There are several options to collecting data including "Full-Disk Forensic Imaging", "Drag and Drop Collection" and "Targeted Forensic Collection".
We begin by helping you to decide on the best collection strategy for your case. We combine proven, industry-leading technology with our extensive legal expertise to ensure a strategic approach where costs are controlled effectively, critical timelines are met, risks are minimized and the evidence is accessed and managed in the most meaningful way.
Those seeking a fully-defensible solution often turn to Full-Disk Forensic Imaging. However, with increasingly large local hard drives and active servers, individual Full-Disk Forensic Imaging can be expensive and is rarely legally required.
As an alternative, the Drag and Drop Collection method is another strategy but can result in not capturing important deleted information, altered meta data and non-forensically sound data. Although often considered to be more cost-effective, the ‘Drag and Drop' method may be more costly in the long run if spoliation arguments are raised or key evidence is lost.
The now often recommended strategy is Targeted Forensic Collection, which offers more forensic completeness and integrity than Drag and Drop, but is aimed at gathering only the most relevant information regarding the case.
Targeted Forensic Collection can:
Target by custodian
Target by date range
Target by file type (e.g. office documents, mail)
Limit by location
Document the chain of custody
Be forensically sound with the appropriate tools and expertise