Collection. Forensic, hash-verified, ACPO-aligned.
Collection is where the matter either acquires evidence-grade material or acquires a future argument about how the material was handled. Both outcomes are possible, and only one is useful.
- Phase
- 03 of 06
- Discipline
- Collection
- Standard
- ACPO · ISO 27001
Plate · CollectionEvidence-grade acquisition, by source.
There is no single collection method. For remote endpoints we deploy Magnet Axiom Cyber and Magnet Nexus, which collect Windows, Mac and Linux systems - plus cloud workspaces such as Office 365, OneDrive, Google Workspace, Box, Dropbox and Slack - without the device leaving the user's desk or the data leaving the jurisdiction. For on-site or offline sources we use EnCase, FTK, X-Ways, Cellebrite and Magnet AXIOM. Native forensic connectors for cloud tenants preserve audit context, chat platform API capture keeps participant metadata intact, and mobile device extractions are handled through appropriate tooling. We match method to source, document the choice, and hash-verify the output.
The distinction between a forensic collection and an administrative export is not academic. A drag-and-drop from a mailbox, a self-service download from a cloud tenant, or an IT-led PST export changes metadata, breaks message-thread integrity and leaves no record of who did what, when, from which system.
Every collection on our matters is performed by a trained examiner using tooling appropriate to the source, recorded at the point of capture, and hash-verified before it leaves the practitioner's custody. The methodology is the evidence.
How collection runs on our matters.
- 01
Endpoint & server
EnCase, FTK and X-Ways for laptops, desktops and servers. Logical acquisition where scope permits, full physical imaging where it does not. Live acquisition supported for systems that cannot be taken down.
- 02
Mobile devices
Cellebrite Premium, GrayKey and Magnet AXIOM. Full file-system extraction where the device supports it, logical extraction where it does not, with the choice recorded and justified.
- 03
Cloud & collaboration
M365, Google Workspace, Slack, Teams, Box, Dropbox and the long tail of SaaS. Native forensic connectors preserve metadata, thread structure and audit-log context. No screen-scraping.
- 04
Structured data
Databases and line-of-business systems collected via schema-aware export, with referential integrity and lineage preserved for later reconstruction.
- 05
Hashing & verification
SHA-256 at acquisition, verified on write, verified on transfer, verified on ingest into the review platform. Any deviation is investigated before the material is used.
- 06
Chain of custody
Signed acquisition notes, examiner identity, device serials, timestamps, tool versions and hash values recorded on a per-item basis. The custody log is a working document, not a form filled in at the end.
What collection produces.
What arrives at the end of the phase, in a form the next phase, or a court, can rely on.
- Forensic images or evidence-grade exports for each source
- SHA-256 hash log verified at acquisition and on transfer
- Signed acquisition notes with examiner, tooling and timestamps
- Chain-of-custody register maintained per item
- Contemporaneous notes suitable for later expert reporting
- Encrypted, tracked transport of physical media where relevant
Where collection goes wrong.
The recurring pattern is a collection done for speed rather than defensibility. A mailbox is exported as PST by an administrator with no chain of custody. A laptop is copied file-by-file over the network. A phone is backed up to iCloud and the backup treated as the evidence. Each of these looks efficient in the moment and becomes an expensive problem when the methodology is questioned. Our answer is straightforward. The collection is done once, properly, by someone who can give evidence on how it was done.
Continue through the workflow.
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.