Global Digital Forensics · Information gathering library · October 18, 2026
Read this guide freely. Choose a download, then share your work email and company or skip.
When you share your details, GDF records the requested resource with your introduction.
Your selected download starts immediately after you share your details or choose Skip.
No marketing subscription is created. Keep completed records in controlled systems.
Use these packages to find, describe and organize information before engaging an auditor, cybersecurity consultant, attorney or export control specialist. Begin with the records you already have, because most of what a specialist needs on day one exists somewhere in the organization and the work is locating it and naming who holds it. An unanswered question is a request for help, not evidence of a violation, and a gap recorded honestly is worth more to the specialist than a guess.
This edition supplies gathering guidance, candidate data sources and question banks. The receiving professional decides what the gathered material supports.
Legal entity, trade names, parent/affiliate chart and relevant client or case reference.
Purpose and recipient
Which audit, assessment, consultation, litigation question or export review is contemplated? Who requested it?
Period and locations
Start and end dates, time zone, state/country locations, business changes and exclusions.
People
Business sponsor, legal lead, coordinator, internal IT, provider contacts and person authorized to release records.
Systems and data
Actual tenants, accounts, devices, applications, paper stores, vendors and relevant data types.
Immediate concerns
Known active incident, imminent deletion, expiring logs, court order, transaction hold or contractual deadline. Escalate to the responsible professional right away.
Record the legal entity, business unit or case, the intended recipient, the purpose, the relevant period, the sites, the systems and the client contact on one page, and ask the recipient which criteria, versions and deliverable format they expect before anything is gathered. Keep an audit preparation request separate from an incident response or a litigation deadline; the two run on different clocks and the first thing a specialist asks is which one applies.
2 Identify people and places
Ask the business owner what work occurred and ask IT where the resulting information lives, because the two answers rarely match on the first pass and the difference is where the missing sources are. Include providers, acquired businesses, former accounts, paper files and legacy systems. Start with the data source atlas and create one inventory row per actual tenant, repository or device, not one row per vendor name; a single vendor name can hide three tenants and a dormant domain.
3 Check authority and preserve when necessary
Before changing accounts, retention or content, ask counsel and the authorized system owner what must be preserved and who can act. Escalate short lived logs and pending deletions promptly, because the retention clock does not wait for the checklist. A hold request must be checked for its actual scope and its successful application; the confirmation screen from the platform is the record, not the email that asked for it. Confirm what earlier data a new license or case actually preserved.
4 Gather existing records safely
Request existing exports and documentation through approved channels. Obtain a scoped collection plan from the specialist if forensic acquisition, production testing, restoration or third party access is needed, so every image and export follows the plan. Use identifiers and redacted examples until the receiving specialist confirms a secure route. Keep passwords, recovery secrets, private keys, patient records and controlled technical data out of ordinary email and public forms.
5 Describe what was supplied
Assign a request identifier and a record identifier to every item. Record the source system, the account or tenant, the owner, the period, the retrieval time with its time zone, the method, the filters, the permissions, the file format and the known omissions. Where appropriate, have the collector create and verify a cryptographic hash. A matching hash establishes byte consistency between compared copies.
6 Show gaps and limits
Use the statuses Not started, Requested, Received awaiting specialist review, Partially received, Not available after inquiry, and Proposed not applicable awaiting confirmation. Explain a missing period, an excluded field, a failed export or an uncertainty in the row itself. Record unknown as Unknown, and mark a request complete when every requested record has arrived.
7 Prepare a controlled handoff
Reconcile the request checklist to the file inventory so every request points to a record or a stated gap. Separate ordinary records from restricted evidence and potentially privileged material. Agree on the access, the permitted recipients, the transmission encryption and the retention before anything is sent. Obtain a receipt and list the follow up questions. The recipient decides whether the information supports the proposed engagement, and the receipt is the record that the handoff happened.
