Forensic Collections

What are Forensic Collections?

Forensic collections come in many sizes and complexity.  You may need an opposing party’s mobile phone collected in your conference room at a deposition.  Or, you may need laptops, cell phones, USB flash drives, net file shares, and email accounts preserved for a dozen custodians.  And they are located at your best client’s corporate headquarters across the state.  Which best practices will ensure the collection is legally defensible, cost effective, and completed before your e-discovery window closes?

Planning

The plan is the thing for successful forensic collections.  Perhaps you agree?  So we like to team collaboratively with you and your clients, including the IT folks.  We ask them to review our first and final drafts of the forensic collection plan.  Their input on the plan is essential and usually removes costly surprises. 

Resoucefulness

After planning, the next best practice to ensure effective, legally defensible forensic collections is resourcefulness.  Our experienced, certified forensic experts are resourceful on-site and as effective as they are in the digital forensics lab.  They must respond to thousands of digital devices including both legacy and the latest models to be collected.  A skilled, on-site project manager and evidence technician rounds out the team.  She keeps the collection organized, secure, and properly documented for admissibility in court.  And the collection flows smoothly and cost-effectively until complete.

Loading

After your forensic preservation is complete, the load into your chosen process, review, and host platform is the final step.  Our forensic experts who performed the collection partner with your process and review team until the load is complete.  They make sure the forensic collection is ingested accurately and securely.  They also draft a forensic collection memo which documents insights and helpful observations about your client’s ESI collection.  It enables an easier and more accurate load of the evidence by identifying each evidence source and describing it with technical specificity.  The collection memo also highlights any evidence sources of special interest. It describes any irregularities in nomenclature, labeling, or storage to clarify and streamline load processing.