ESI Collection

What is ESI collection?

ESI collection gathers electronically stored information for a defined matter while documenting its source and handling. Potential sources include computers, email, mobile devices, cloud accounts, shared storage and databases. Global Digital Forensics works with counsel and technical contacts to define scope, preserve relevant material and prepare a usable handoff.

The collection should answer a specific need. A broad disk image, a targeted file collection and a cloud export preserve different information. The appropriate method depends on the matter, preservation requirements, access and the questions the data must support.

Plan the collection with counsel and data owners

Identify custodians, accounts, devices, relevant dates and likely responsive sources. Confirm access authority, legal-hold instructions, privacy constraints and the treatment of privileged or unrelated data. Counsel determines legal scope; the technical plan explains how that scope can be carried out and documented.

Record retention risks early. Deleted-user accounts, expiring audit logs, rotating backups and departing employees can change availability. Document decisions about sources that will not be collected, including the reason and any resulting limitation. For preservation coordination, see legal-hold technical support.

Match the method to the source

• Endpoints: select imaging or targeted collection based on the need for deleted material, application records and activity artifacts.
• Email and cloud: record accounts, permissions, export scope, available metadata and provider limits.
• Mobile devices: assess access, supported extraction and related account or backup sources.
• Databases: preserve schema, queries, relationships and the context needed to interpret records.
• Remote or onsite collection: choose based on access, bandwidth, device condition and operational constraints.

Collecting from an account does not necessarily preserve every service connected to it. Verify coverage against the source map and record exceptions before the collection is treated as complete.

Discuss the sources and deadline

Tell us what you need to establish and which systems are available.

Talk with a forensic expert

Document integrity and custody

Record source identifiers, collection dates, responsible people, methods and relevant settings. Keep custody transfers and integrity checks appropriate to the collected format. Preserve originals or source exports separately from processing and review copies.

Collection notes should explain interruptions, errors, unavailable items and retries. Reconcile counts and examine a sample of the output to confirm it contains the expected material. A successful export notification alone does not demonstrate that the agreed scope was captured.

From collection to review and production

Agree on the next destination before delivery. Review may require native files, extracted text, metadata, document families, load files or rendered images. A production may also require identifiers, redactions and an agreed format. Those decisions should not silently alter the preserved source.

Search terms, date filters and deduplication can reduce the review set, but each transformation needs a record. Keep attachments and parent-child relationships where relevant. For structured data, preserve the meaning of fields and relationships rather than flattening everything into an unexplained spreadsheet.

What to send with an initial inquiry

Tell us the matter type, deadline, approximate number of custodians, known platforms and any urgent retention issue. Identify whether counsel, internal IT or another provider controls access. We can use that information to outline collection options and an initial scope.

Do not submit evidence, account passwords or privileged documents through the general contact form. Secure transfer and access arrangements can be established after the engagement is scoped. Pricing, storage and delivery requirements are agreed for the specific work rather than assumed from an old service package.

Related technical service

Explore the service scope and deliverables

Meet our forensic experts