Remote Phone, Laptop and Desktop Collection for eDiscovery

Remote Phone and Laptop Collection for eDiscovery

The text thread that decides the case lives on a phone your custodian will not hand over for a week, and the laptop that holds the files is in another state. Global Digital Forensics collects supported phones remotely through a collection link and a computer, usually while the custodian keeps using the phone, and collects targeted laptop and desktop records over an approved connection. Every collection carries the integrity checks and custody record a lab collection would, and the examiner who ran it can explain it under oath.

Get a Free Consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

Agree on the Method Before the Phone Is Touched

Legal authority to collect a device is not the same as technical access to everything on it. A passcode, an encrypted volume, an operating system version or an application’s own storage can limit what any method returns, and a method that works on one iPhone model may not work on the next. Before anything is collected we agree what the chosen method involves: any software installed, any assistance the custodian provides, any operating system activity the collection will cause and any change to the source that has to be documented.

The deliverable identifies the acquired sources, the original outputs, the collection logs, the integrity checks appropriate to those outputs, the regions that were inaccessible and any step that failed or was excluded. We also look at backups rather than discarding them because someone called them an IT copy, since an older backup often holds the message the current phone no longer does.

Technical references on collection method are available in NIST IR 8354, Digital Investigation Techniques: A NIST Scientific Foundation Review, Apple backup contents and Apple iCloud security.

Not sure whether the phone in your matter needs to be preserved today? Call (800) 868-8189 before anyone resets it, upgrades it or hands it back.

Technical methods and scope

Collect the Business Evidence Held on Phones and Computers

Global Digital Forensics has served law firms and companies since 1992, and our examiners have testified in federal and state courts about how device evidence was collected. Text messages, Signal and WhatsApp conversations, calendar entries, browser history, file movement and USB activity hold business evidence that never reaches the mail server, and in discovery those records have to be collected in a way that can be explained later to the other side and to the court.

Our collection record documents the selected method, the provenance, any source changes and the coverage, so another qualified examiner can assess the material. The plan confirms the exact device, the available access and the supported method, and identifies where a deeper examination would need laboratory work, which lets the legal team separate an obtainable record from a proposed recovery task before committing to the cost.

Method Selection Guided by NIST SP 800-101 Rev. 1

NIST guidance on mobile device forensics addresses validation, preservation, acquisition, examination, analysis and reporting, and we plan against it while confirming the actual device, operating system version, source state and validated tool support for the matter at hand. Logical, file system, physical, backup and cloud methods have different coverage, and the record names exactly what the chosen method reached.

The method follows the question. A discovery request for business texts over a defined period calls for a different collection than a trade secret matter that turns on deleted files, and the proposal names the method we recommend and what it is expected to return.

Ask a discovery specialist how this fits your matter; the first consultation is free.

iPhone, Android, Windows and Mac, Collected by Certified Examiners

Veronica Perez, a Senior Computer Forensic Specialist, focuses her work on the collection, preservation and examination of mobile device evidence. She is an EnCase Certified Examiner and a Paraben Certified Mobile Phone Examiner with Cellebrite CCLO and CCPA certifications, served in law enforcement from 2001 to 2016 before private practice and has provided mobile forensics instruction for the California Department of Justice Advanced Training Center. Robert Knudsen brings hundreds of computer and mobile device examinations in federal and state court matters. The examiner who collects the device is the examiner who explains it.

For iPhone and iPad, supported logical, advanced logical or file system methods are selected against the exact hardware, software, state and credentials, and the record identifies what was obtained and what was inaccessible. Android collection covers Samsung, Google Pixel and other supported devices, with the method and tool version confirmed for the particular model. Windows imaging uses write protection and verified E01 or AFF4 images, or remote targeted collection where a full image is unnecessary. For macOS we account for T2 and Apple Silicon protections and for APFS snapshots, Unified Logs and application databases. Tablets, watches and other connected endpoints are assessed for the records their platform actually retains.

Remote Collection While the Phone Stays in Use

For supported phones, the custodian connects the phone to a compatible computer, opens the collection link we send and follows the prompts with a GDF examiner guiding each step. The data transfers securely to GDF and the phone normally stays in use throughout. A remote collection takes anywhere from a few minutes to overnight depending on the amount of data and the setup, and many custodians start it before bed and wake to a finished collection. Nothing is shipped, nobody travels and no one is without a phone for a week.

For distributed laptops and desktops, a supported remote method collects targeted Windows or macOS records over an approved connection, with the custodians, dates, file types, directories, collection window and any installation or removal of the collection component defined in advance. We document the parameters, the transfers, the output integrity checks, the exceptions and any changes the live operating system or user activity introduced, so the result can be interpreted in context. We confirm compatibility before starting and tell you plainly when a question needs the deeper methods only a laboratory can provide.

