ESI Collection That Documents Every Step for the Court

What ESI Collection Is and Why the Method Matters

ESI collection gathers electronically stored information for a defined matter while documenting its source and its handling. The sources run from computers, email and mobile devices to cloud accounts, shared storage and databases, and Global Digital Forensics works with the attorneys and the technical contacts on each side to define the scope, preserve the relevant material and prepare a handoff the review team can use on the first day.

Every collection should answer a specific need. A full disk image, a targeted file collection and a cloud export preserve different information, and the right one depends on the matter, the preservation obligations, the access available and the questions the data will have to support. Choosing the method deliberately keeps the collection proportionate and keeps it from being redone.

Full image, targeted collection or cloud export? Describe the sources and the question and we will tell you which method fits each one.

Collections Run by Examiners Who Have Explained Them Under Oath

Global Digital Forensics has served AmLaw 100 firms and Fortune 1000 companies since 1992 with certified, court tested examiners who have testified in federal and state courts, and the person who runs your collection is the person who will explain it in a deposition if it comes to that. Because GDF owns its software, we also process and host what we collect at a cost scaled to small and midsize businesses, so a collection does not have to be handed to a second vendor before anyone can review it.

In the massive data discovery matter, a class action law firm received terabytes of raw financial data, documents, email and legacy mainframe source code with no access to the live system, and we extracted the email and document metadata, correlated it into timelines and kept supporting discovery requests and depositions as the matter progressed. We bring the same standard to a routine custodian collection.

Plan the Collection With Counsel and the Data Owners

We identify the custodians, accounts, devices, relevant dates and likely responsive sources, and we confirm access authority, legal hold instructions, privacy constraints and the treatment of privileged or unrelated data. Our plan turns the agreed scope into collection steps and documents each one, so the collection stands on its own record.

Retention risks are recorded early, because deleted user accounts, expiring audit logs, rotating backups and departing employees change what is available from one week to the next. Decisions not to collect a source are documented with the reason and the resulting limitation. For preservation coordination, see our legal hold technical support.

Match the Collection Method to Each Source

On endpoints we choose between imaging and targeted collection according to the need for deleted material, application records and activity artifacts. For email and cloud services we record the accounts, permissions, export scope, available metadata and provider limits before the export runs. For mobile devices we assess access, supported extraction and the related account and backup sources, and for databases we preserve the schema, the queries, the relationships and the context needed to interpret the records. Remote or onsite collection is chosen on access, bandwidth, device condition and operational constraints.

Collecting from an account does not necessarily preserve every service connected to it. We verify coverage against the source map and record the exceptions before any collection is treated as complete, which is the moment a review team usually discovers a gap if nobody checked.

Bring the device list and the account inventory to the first call and we will mark the sources that need imaging rather than export before anything is collected.

Tell Us the Custodians, the Platforms and the Deadline

A senior examiner will outline the collection options, the scope and the handoff your review team needs. The initial consultation is free, and the 24/7 hotline is (800) 868-8189.

Get a Free Consultation

Document Integrity and Custody From the First Export

We record source identifiers, collection dates, the responsible people, the methods and the relevant settings, keep custody transfers and integrity checks appropriate to each collected format, and preserve the originals or source exports separately from the processing and review copies.

Collection notes explain interruptions, errors, unavailable items and retries. Counts are reconciled and a sample of the output is examined to confirm it contains the expected material, because the export tool's success message demonstrates only that the tool finished, not that the agreed scope was captured.

Ask for a walkthrough of the collection log on the first call and see exactly what the custody record looks like.

Carry the Collection Into Review and Production Without Changing It

We agree on the next destination before delivery. Review may require native files, extracted text, metadata, document families, load files or rendered images, and a production may add identifiers, redactions and an agreed format. None of those decisions is allowed to alter the preserved source.

Search terms, date filters and deduplication reduce the review set, and each transformation is recorded so the path from source to production can be retraced. Attachments and parent and child relationships are kept where relevant, and structured data keeps the meaning of its fields and relationships rather than being flattened into an unexplained spreadsheet.

If your review platform has particular load file needs, read how processing and review hand off, then tell us the format and we will build the collection to it.

What to Send With Your First Inquiry

Tell us the matter type, the deadline, the approximate number of custodians, the known platforms and any urgent retention issue, and whether counsel, internal IT or another provider controls access. With that we can outline the collection options and an initial scope in the first conversation.

Evidence, account passwords and privileged documents travel through a secure transfer we set up once the engagement is scoped, with storage and delivery requirements agreed for the specific work, so the first inquiry only needs the outline.

Ready to send it? Use the contact form for the matter outline and a senior examiner will call to arrange the secure channel for everything else.

Related eDiscovery Services

Explore eDiscovery collections and processing scope and deliverables

Meet the examiners who run the collections