When it comes to electronic discovery (eDiscovery), how evidence is collected can be just as important as what evidence is collected. Emails, text messages, computers, mobile devices, cloud storage, and business communication platforms all contain potentially relevant electronically stored information (ESI). However, not all electronic evidence can or should be collected using the same method.
For Hawaiʻi law firms handling civil litigation, employment disputes, business investigations, or other matters involving digital evidence, choosing the appropriate collection method can affect cost, efficiency, data integrity, metadata preservation, and defensibility.
Should a law firm request a complete forensic image of a computer? Is exporting relevant emails sufficient? Can employees collect their own documents? What happens when potentially important evidence has been deleted? Understanding the differences can help attorneys make more informed decisions before beginning discovery.
What Is ESI Collection in eDiscovery?
Electronic evidence collection is the process of acquiring potentially relevant electronically stored information from digital sources for preservation, investigation, review, or production. EDRM guidance emphasizes defensible, proportionate, efficient, auditable, and targeted collection. Depending on the matter, relevant information can include:
File creation and modification dates
Email senders, recipients, and timestamps
Original file locations and folder structures
Message attachments and conversation relationships
System-generated metadata
Deleted or hidden information
Evidence integrity and chain-of-custody documentation
The appropriate collection method depends on what information must be preserved and what questions the evidence may need to answer.
1. Forensic Imaging: Creating a Comprehensive Copy of Digital Evidence
Forensic imaging acquires a digital storage device or other supported data source in a manner designed to preserve its contents and support later forensic examination. A full physical or bitstream image of an accessible drive can capture allocated data and areas that may contain deleted file remnants, unallocated space, or other forensic artifacts. Forensic imaging is useful when authenticity, integrity, or completeness may be disputed.
Pros of forensic imaging
May preserve deleted file remnants and other forensic artifacts.
Can support detailed examination of file activity and system history.
Provides a preserved data set for later analysis.
Supports integrity verification through hashing and documentation.
May be valuable when evidence deletion or manipulation is disputed.
Cons of forensic imaging
Can cost more than targeted collection.
May require specialized equipment and trained examiners.
Can capture substantial irrelevant or sensitive information.
May increase storage, processing, and review costs.
May require physical access or downtime.
Full physical acquisition may be unavailable on certain encrypted devices or modern mobile systems.
When to use it
Consider forensic imaging when deletion, employee misconduct, trade secrets, authenticity, or complex digital activity is at issue. A complete forensic image is not automatically necessary for every matter.
2. Targeted or Logical Collection: Collecting Only What Is Needed
Targeted collection focuses on specified files, folders, custodians, dates, or categories rather than an entire device. Logical collection generally acquires accessible files or supported data through an operating system, application, or acquisition tool; it can be broad or targeted.
Pros of targeted collection
Typically faster and less expensive than full forensic imaging.
Reduces unnecessary data collection and processing.
Can minimize exposure to unrelated confidential information.
Often requires less storage.
May suit routine litigation involving known sources.
Cons of targeted collection
May exclude relevant information if scope is too narrow.
Generally does not capture unallocated space or deleted remnants.
May miss hidden, inaccessible, or unexpected sources.
Metadata preservation depends on the method.
May require follow-up collection as the case evolves.
When to use it
Use when relevant custodians, timeframes, and sources are reasonably understood, with a plan to expand the scope if new evidence emerges.
3. Remote Collection: Acquiring Evidence Without Being On-Site
Remote collection acquires information from supported endpoints without requiring an examiner to be physically present. It may use secure connections, endpoint agents, or specialized software.
Pros of remote collection
Reduces travel and on-site logistics.
Supports geographically dispersed custodians.
May reduce business disruption.
Allows centralized management of some workflows.
Cons of remote collection
Depends on network connectivity and endpoint availability.
May require installation or administrative access.
Interrupted connections complicate acquisition.
Not every artifact can be collected remotely.
Requires careful security, integrity, and chain-of-custody controls.
Why it matters in Hawaiʻi
Remote collection may be helpful when evidence is spread across Oʻahu, Maui, Kauaʻi, Hawaiʻi Island, or the continental United States. It is not equivalent to simply emailing files.
4. Cloud and Email Collection: Acquiring Data From Online Platforms
Businesses increasingly store records in Microsoft 365, Google Workspace, cloud drives, and collaboration platforms. Cloud collection may use supported exports, administrative tools, APIs, or specialized connectors.
Pros of cloud collection
Centralized access to supported online records.
May allow custodian, date, or other filtering.
Can reduce device-by-device collection.
May preserve platform metadata through supported exports.
Cons of cloud collection
Capabilities vary by platform and subscription.
Some exports may omit edits, reactions, relationships, or metadata.
Deleted or expired data may be unavailable.
