Global Digital Forensics · Information gathering library · October 18, 2026
Read this guide freely. Choose a download, then share your work email and company or skip.
When you share your details, GDF records the requested resource with your introduction.
Your selected download starts immediately after you share your details or choose Skip.
No marketing subscription is created. Keep completed records in controlled systems.
Help counsel and a forensic consultant identify relevant people, devices, accounts, repositories and short lived records before collection.
Attorneys, paralegals, business/medical contacts, project coordinators and client IT
Employment, confidential information and departure disputes. The package starts from the facts, and theft, recoverability, employer ownership of personal accounts and authority to access another organization are each questions for the attorneys and the examiner to work through.
Begin with the alleged events and dates, not with a request for every record on every device. Ask counsel to identify the issues, the custodians, the time ranges and the preservation priorities, and include records that may support or contradict the allegation, because a forensic examiner who later testifies will be asked whether the search was one sided.
Account disablement, license removal, transfer of ownership, device wipe and replacement can all affect evidence, and they are routine offboarding steps that run on IT's schedule, so bring the legal team into that schedule early. Coordinate security containment and preservation with the legal team and authorized IT. Necessary containment goes ahead; document what changed and when, with the ticket or change record that shows it.
Federal and New York practice differ. Counsel reviews preservation, proportionality, possession, custody or control, privacy, privilege, local rules and case orders. New York CPLR 3130 sets conditions on the use of interrogatories in specified circumstances, and the commercial and uniform rules add their own requirements. The sample questions are a drafting bank for counsel to tailor before service.
Give each request to the suggested owner. Record each answer, including the items awaiting confirmation, in the editable CSV checklist. Keep the records themselves in a secure evidence location agreed with the recipient and use the checklist as the index that points to them; passwords stay with their owners, and real patient data and controlled technical information stay in the secure location.
Records to find
Download the editable gathering checklist. CSV files hold plain records, and your spreadsheet sets the layout. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
EMP-R01 Matter facts and timeline
Ask
HR and legal
Gather
Employment/role dates, departure timeline, relevant business files/events, parties, issues and permitted time range.
Where to ask
HR, manager and counsel
Why it may be needed
Directs a proportionate, even handed information request.
Hold instructions/implementation, relevant retention settings, pending deletions, license changes, account disabling, wipes and replacement/reassignment records.
Where to ask
Legal, messaging, identity and endpoint owner
Why it may be needed
Flags the time sensitive steps that protect relevant information.
If missing or uncertain
Escalate imminent deletion or open hold coverage at once so the hold reaches each source early, and record when each hold took effect; the examiner plans any recovery work from those dates.
What was actually preserved/collected, who performed it, exact scope/filters, date/time zone, hashes where used, errors and sources queued for collection.
Where to ask
Collection report and file index
Why it may be needed
Allows the receiving expert to assess coverage and request remaining work.
If missing or uncertain
Confirm a completed download or a zero search result against the source scope, filters and error reports before reading it as final.
Download the response template. A useful answer names the actual system, period, supporting record and its coverage. Where the answer sits with someone else, name the person or provider who can give it.
1. Which accounts and devices did the person use for the relevant work, including shared and renamed accounts?
Suggested responder
Client IT or system owner
Useful supporting record
Identifier crosswalk with dates and ownership.
2. Which offboarding actions have occurred and what remains scheduled?
Suggested responder
Client IT or system owner
Useful supporting record
Dated action/change records and preservation confirmation.
3. Where do linked cloud files live, and who owns the external/shared copies?
Suggested responder
Client IT or system owner
Useful supporting record
Exact tenant/site/share/workspace IDs and owner list.
4. Which non email tools did the person and coworkers actually use?
Suggested responder
Client IT or system owner
Useful supporting record
Custodian interview notes with apps/accounts and purpose.
5. What event types were logged at the time and how far back can each source be retrieved?
Suggested responder
Client IT or system owner
Useful supporting record
Coverage/retention table, earliest/latest examples and field legend.
6. Could a device, account, IP or badge have been shared or used by an administrator?
Suggested responder
Client IT or system owner
Useful supporting record
Assignment, delegation and remote support records.
7. What migrations, deletions, license changes or policy changes may have affected records?
Suggested responder
Client IT or system owner
Useful supporting record
Change log with known gaps and decision owners.
8. What does a permitted export include, and which errors or unindexed items need separate work?
Suggested responder
Client IT or system owner
Useful supporting record
Export process report and documented limitations.
Sample discovery questions to tailor
Sample questions are drafting prompts for counsel, who shapes them into requests that fit the matter. Define the event, source, period and parties. Check relevance, proportionality, privilege, privacy, possession/custody/control, current local rules and case orders. Federal Rule 33 ordinarily allows up to 25 interrogatories, including discrete subparts, unless a stipulation or court order sets another number. New York uniform and Commercial Division rules and CPLR 3130 set their own conditions on interrogatories; especially check the interrogatory/deposition choice in negligence personal injury, property or wrongful death actions. Split or narrow prompts as the rules permit, and use a document request, interview or deposition topic where that is the appropriate device. Counsel decides what is served; these packages prepare the facts behind it.
Supporting procedural sources: LG01, NY05, NY06, NY07 and NY08. These questions are separate from the internal IT interview.
Identify the custodians of records concerning [defined disputed event] during [period] and each custodian role.
Identify the devices assigned to [person] during [period], including their unique identifiers and current custodian.
Identify the business accounts used by [person] for [defined project], including aliases and shared accounts.
Identify the repositories holding [defined project records] during [period], their responsible administrators and relevant external owners.
Describe the retention/deletion settings applicable to [defined source] during [period], including material changes and known data gaps.
Identify the log sources that record [defined activity] for [period] and the person able to explain their coverage and fields.
Identify the preservation and collection actions actually taken for [defined source], including dates and persons performing them, without requesting privileged advice.
Identify responsive sources not searched or produced and the factual basis for claimed inaccessibility or limitation, subject to the applicable rules and orders.
Record the technical questions to discuss with counsel when preparing discovery requests.
Worked gathering example
Example only: A returned laptop contains an online only shortcut to a project folder. The coordinator records the shortcut and asks IT for the tenant/site owner, relevant versions and sharing records. The specialist chooses a collection method for the cloud folder, and the coordinator logs the shortcut as a pointer to that folder.
Facts to confirm and specialist decisions
These are explicit handoff questions, and each one closes with the specialist's written answer, drawing on the records marked Received. Add client specific questions and a responsible person.
EMP-Q01 What sources and time ranges are proportionate and within lawful possession, custody or control?
Ask
Counsel
Gather
Claims, issues, chronology, ownership and proposed source inventory
Resolution needed
Counsel approved scope and authority before collection; preserve separately where required.
EMP-Q02 Can the relevant activity be attributed, and what alternatives remain?
Ask
Forensic specialist
Gather
Original records, timestamps, IDs, mappings and limitations
Resolution needed
Expert analysis after collection, combining the device record with access logs, interviews and other corroboration.
The handoff is ready when the issue, date and custodian scope and the authority to collect are agreed with counsel; when imminent deletion and offboarding actions are recorded and escalated; when cloud repositories, archives, backups and business systems are addressed alongside the endpoints; and when the source inventory distinguishes possible, confirmed, preserved and collected locations so the examiner can plan the next steps.
Download the record index. Use the shared walkthrough for custody, restricted records, follow up on open items and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. The package works alongside the actual contracts, facts, configuration and case orders.
