The Case of the Vanishing Attachments: Solving the Mystery of Modern eDiscovery
Article Written By Tim Morenc, BlueStar
Written for The Orange County Paralegal Association
It was a foggy evening when a troubled lawyer arrived at Sherlock Holmes’ door. "The evidence has disappeared!" he exclaimed. "The emails were there, but the attachments… vanished!"
Holmes steepled his fingers, eyes narrowing. "Ah, a case of modern attachments. Watson, fetch my magnifying glass— we have digital mysteries to unravel."
The Curious Case of Cloud Attachments
Unlike traditional attachments, modern attachments—cloud-hosted files shared via links— do not travel with emails. Instead, they remain in the ether of Microsoft 365, Google Workspace, and other platforms. While they offer real-time collaboration, version control, enhanced security, and accessibility anywhere, they also create chaos in eDiscovery, often remaining hidden, misplaced, or misattributed.
"The evidence isn’t missing," Holmes mused. "It’s merely out of sight."
The Hidden Perils of Modern Attachments
Watson scribbled as Holmes detailed the key challenges:
Invisible Evidence – Unlike traditional attachments, cloud files don’t sit inside emails, leaving a gap in discovery.
Lost Connections – Even when collected, modern attachments aren’t linked back to their parent emails, like a ransom note without a kidnapper.
Version Confusion – Which version of a file matters? The one sent? The one modified later?
Elementary, yet easily overlooked.
Metadata Gaps – Without a proper trail, who accessed, edited, or shared a document can be obscured.
Defensibility Dilemmas – Without an airtight audit trail, evidence can be challenged, much like Lestrade’s flimsy cases against the wrong suspects.
Solving the Case: Best Practices for Modern Attachments
"Fear not," Holmes reassured the lawyer. "The key is a precise methodology—much like solving a crime."
1. Collect All Evidence
Gather every version of an attachment as it was when sent, received, or modified.
Link attachments to parent emails, ensuring context isn’t lost
2. Capture Critical Metadata
Identify who accessed, modified, or shared files, and when.
Preserve permissions and access history for a complete evidentiary chain.
3. Filter for Relevance
Focus on versions that matter by filtering by custodian activity, date, and edits.
Remove redundant versions to streamline review.
4. Uncover External Sharing
Detect files shared outside the organization.
Track who had access and what permissions they held.
5. Ensure Defensibility
Maintain detailed audit trails proving data integrity.
Establish a clear chain of custody to withstand legal scrutiny.
Holmes-Approved eDiscovery
"Mysteries are best solved with the right tools," Holmes remarked. So, Holmes and Watson decided to call in Tim Morenc, BlueStar Case Solutions. Tim showed them how to:
All-in-One Collection & Review – Seamlessly capture, link, and analyze modern attachments.
Deep Insights – Gain unparalleled visibility into custodial activity, versions, and sharing patterns.
Defensible & Efficient – Build confidence with detailed audit trails and precise filtering.
"Watson," Holmes concluded, "this was never a case of missing evidence—only a failure to look in the right place."