, but I love hearing what's going on and then throwing out a tidbit or having people throw tidbits at me. I learn stuff from my kids all the time.
They're like, dad, don't do it this way, do it this way. And I'm like, okay, cool. Like I think all of us need to have that self deprecation and the willingness to listen to others and learn from others. So I think collaboration is great. I think Purpose Legal leads the league in being open-minded at the CEO and the president, both are of that mind. I mean, the president is a good friend of mine, Chris Taylor. And I mean, he has a lot of opinions and he's also the first one to listen to somebody else. Like he will totally, he'll call together eight or 10 people in a meeting and get other people's opinions. I love that. And I think that's where we shine is our willingness not to assume we know.
When I was 25 years old, I was dying to be 40. I just wanted to be authoritative. My wife used to laugh at me. Then I got 40 and I got old. Now I'm really old. But I kept the hair. But it just got grayer and grayer as time went on. But I always wanted to be authoritative. I always wanted to be able to be the one they came to. And what I'm learning is that's not just gray hair. I mean, it's people that have experiences and that may be an 18 year old that has tremendous experiences that you can learn from. And I think we do that really well at our company is that we don't have a rinse repeat model where we've already decided.
A lot of times we're brainstorming. What would be the best way to solve this problem? Do we have to go outside? We were on a call that I interrupted that I got off of dealing with sales to come join y'all. And basically one of the things that was said is don't be afraid to talk to your counterparts in the industry. I don't care if it's sales. I don't care if it's forensics. I don't care if it's operations. The one, one of the people that runs our operations department was implementing a new way for project managers and pods. And they talked to one of the other biggest players in the market about the foibles, the upside, the downside of it. Now I think that type of introspection and that type of willingness to be learning all the time and not just educating is crucial for success.
There are so many tidbits here, Steve, for so many people, irrespective of what they do in this profession. And we can't thank you enough for being here. We can't thank you enough for being a Gold Sponsor of the NeLI Conference. Can you tell us, Steve, where do people find you? Where do they find Purpose Legal?
You know, anybody that looks on LinkedIn will find me. If you look for Steve Davis, look for the gray-haired guy and you'll find him available to chat. I love my favorite thing, like we didn't know each other well getting onto this. I love meeting people. I love having more people to be able to say hey to. A pandemic was crushing to me. It's crushing to a lot of people in a lot of different ways in a very serious manner. But it was also crushing personally to me because I live, I don't go like, I'm not pigpen where I just go from pile to pile and the dust is all going. I don't like to go to every single show, but I love learning. And I find that everywhere I go, whether it's something that's not necessarily in my belly wick and I'm learning about something that's brand new, like AI, you know, if I go to an ever law thing and I sit there and listen to what they're saying, I'm learning stuff that I never knew.
I'm not gonna be the biggest proponent of it one way or the other, but I'm learning something that I didn't know before. And I love that about getting on podcasts. I love that about meeting people. I love that about having a drink and talking to somebody about what they're doing. And you know, what's the highlight of your day? What's the, what's a bad part of your day? So it's a, it's a blessing. It's fun for me and I appreciate the opportunity.
Well, this has been a great conversation. Steve Davis, thanks again.
All right, have a great day.
Daniel Gold is an attorney and a Principal at BDO USA, where he leads eDiscovery managed services. He co-hosts the NeLI Pod with Brandon Mack for the National eDiscovery Leadership Institute, hosts BDO's Legal Tech Talk and founded Gold Standard Leadership.
More about DanielGet the next one in your inbox
Daniel Gold writes weekly on leadership, legal technology and eDiscovery.
Subscribe on Substack