Permissions and retention settings may limit access.
Platform changes can affect acquisition methods.
Why export format matters
A screenshot may capture visible messages but omit attachments, timestamps, edits, and context. Attorneys should evaluate whether the export preserves information necessary to understand and authenticate the records.
5. Mobile Device Collection: Preserving Messages and App Data
Phones may contain messages, photos, call records, and application artifacts. Depending on device, operating system, security, and tool support, examiners may use logical, selective, file-system, or physical methods. Tools such as Cellebrite and Magnet AXIOM may assist with supported data.
Pros of mobile device collection
Can capture communications and associated artifacts.
May preserve metadata absent from screenshots.
Can support analysis of applications and message relationships.
Some methods may access deleted or otherwise inaccessible artifacts.
Cons of mobile device collection
Encryption and OS restrictions can limit access.
May require credentials or specialized equipment.
Full physical acquisition is not available for all devices.
May expose sensitive unrelated personal information.
Live device data can change during acquisition.
Deleted messages are not always recoverable.
Example
If parties dispute the completeness of text-message screenshots, forensic examination may identify additional messages, attachments, or timestamps, depending on the available data. It cannot guarantee recovery or authenticity in every case.
6. Custodian Self-Collection: When Employees Gather Their Own Documents
Custodian self-collection occurs when employees or clients locate and gather their own potentially relevant records. It may be suitable for narrow, straightforward requests, but depends heavily on instructions and oversight.
Pros of custodian self-collection
Low immediate cost.
Can be relatively quick.
Uses custodians’ knowledge of their own records.
May be practical for small, low-risk matters.
Cons of custodian self-collection
Custodians may overlook relevant records.
Copying can alter metadata.
Procedures may be inconsistent.
Chain-of-custody documentation may be incomplete.
Completeness can be difficult to demonstrate.
Is it defensible?
Self-collection is not inherently improper. Its suitability depends on risk, the importance of metadata, possible deletion, and attorney oversight. Trained collection personnel may be preferable where authenticity is contested.
7. Live Collection: Preserving Information That May Disappear
Some data is volatile and may disappear when a system is shut down or restarted, including information in RAM, running processes, and certain temporary artifacts. Live collection acquires information while a system remains powered on.
Pros of live collection
Can preserve certain volatile information.
May reveal active processes and connections.
Can support incident response and complex investigations.
May access certain information in a decrypted state.
Cons of live collection
The acquisition itself may alter system data.
Requires specialized expertise and documentation.
May introduce operational risks.
Is often unnecessary for ordinary document discovery.
When to use it
Live collection is more commonly relevant to specialized forensic investigations than routine document production.
How Should Hawaiʻi Law Firms Choose the Right Method?
Before collecting evidence, attorneys should assess what is relevant, whether deletion or manipulation is suspected, the importance of metadata, costs and proportionality, and whether the collection can be explained and verified. Teams should document what was collected, how it was acquired, limitations, and integrity controls.
Why Proper Evidence Collection Matters in Hawaiʻi Litigation
Collection is not merely a technical task. A narrow or poorly documented collection may omit evidence or raise authenticity questions; an unnecessarily broad one may increase costs and expose sensitive unrelated information. Hawaiʻi civil discovery rules address electronically stored information. Counsel should consider applicable rules, orders, and case-specific obligations when selecting methods.
The Bottom Line: Collect the Right Evidence, the Right Way
Effective eDiscovery does not always require collecting everything. Some matters call for targeted exports; others require forensic imaging, mobile examination, remote acquisition, or cloud collection. The key is knowing what each method can capture, what it may miss, and whether it fits the case. The goal is reliable, proportionate, and defensible evidence collection.
Sources and Further Reading
EDRM — Collection Guide: https://edrm.net/resources/frameworks-and-standards/edrm-model/collection/
EDRM — Collection Standards: https://edrm.net/resources/frameworks-and-standards/edrm-model/edrm-stages-standards/edrm-collection-standards/
NIST — Digital Investigation Techniques: A Scientific Foundation Review: https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8354.pdf
SWGDE — Best Practices for Digital Evidence Collection: https://www.swgde.org/documents/published-complete-listing/18-f-002-2-0/
SWGDE — Remote Collection of Digital Evidence: https://www.swgde.org/documents/published-complete-listing/22-f-003-best-practices-for-remote-collection-of-digital-evidence-from-an-endpoint/
The Sedona Principles, Third Edition: https://www.thesedonaconference.org/sites/default/files/Recommended-03_TSC_Principles_Addressing_Electronic_Document-Production-Third%20Edition.pdf
This article is for educational purposes and does not constitute legal advice. Collection methods should be selected according to applicable legal requirements, technical circumstances, and case-specific needs.