Question 1

Will a court criticise us for not imaging everything?

Accepted Answer

Not for narrowing; for narrowing badly. The disclosure regime expects proportionate scope, and a targeted collection with recorded criteria, forensic method, manifests and a preservation backstop is the compliant posture, not a concession. Criticism attaches to the other version: undocumented selection, degraded method, contested sources gone: which is a records failure wearing proportionality's clothes.

Question 2

Is it safer to image everything if the client will pay?

Accepted Answer

Safer against the missed-source risk, yes; but it buys new exposure: cost that may be disallowed as disproportionate, months of delay, a data-protection posture that is hard to defend, and a review mountain that degrades accuracy. The optimum for most matters is the §8 pattern: broad preservation, narrow collection: which delivers full-image safety on the sources that need it at targeted-collection cost overall.

Question 3

Can we use keyword filters to reduce what we collect?

Accepted Answer

Sparingly and late: prefer container-and-date scope at collection, and apply terms at processing where they can be tested, iterated and reported. Where collection-time filter in g is genuinely required (a third party will only export matches; a court order specifies terms), treat the term set as a negotiated instrument, test it on a sample first, and record that families and near-misses outside the filter were never collected, so nobody later mistakes the boundary for the universe.

Question 4

What if we discover mid-case that our criteria missed something?

Accepted Answer

Amend and collect: scope revision on new information is the system working, and the amendment trail is evidence of good faith rather than an admission. The cost turns on two earlier decisions: whether the source was preserved (backstop or organisational resilience), and whether the original criteria were recorded, so the miss reads as a reasoned boundary honestly revised rather than a hole in an undocumented net. Example 2 is the case study, costs consequence included.

Question 5

How do we challenge an opponent whose "targeted collection" looks like cherry-picking?

Accepted Answer

Ask for the records this guide would have produced: criteria and rationale, protocol section, interview basis, exclusions, manifests, sampling, preservation position. Cherry-picking and principled targeting are indistinguishable from outside and completely distinguishable on paper; a party that cannot produce the paper has answered the question. Frame relief accordingly: specific disclosure of the excluded categories, or collection from the preserved layer their answers reveal (or reveal to be missing).

Question 6

Does targeted collection satisfy our preservation duty by itself?

Accepted Answer

No: preservation and collection are different duties on different timetables. The hold and its suspension of deletion mechanisms cover the estate; collection then takes what the criteria select. Targeting the collection while the hold quietly lapses else where is how the §5 blind spots become permanent; the protocol should state both layers, and the DRD's preservation section should describe the hold, not the collection, as the answer to "what has been preserved?". cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 16 of 18

Can We Collect Only Relevant Data Instead Of Imaging Everything