Resources · Information-gathering library · OT library · Download access · Privacy Global Digital Forensics · Information gathering library · October 18 2026
Edition GATHER-20261018-01 · Information-gathering edition
Read this guide freely. Request download access with your name and email.
GDF records the selected resource in its lead intake and private Stats.
Open your emailed link for seven days of preparation downloads in this browser.
No marketing subscription is created. Keep completed records in controlled systems.
Use this atlas as an interview menu. A category is a possibility until an owner confirms the actual system, account, period and available records. Record both business content and separate metadata/logs. Do not seek every source in every case. Counsel and the receiving specialist set relevance, preservation, lawful authority and proportionate scope.
Library home · Download the editable source inventory
D01 Laptops and desktops Possible information Local files, downloads, synced copies, browser records and user/application artifacts if retained. Ask the owner Which device IDs, user profiles, encryption/recovery arrangements and relevant dates exist? Is a scoped forensic collection needed? Likely contact IT asset owner and custodian Limits to confirm A local synced folder may contain placeholders rather than all cloud content. Do not boot, wipe or explore a device simply to fill this inventory. Reference: NI04; MS01
NI04 MS01 D02 Mobile phones and tablets Possible information Messages, work apps, photographs, attachments and account links subject to device/app state. Ask the owner Company-owned or personal? Which apps and accounts were used, who can authorize collection, and what is still available? Likely contact Custodian, MDM owner and counsel Limits to confirm MDM enrollment does not guarantee access to all app data or permission to collect personal information. Deletion and encryption can limit recovery. Reference: NI04; LG01
NI04 LG01 D03 External media and paper Possible information USB/external disks, removable media, notebooks, printouts and offsite files. Ask the owner Which media or physical locations were used and who has custody? Likely contact Custodian, facilities and records manager Limits to confirm A record may have left the managed network without a surviving access log. Preserve physical identifiers and custody. Reference: NI04; NY02
NI04 NY02 D04 Email and calendars Possible information Messages, attachments, drafts, calendars, tasks, shared/delegated mailboxes and groups where supported. Ask the owner Identify all primary/alias/legacy/shared addresses and relevant mail systems; what export includes attachments and metadata? Likely contact Messaging administrator and business owner Limits to confirm An individual mailbox search can omit shared mailboxes, external mail, deleted/inactive users and cloud-linked documents. Reference: MS01; GO01
MS01 GO01 D05 OneDrive and personal work storage Possible information User-owned work files, supported versions, sharing links and retained content. Ask the owner Which exact user/site URLs exist, including deleted/unlicensed accounts? What holds, licenses and deletion schedules apply? Likely contact SharePoint/OneDrive administrator Limits to confirm Recycle bins are not indexed for normal eDiscovery search. Current unlicensed-account archive/payment conditions require separate checks; do not promise indefinite preservation. Reference: MS03; MS05
MS03 MS05 D06 SharePoint and Teams files Possible information Team sites, libraries, lists and separate channel sites where used. Ask the owner Which site/library and private/shared-channel locations are relevant? Where do linked files actually live? Likely contact Site and collaboration administrators Limits to confirm Mailbox message collection alone does not gather every channel file, list, version or linked target. Reference: MS01; MS02; MS05
MS01 MS02 MS05 D07 Teams messages and meetings Possible information Searchable compliance records, chats/posts, recordings/transcripts and meeting artifacts where supported. Ask the owner Which chat/channel/meeting types, policies, organizers and storage locations apply? What known content exclusions exist? Likely contact Teams, messaging and site administrators Limits to confirm eDiscovery uses compliance records rather than the live Teams database. Files and recordings may require different locations. Features and channel behavior change. Reference: MS02
MS02 D08 Google Gmail and calendars Possible information Messages, attachments and calendar content supported by the actual Workspace/Vault setup. Ask the owner Which accounts/domains, delegated/group mail, licenses and retention/holds existed for the relevant period? Likely contact Workspace/Vault administrator Limits to confirm Vault is not an independent archive and requires supported/licensed data and configured policies. Deleting users or required licenses can destroy availability. Reference: GO01
GO01 D09 Google Drive and shared drives Possible information Owned/shared files, shared-drive material and versions/exports as supported. Ask the owner Who owns each file/shared drive, including external owners? Which search and export settings were used? Likely contact Drive/Vault administrator and document owners Limits to confirm A user-centric search or exported shortcut need not include the actual external target or every historical version. Confirm the export scope with the provider. Reference: GO01
GO01 D10 Google Chat Meet and Voice Possible information Supported messages, meeting artifacts, recordings and Voice records if used and retained. Ask the owner Which services, history settings, organizers and licenses were in use? Likely contact Workspace/Vault and communications administrators Limits to confirm Service-specific coverage matters; do not assume every conversation or unrecorded call is recoverable. Reference: GO01; GO02
GO01 GO02 D11 Slack and shared workspaces Possible information Channels, direct messages, files and preserved edits/deletions where the plan and tools support them. Ask the owner Which workspaces, plan, export authority, apps, retention and Slack Connect parties apply? Likely contact Workspace/org owner and counsel Limits to confirm Exports/API access are plan/permission dependent. External organizations can control relevant content and retention. Reference: SL01; SL02
SL01 SL02 D12 Other messaging and meeting systems Possible information Business use of texts, WhatsApp, Signal, Zoom, chat, voice or other collaboration tools. Ask the owner Ask each custodian which actual accounts/apps were used, whether history/recording existed and who controls it. Likely contact Custodian, communications owner and counsel Limits to confirm Candidate category only: encryption, device state, disappearing settings, contracts and legal authority differ. No guaranteed export or recovery is represented. Reference: NI04; LG01
NI04 LG01 D13 Identity and access platforms Possible information Account, sign-in, role, group, authentication and administrator records if logged. Ask the owner Which tenant/account IDs, role assignments, event sources and dates can be exported? Likely contact Identity administrator Limits to confirm Successful authentication is not proof that a named person performed every later action. Log availability depends on actual coverage and retention. Reference: NI04; MS04; GO02
NI04 MS04 GO02 D14 Security monitoring and endpoints Possible information SIEM, EDR, DLP, alerts, investigation cases and file/device activity if collected. Ask the owner Which agents, policies, sensors, fields, exclusions and retained periods cover the relevant event? Likely contact SOC, endpoint owner and providers Limits to confirm An alert is a lead requiring interpretation. Absence of an alert or agent visibility does not prove no activity occurred. Reference: NI04; MS04
NI04 MS04 D15 Network and remote access Possible information VPN, firewall, proxy, DNS, wireless and remote-support records if enabled. Ask the owner Which identity/device/IP mappings and times are available; what NAT, clock or shared-account issues exist? Likely contact Network team and remote-access provider Limits to confirm Network connections do not necessarily reveal file contents or establish the human actor. Reference: NI04
NI04 D16 Microsoft audit and export reports Possible information Activity logs, query/export job records, processing errors and source counts. Ask the owner What exact licenses, policies, event types, role filters, earliest dates and error reports apply? Likely contact Purview administrator Limits to confirm Content retention is separate from audit-log retention. A zero result can arise from scope, indexing, permissions or filters. Reference: MS04; MS06
MS04 MS06 D17 Google audit and export reports Possible information Admin, login, Drive and other service events, job histories and errors as available. Ask the owner Which log type, time period, query, export mechanism and event delay apply? Likely contact Workspace security/Vault administrator Limits to confirm Retention and delay vary by log. A Vault content hold does not promise preservation of every separate activity log. Reference: GO01; GO02
GO01 GO02 D18 Cloud infrastructure and storage Possible information Virtual machines, object stores, snapshots, databases, cloud keys and management/data-access logs where configured. Ask the owner List accounts, subscriptions, regions, services, logging settings, bucket/container IDs, lifecycle rules and providers. Likely contact Cloud administrator and application owners Limits to confirm AWS default Event history is regional 90-day management history; it excludes data events. A storage download may not have been logged there. Reference: AW01; NI04
AW01 NI04 D19 Email journals and compliance archives Possible information Journaled/ingested mail, attachments, other captured feeds and archive search histories. Ask the owner Which feeds/users/date ranges were captured, what failed, and does export preserve original fields and attachments? Likely contact Archive owner and provider Limits to confirm Candidate category. Verify capture, deduplication and migration gaps; an archive is not necessarily a complete copy of the source. Reference: NI04; LG01
NI04 LG01 D20 Backups snapshots and recovery replicas Possible information Point-in-time data, application/database copies, endpoint backups and old recovery media. Ask the owner Which systems/dates, catalogs, keys, overwrite dates, restore methods, cost and licensing are involved? Likely contact Backup administrator and provider Limits to confirm Do not restore over production. Ask the specialist whether a justified isolated restoration is necessary; a job-success report is not proof that relevant data can be restored. Reference: NI04; LG01
NI04 LG01 D21 Legacy systems and migrations Possible information Decommissioned servers, previous tenants/domains, migration staging, historical exports and transfer logs. Ask the owner What moved, when, from/to which system, with what reconciliation and known exclusions? Likely contact Former owners, integration/migration team and provider Limits to confirm A current-system report can omit earlier data; old schemas, software or keys may be needed. Reference: NI04; LG01
NI04 LG01 D22 CRM and sales systems Possible information Customer/contact records, opportunities, activities, attachments, quotes and field histories where supported. Ask the owner Which objects, IDs, fields, audit/history features, attachments and integrations cover the dispute? Likely contact Sales operations and CRM administrator Limits to confirm Candidate category. Standard reports may omit history, deleted records, relationships or linked files. Confirm vendor/version. Reference: NI04; LG01
NI04 LG01 D23 ERP accounting and procurement Possible information Orders, invoices, payments, approvals, vendor/customer changes and journals where retained. Ask the owner Which transaction IDs, attachments, effective/posting dates, approval records and audit histories are needed? Likely contact Finance, procurement and application owner Limits to confirm An invoice alone need not show approval, delivery, later adjustments or who changed bank details. Reference: NI04; LG01
NI04 LG01 D24 Contracts and electronic signatures Possible information Negotiation files, clause versions, signature envelopes, completion certificates and recipient events where available. Ask the owner Which CLM/e-signature service, envelope/agreement IDs, history/certificates and linked exhibits exist? Likely contact Legal operations, contracting and signing-service administrator Limits to confirm A signature certificate is one part of the record; it does not independently establish the signer identity or all negotiations. Reference: DS01; LG01
DS01 LG01 D25 Document management and deal rooms Possible information Matter/project files, version chains, comments, permissions, workspace activity and external shares where supported. Ask the owner Which workspaces, version policies, exports and external-party copies should the specialist consider? Likely contact Records/legal operations and workspace owner Limits to confirm Candidate category. Current-document download can omit earlier drafts, annotations or workspace audit history. Reference: NI04; LG01
NI04 LG01 D26 Tickets project and engineering tools Possible information Requests, task comments, approvals, attachments, release/change records, code and designs. Ask the owner Which project/repository IDs, branches, issue types, revisions and external integrations contain relevant work? Likely contact Engineering, service desk and project owners Limits to confirm Candidate category. Export relationships and linked artifacts may require separate requests. Reference: NI04; EA01; IT01
NI04 EA01 IT01 D27 HR payroll and offboarding Possible information Employment dates, role/device assignments, access-change requests, separation and reimbursement records. Ask the owner Which relevant dates, devices, accounts and policy acknowledgments can be supplied lawfully? Likely contact HR, payroll, IT and counsel Limits to confirm Restrict personnel and unrelated personal data. Offboarding can trigger deletion, token changes or wiping; coordinate preservation with counsel and security. Reference: LG01; NI04
LG01 NI04 D28 Legal practice management Possible information Matter metadata, documents, notes, billing, trust/accounting entries, communications, tasks and portals where used. Ask the owner Which modules, linked storage, client portal and separate exports are relevant? Likely contact Firm administrator, legal operations and provider Limits to confirm Clio matter-list export contains matter-form data; other subtabs may be needed. Do not assume one matter CSV is the whole file or waive privilege. Reference: CL01; CL02
CL01 CL02 D29 EHR or EMR clinical record Possible information Visits, notes, orders, results, medication records, amendments, addenda and signed/unsigned status as stored. Ask the owner Which systems, patient/encounter IDs, modules, authors, date types and export formats hold the relevant episodes? Likely contact Health information management and clinical application owner Limits to confirm Candidate clinical locations require vendor/site confirmation. A printed chart may omit audit data, versions, attachments or separate departmental systems. Reference: HE01; HE03; HE06
HE01 HE03 HE06 D30 Clinical audit and provenance Possible information Audit events, accesses, amendments, signatures, proxy activity and emergency overrides if recorded. Ask the owner Which events/fields, identifiers, clock settings, retention and reports exist? Ask for a legend and known gaps. Likely contact Clinical security/application owner and vendor Limits to confirm Certification guidance describes capabilities; it does not prove a specific field/event exists in this deployment or that logs were retained. Reference: HE01 164.312(b); HE06
HE01 HE06 D31 Imaging laboratory and pharmacy Possible information PACS/RIS images/reports, laboratory/pathology systems, medication and administration records if used. Ask the owner Which separate systems, identifiers, original files, result revisions and interfaces relate to the episode? Likely contact Radiology, laboratory, pharmacy and department IT Limits to confirm Candidate categories only. Do not infer a particular event or file exists or that an EHR export includes all departmental records. Reference: HE01; NI04
HE01 NI04 D32 Patient portals exchanges and telehealth Possible information Portal messages, upload/download records, referrals, health-information-exchange traffic and telehealth artifacts where retained. Ask the owner Which platform, patient/account IDs, sending/receiving organizations and interface messages are relevant? Likely contact Portal/HIE/telehealth owner and privacy lead Limits to confirm Account activity does not establish the patient personally acted; proxy accounts and imported records require interpretation. Reference: HE01; HE03; HE06
HE01 HE03 HE06 D33 Practice management billing and claims Possible information Scheduling, check-in, referrals, coding, authorizations, claims/remittances and adjustments if used. Ask the owner Which clinical/financial IDs join the records and what does the billing export omit? Likely contact Practice administrator, billing and payer/clearinghouse contact Limits to confirm Billing, clinical and legal records can differ. Do not treat a charge code as proof that care was delivered. Reference: HE01; HE03; NI04
HE01 HE03 NI04 D34 Facilities and physical systems Possible information Badge/visitor events, CCTV, building controls and vehicle/location records if operated and retained. Ask the owner Which camera/door/location IDs, overwrite times, clocks and system owners relate to the matter? Likely contact Facilities, security, fleet and counsel Limits to confirm Candidate categories. Confirm privacy/authority and preserve time context; a badge event need not identify the person who entered. Reference: NI04; LG01
NI04 LG01 D35 Third parties insurers and outside professionals Possible information Vendors, brokers, advisers, counterparties, outsourced IT and external archives may hold distinct records. Ask the owner Who owns or controls each copy and what request/consent/order or contract right is needed? Likely contact Counsel, business owner and provider Limits to confirm A client contact or login is not authority to obtain all third-party data. Coordinate lawful requests and restrictions. Reference: LG01 Rules 34 and 45; HE03
LG01 HE03 D36 Automations AI tools and integration copies Possible information Prompts/outputs, connected data, workflow histories, generated summaries and intermediate files where actually retained. Ask the owner Which tools were actually used, with which organization/personal accounts, connectors and retention settings? Likely contact Application owner, users and provider Limits to confirm Candidate category only. Generated text is not a substitute for the original record; preserve provenance and verify actual feature/export coverage. Reference: MS01; GO01; NI04
MS01 GO01 NI04 These materials assist preparation and information gathering. The receiving professional determines scope, necessary records and conclusions. No audit, certification, legal determination or collection authorization is supplied.
Source review date: October 18 2026. Recheck sources and actual-client facts before use.