Tell us the devices, the applications and the deadline and we will confirm which can be collected remotely, which need a visit or a laboratory and what each will return.

When a device does need the laboratory, the custodian is usually without the phone for 24 to 48 hours while it is with us, with shipping time additional, and the device's condition and extraction requirements can affect that schedule.

Get a Free Consultation Call (800) 868-8189

Verify Integrity and Document Custody

A reliable handoff documents source changes, integrity checks and custody continuity. We use a validated write blocking method where the source and method support it, record acquisition and file integrity values, verify the collected material at transfer and at examination and account for each material transfer from collection through delivery. Live mobile, memory and remote collection can change the source, so each change is written into the record before cross examination can ask about it.

The report pairs the hash values with a coverage statement, so the other side sees both integrity and scope. When expert support is in scope, the assigned examiner addresses the documented method, the integrity checks and the custody record in an affidavit, at deposition or at trial.

Attorneys who want to know which certified examiner would collect the devices and explain the method can review the forensic team and their certifications.

Methodology

From Device Sources to Discovery Delivery

Identify devices, custodians and relevant data

We map the request to custodians, devices, accounts, retention and data types and confirm authority before choosing a method.
Preserve the approved device records

We implement the approved preservation and document owners, dates, changes and exceptions for each source before anything is reset or reissued.
Collect and verify

We collect with the supported remote, onsite or laboratory method, verify transfers and reconcile extraction and processing exceptions against the agreed scope.
Deliver the agreed discovery package

We check the review or production package against its specification and hand the receiving team the device collection audit record alongside it.

When a matter needs a full forensic examination of a laptop rather than a targeted collection, our computer forensics service picks up where discovery collection stops.

Evidence commonly examined

Mobile and endpoint records we collect

Custodian and source inventories identify the devices and accounts covered by the request. Microsoft 365 and Google Workspace provide the connected account records, collaboration and messaging content ties device activity to wider conversations, and computers, phones and shared storage supply the local evidence within scope. Database and structured business records corroborate events where included, and the collection, processing and exception records document acquisition coverage and handling.

What you can expect

Your collected data and handling record

The device map and scope record identify sources, methods and responsibilities. Acquisition and processing logs preserve the technical history of the collected data, the reconciliation report accounts for unreadable, failed or excluded steps, and the validated package presents the acquired material in the agreed review or production workflow.

Request a free initial consultation with the device list and the discovery deadline and we will scope this handling record in writing.

Plan Your Mobile and Endpoint Collection Before the Device Changes

Bring the device models, the account access, the relevant applications and the deadline to a free initial consultation. We will compare remote, onsite and laboratory methods and tell you what each will return.

Read the data discovery case study to see how collected records became a usable review set, and meet the examiners who would handle the collection.

Get a Free Consultation

Frequently asked

Phones in Use, Collection Time and Targeted Extraction

Can the custodian keep using the phone during collection?

In most supported remote collections, yes. The custodian connects the phone to a computer, opens our collection link and follows our guidance, and the phone normally stays in use. We tell you in advance if a particular device or method needs a pause.

How long does a remote phone collection take?

Anywhere from a few minutes to overnight, depending on the amount of data and the setup. We give the custodian a timing estimate, and many start the collection before bed so it finishes while they sleep.

Which phones and computers can you collect?

Supported iPhone, iPad and Android devices, Windows and macOS computers, and tablets, watches and other endpoints where the platform retains useful records. We confirm the exact model, operating system and access before quoting a method, and we say plainly when a device needs laboratory work.

Do you collect the whole phone or only what the case needs?

Both, depending on what the matter needs. Targeted collection limits the records to the applications, dates and custodians in scope, which keeps personal material out of the review set, and a full extraction is used when deleted data or deeper application records are at issue. Either way the record states exactly what the method covered.

Can you work with our review platform and production format?

Yes. Name the platform, the load file format and the tasks your team keeps, and we will confirm compatibility, transfer methods and responsibilities before collection begins, so the device data arrives ready for review.

Talk with an examiner

Preserve Device Records Before the Next Deadline

Tell us which phones or computers hold the requested records and whether custodians can assist. We will discuss remote collection, an onsite visit or a laboratory handoff and the preservation steps each device needs.

GDF has operated since 1992 and provides court tested forensic expertise.

Talk with an examiner

Send the Device List Before the Phone Changes

On the first call a senior examiner reviews the device models, accounts and applications in scope, says which devices can be collected remotely and which need a visit or the lab, and sets out what each method will return. The consultation is free.

Call (800) 868-8189 Get a Free Consultation

For mobile and endpoint collection, call (800) 868-8189.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.