8 Maintain the package
Save the edition and the source review date with the handoff. Recheck the requirements and the vendor documentation before the next engagement and whenever the facts change. Version new submissions, retain the earlier index and explain the changes, so that two years later anyone can see what was known at each point. Preservation releases and record destruction go through the applicable owner and counsel.
Who helps with the gathering
Business contact
Explains the business, relevant events, services and people. Can identify records without answering technical control questions.
Project coordinator
Tracks requests, owners, dates, follow up and handoff. Tracks receipt separately from specialist acceptance.
IT and provider contacts
Describe actual systems, permissions, retention, logging and export limitations. Arrange authorized technical work.
Legal and privacy lead
Determine case scope, preservation, legal authority, privilege, protected information and applicable duties.
Receiving specialist
Agrees criteria and scope, specifies additional evidence and evaluates it. Export classifications and audit conclusions remain with qualified decision makers.
Suggested handoff folders
00 Scope and contacts
Engagement purpose, entity/matter facts, period, owner roster and exclusions.
01 Requests and responses
Completed request list, IT questionnaire, records of follow up and unresolved questions.
02 Record index
Pointers to approved evidence locations; source, date, method, limits and receipt. Keep sensitive data in its source system and point to it from this index.
03 Source records
Existing policies, diagrams, contracts and exports; keep restricted material in its approved repository with access controls.
04 Specialist decisions
Applicability, legal/process decisions, export classification or technical collection plan when actually supplied.
05 Handoff and updates
Transmittal, recipient receipt, known gaps, version history and supplemental requests.
Use the record index
Use one row per actual file or logically defined record set. Identify the associated request, original source, date range, collector/method, approved location and limits. Five blank template rows are supplied for extension. No invented case facts or evidence are prefilled.
The first four packages develop the approved initial regulatory priorities. The routing entries below identify additional work; they are not complete audit packages for every law, state, sector or agency.
NYDFS Part 500
Starting facts
Entity operating or required to operate under a relevant DFS authorization.
Records to locate
Legal entity/licensing, examination request, exemption/Class A support, period and existing program records.
Coverage of this edition
Use package 01. Legal scope and the final examination criteria require specialist confirmation.
Specific entity, licenses, sites, residents, sector, government role, permits/orders and contracts.
Records to locate
An applicability register with source/version, actual facts, responsible reviewer and open questions.
Coverage of this edition
Not a fifty state audit package. Refer utility/OT matters to the existing library and current unresolved registers; retain local and controlled document gates.
A person who may possess or manage relevant information. The system owner may be a different person.
Tenant
An organization specific cloud environment. One company can have several tenants and acquired or dormant domains.
Native file
A file in its original working format. A PDF printout can omit formulas, comments, versions, metadata or embedded material.
Metadata
Information describing a record, such as dates, owner, IDs or revision information. Its meaning depends on the application and collection method.
Log
A record of selected system activity. Its value depends on what was logged, for how long and where. Where an entry is absent, the examiner looks at retention settings, adjacent logs and the device record to show what the system would have captured.
Archive
A retained repository that may preserve selected content. Coverage depends on capture, indexing, policy and configuration.
Backup
A recovery copy. Its contents, restore capability and point in time need confirmation; it is not automatically searchable or a litigation hold.
Legal hold
A preservation measure directed by counsel or an authorized process. The instruction, technical implementation and confirmation are distinct.
CUI and FCI
Controlled Unclassified Information and Federal Contract Information. Ask the contracting/data owner for the actual category and contractual basis; a company label alone is insufficient.
ECCN and USML
An Export Control Classification Number under EAR and the United States Munitions List under ITAR. A specialist determines classification and jurisdiction from item and technology facts.
Receiving the package
Ask the recipient to acknowledge what arrived, to name unreadable or missing files and to confirm the next information request. Keep their substantive review decision separate from the delivery receipt. A complete collection is where the specialist's work begins.
Timing and urgent matters
Agree gathering dates with the recipient based on the records, the access and the provider availability. These are project targets, not legal deadlines. Active incidents, imminent deletion, filing deadlines, litigation orders and pending transactions go to counsel or the responsible specialist immediately.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .
