Early decisions have an outsized effect on cost and evidence quality. These answers describe GDF's technical process. They are not legal advice, and the right method depends on the source and matter.
Should a device be turned off?
It depends. Life safety, personal safety, and urgent operational containment take priority. When no immediate protective action is required, a powered-on encrypted device may lose accessible keys if shut down, a connected phone may receive remote changes, and a damaged drive may deteriorate with use. Avoid exploratory handling, record what is currently visible and who has handled the source, and obtain source-specific technical guidance before changing state.
Can deleted data always be recovered?
No. Recovery depends on the device, storage technology, encryption, overwrite, application behavior, cloud retention, backups, and time. Modern solid-state storage and mobile systems may remove deleted content quickly. A recovery assessment should identify alternative sources instead of promising a result.
Can work be done remotely?
Many cloud, email, and supported device collections can be handled remotely. Physical damage, some full-device acquisitions, specialized hardware, contested handling, or short-lived live data may require on-site or laboratory work. The collection method and its limits are documented either way.
What drives time and cost?
Source count, data volume, encryption, access, damage, date range, custodian count, cloud provider, tool support, urgency, search protocol, reporting depth, opposing-expert work, and testimony all matter. A focused question and early source map usually control cost better than a broad request to examine everything.
What does counsel receive?
Deliverables may include an acquisition record, evidence inventory, chronology, artifact table, findings memorandum, expert report, declaration support, demonstrative, or testimony. Scope determines the deliverable. Observed facts, inferences, and limits are kept distinct.