Data preservation and collection bring electronically stored information (ESI) from multiple custodians and systems into a documented discovery workflow. Forensic Discovery helps law firms and businesses identify relevant sources, plan technical preservation, and collect available data within an authorized scope.
A litigation hold, regulatory request, or internal investigation may involve laptops, phones, mailboxes, shared drives, and collaboration accounts at the same time. The starting point is a coordinated source map: who holds the data, where it resides, which retention settings affect it, and what can be collected.
Preservation protects identified information against loss or change; collection acquires a working copy for later use. Counsel determines the legal obligations, access authority, and scope. Our technical work supports that direction as part of eDiscovery services. When the question requires deeper examination, our digital forensics services provide a separate analysis path.
We work with counsel, business stakeholders, and IT to connect the requested custodians, date ranges, and information categories to actual systems. The map records source owners, locations, retention concerns, dependencies, and unresolved access questions so collection decisions have a practical basis.
Sessions to identify sources and questionnaires help locate work accounts, devices, shared repositories, and relevant communication channels. These are technical scoping conversations, not investigative witness interviews. We document reported sources and questions that need IT or counsel confirmation rather than assuming a custodian knows every location.
For suitable sources, a preservation plan may retain information within its existing system while collection is arranged. We coordinate proposed changes to retention or deletion settings with authorized system owners. A hold instruction alone does not establish that a platform has preserved every relevant record.
Targeted collection or a fuller forensic image may be appropriate depending on the question, source, and authorized scope. Remote or onsite approaches are assessed for access, device condition, encryption, available exports, and practical constraints. The method and exceptions are recorded for each source.
A program may include collaboration and chat data alongside email, documents, and mobile sources. Conversation context, participants, timestamps, attachments, and linked files need explicit scope decisions. Availability varies by platform configuration, retention, permissions, and the collection method; a linked file is not automatically included.
Collection logs, chain of custody records, available hash manifests, and a report in plain language connect acquired data to its source and method. We identify inaccessible sources, errors, exclusions, and items for further work. Documentation supports review of the work without promising that the collection is complete or admissible.
A legal team may need information from several custodians who use different devices, accounts, and shared workspaces. We help turn counsel’s scope into a plan for each source and coordinate technical work with IT. Counsel remains responsible for decisions about hold notices, legal coverage, and release of the hold. See our eDiscovery services for the broader discovery workflow.
Start with the request, the relevant systems, and the date by which counsel needs usable data. We identify access dependencies, available collection paths, and constraints that could affect scheduling. The technical plan can prioritize agreed sources while recording deferred items; it does not determine the legal adequacy of a response or guarantee completion by a deadline.
A laptop reassignment, account closure, or routine deletion policy can affect information needed for an investigation. Counsel and authorized business owners can coordinate preservation before those changes occur. Business data theft investigations address questions about organizational data loss; employee misconduct investigations support the separate review of digital records. Preservation itself does not establish misconduct.
Self-collection and IT exports can be appropriate within a clearly defined process. Bring in a forensic specialist when scope, metadata, custody, or an unexplained gap needs independent technical attention, or when a method is challenged. We assess what was collected and the available documentation, identify limits, and discuss proportionate further work with counsel. Read three mistakes people make in data collection.
| Source | Examples | Collection considerations |
|---|---|---|
| Computers, servers, and file shares | Windows and macOS computers, servers, shared folders, external media | Targeted acquisition or a forensic image, depending on source and scope. |
| Email systems | Microsoft 365, Google Workspace, and available mailbox exports | Supported export or account collection with defined folders, dates, and exclusions. |
| Mobile devices and messages | iPhone and Android devices, available texts and backups | Collection depends on the source, device state, access, and supported data. |
| Cloud storage and productivity | OneDrive, SharePoint, Google Drive, Dropbox | Authorized account or repository collection; versions and linked content scoped separately. |
| Collaboration and chat | Slack, Microsoft Teams, and available meeting content | Supported exports or platform collection, with available conversation context documented. |
| Social media and web content | Authorized accounts, identified pages, audio and video | Scoped capture or export of available content, with date and method recorded. |
These are source categories to evaluate, not a promise of universal platform support. For detail about each source, see email collection, mobile device forensics, and cloud-based forensics.
Further reading on document examination
Source files, including PDFs, should be handled in a way suited to the information at issue. A document may contain metadata, attachments, comments, layers, or information about saved versions, but availability varies.
These guides explain separate examination questions:
Review the hold, request, or investigation questions with counsel and the business team. Establish authorized access, intended use, deadlines, and what is outside scope before choosing collection methods.
Use sessions to identify sources, questionnaires, and IT input to locate data. Record accounts, devices, shared sources, retention settings, and access dependencies, including locations still needing confirmation.
Agree which steps for each source are appropriate and who will implement them. Document preservation in place or collection decisions and any approved changes to deletion or retention settings.
Acquire agreed data remotely or onsite and maintain chain of custody. Record source identifiers, method, exceptions, and hash verification where applicable. Our remote data collection overview explains the preparation involved.
