What a standard export captures — and misses
A standard export typically pulls the visible content of an account or folder. It may not capture metadata reliably, it may alter timestamps, and it rarely records how the data was obtained. If anyone later asks how the data was collected or whether it is complete, there may be no answer on record.
For low-stakes internal use, that can be acceptable. For disclosure in litigation, or evidence in an investigation, gaps in metadata and process can become a problem.
What makes a collection defensible
A defensible collection preserves the original data, captures relevant metadata, and records the process used. Hash values are calculated so the integrity of the data can be verified later. Collection notes record what was taken, when, by whom and how. The aim is that the collection could be explained and, if necessary, repeated.
Defensibility does not always mean a full forensic image of every device. Often a targeted, proportionate collection is appropriate — but it is still done in a way that is documented and verifiable.
Why the difference matters
If the integrity or completeness of collected data is challenged, a defensible process gives a clear answer. Hash verification shows the data has not changed. Collection notes show what was done. Without those, a party may struggle to respond to allegations of spoliation, gaps or alteration.
Proportionality also matters. UK disclosure expects parties to act reasonably and proportionately. A defensible collection can be scoped tightly while still being sound.
Key takeaways
- Standard exports often lose metadata and leave no record of process.
- Defensible collection preserves data, captures metadata and documents the method.
- Hash verification lets the integrity of collected data be checked later.
- Defensible does not mean disproportionate — collection can be targeted and still sound.
Frequently asked questions
Is a forensic image always required?
No. A targeted collection is often proportionate. What matters is that whatever is collected is preserved, verifiable and documented.
Can a standard IT export be used in disclosure?
Sometimes, but it carries more risk. If completeness or integrity is challenged, a documented defensible collection is far easier to stand behind.
What records should a collection produce?
At minimum: what was collected, when, by whom, how, and hash values that allow integrity to be verified.
Discuss your matter in confidence
Speak to an eDiscovery specialist about forensic collection, processing and review support for your case.
Request a Confidential Consultation