Review collection outputs against the agreed scope and available source records. Document useful counts or other checks, along with failed items, exclusions, and questions requiring further work. A successful export alone is not a completeness finding.
Provide agreed outputs for the next stage:
Further examination: Deep examination of a single computer requires a separately scoped computer forensics examination.
Discovery processing and review: Collected data intended for discovery can move into processing, assessment, and hosted review.
Confirm formats and handling instructions with the receiving team; collection does not itself make production or privilege decisions.
Agreed deliverables may include a custodian/source collection log, chain of custody records, available hash manifests, and a report describing methods, outputs, exclusions, and unresolved items. Declarations and testimony about the collection are separately scoped through our expert witness and testimony services. The record should explain what happened to the data and where verification ends.
Forensic Discovery brings preservation and collection into the same workflow as forensic examination and eDiscovery support. A coordinated engagement can keep source relationships, collection exceptions, and requirements of the receiving team visible as work moves between stages. We explain the method and its limits in practical language. Ask for a written scope and estimate so the expected work and deliverables are clear.
We work with outside counsel, internal legal teams, compliance, HR, IT, records managers, and business leaders. Forensic Discovery works with law firms and businesses only and does not accept direct individual consumer matters. If a law firm represents an individual, the firm may contact us about the matter. View our service locations.
Start with the known custodians, systems, deadline, and planned changes to accounts or devices. We will discuss remote and onsite options, volume, encryption, access requirements, transfer constraints, and the documentation your team expects. A declaration or testimony requirement should be raised during scoping.
Confirm scope and pricing before starting. Ask for a written plan that identifies assumptions, exclusions, and how additional sources or access problems will be handled.
Preservation takes steps to retain identified information and reduce the risk of loss or change. Collection acquires data for examination or review. A source may be preserved in place before a copy is collected, or acquisition may be part of the preservation approach. The right sequence depends on the system, retention behavior, authority, and counsel’s scope. Neither step automatically covers every record or every source.
Counsel evaluates the applicable legal duties, timing, and scope in the context of the matter. Forensic Discovery helps translate those decisions into a technical source map and practical preservation options. Custodians, systems, date ranges, shared data, and retention settings all need attention. We can identify technical risks and document agreed actions; we do not determine when a legal duty begins or whether a hold satisfies the law.
Begin with the systems people actually used for the relevant work: email, computers, phones, shared folders, cloud storage, chat, and other identified repositories. Counsel defines relevance and proportionality; IT and custodians help locate the data. The map should distinguish confirmed sources from reported or inaccessible ones. Our guide to what your business should collect for eDiscovery provides a useful starting point.
Some sources support remote collection, while others require physical access or onsite coordination. Connectivity, account permissions, device condition, encryption, platform features, and the requested data affect the available route. We assess the method for each source and document custody and verification steps appropriate to it. Remote access does not make unavailable data recoverable or replace the need to confirm authority. Scheduling and any travel are agreed during scoping.
A specialist can help when a collection involves several sources, disputed methods, metadata concerns, unavailable records, or a need for detailed documentation. IT and custodians often provide essential system knowledge and access. The question is whether the proposed process fits the scope and preserves the information needed for later use. We can review the plan or an existing export and explain limitations without assuming that all self-collection is unreliable.
Chain of custody records document handling and transfers. A hash is a calculated value for a defined file, image, or other data object; matching values can support a finding that those bytes have not changed between checks. The object and comparison points must be stated. Hashes do not establish that all relevant data was collected, that source content is true, who created it, or whether a court will admit it.
Timing depends on the number and condition of sources, data volume, available access, transfer speeds, platform limits, and the need for onsite work. Preservation planning and acquisition may proceed on different schedules. Tell us the deadline and any planned account or device changes so we can discuss priorities and dependencies. We confirm the proposed schedule for the engagement rather than promising work on the same day or a standard turnaround.
Custodian and source counts, collection methods, data volume, encryption, access coordination, travel, and deadlines all affect scope. Reporting detail and anticipated declaration or testimony work may also change the estimate. A clear source map helps distinguish included work from possible further work. Ask for a written scope and estimate before work begins. Newly discovered sources or unresolved access issues may require an agreed change.
The next step follows the matter’s purpose. Discovery data may move to eDiscovery assessment and hosted review for processing and review led by counsel. Questions about activity on a particular device may require computer forensics. The handoff should identify formats, source relationships, handling instructions, and known gaps. Counsel makes privilege, relevance, and production decisions; a collection report does not make those determinations.
An agreed engagement can include a report or declaration explaining the sources, methods, custody records, checks, and limitations, with testimony support scoped when needed. The examiner describes the work performed and what the records support. Counsel determines the procedural requirements and how the material will be used; courts decide admissibility. See our expert witness and testimony services for this separate scope.
Tell us about the hold, request, or investigation, the custodians involved, and the systems you need to preserve. Forensic Discovery can discuss a data preservation and collection scope with your legal and business team. Use the form for a general inquiry; arrange an appropriate transfer before sharing sensitive documents.
"*" indicates required fields
(866) 458-4993 
