This guide answers how to choose the right depth of acquisition for forensic collection, source by source.
Guide · 19 pages · 26 min read · Published 2026-08-30
UK legal practitioners frequently face a false binary when managing e-discovery, trapped between ordering exhaustive physical imaging or opting for lightweight collections that risk missing vital digital evidence. Written specifically for solicitors and legal teams navigating disclosure obligations, this resource dismantles that misconception by evaluating three distinct acquisition depths: forensic physical imaging, logical extraction, and targeted collection. It establishes how to select the correct collection method source by source, balancing cost and proportionality while ensuring full chain of custody documentation and preserving the option to go deeper if required. Across its detailed sections, the text covers side by side comparisons, decision trees, honest risk registers, and real world worked examples. It provides practical drafting aids for disclosure documents, tailored interrogatories to put to clients, opponents, or service providers, and clear checklists identifying technical limitations and red flags. By addressing method selection, cost consequences, and scenarios requiring specialist digital forensic laboratory involvement, it equips lawyers to justify their evidence gathering strategies or challenge flawed methodologies deployed by opposing parties.
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
19 pages · 26 min read
This guide for UK lawyers addresses the critical decision of forensic collection methods: forensic image, logical extraction, or targeted collection.
Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. The authority behind this subject is ACPO/NPCC Good Practice Guide for Digital Evidence, which you should read alongside this guide. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
COLLECTION METHOD S · A GUIDE FOR UK LAWYERS Forensic Image, Logical Extraction or Targeted Collection? Choosing the Right Depth of Acquisition, Source by Source COMPUTER FORENSICS LAB · E-DISCOVERY. UK
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a false binary 03 The three methods, properly defined 04 The comparison table 05 Matching method to evidential need 06 Cost and proportionality: the chain consequences 07 The decision tree 08 The honest risk register of each method 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DEPTHISCHOSENPERSOURCE, ANDTHEOPTIONTOGODEEPER ISPRESERVED
§ 02 · FIRST PRINCIPLES The problem in plain English: a false binary
§ 03 · TERMSOFART The three methods, properly defined Forensic (physical) image Logical extraction Targeted collection
§ 04 · SIDEBYSIDE The comparison table FORENSIC IMAGE LOGICAL EXTRACTION TARGETED COLLECTION
§ 05 · FIT Matching method to evidential need
§ 06 · THEMONEY Cost and proportionality: the chain consequences
§ 07 · THEDECISION The decision tree
§ 08 · HONESTLEDGER The honest risk register of each method Forensic image
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEHYBRIDTHATFITTEDTHECASE EXAMPLE2 · THEBLANKETINSTRUCTION EXAMPLE3 · THETRIGGERTHATFIRED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION PA R AG RAPH ( METHOD PER SOURCE WITH TRIGGERS ) SUGGESTED WORDING · DRD / CORRESPONDENCE PA R AG RAPHEXPLAININGAMIXED APPR OAC H
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The method-selection checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Is targeted collection defensible, or will we be criticised for not imaging? Can we start light and upgrade to imaging later if needed? Do we need to image every custodian's laptop? How do phones fit this framework? Roughly what does each method cost? What should we do when the other side chose the wrong method for a contested source?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
10 pages · 14 min read
A complete guide to how Computer Forensics Lab handles electronic evidence for UK litigation, internal investigations and regulatory work.
6 pages · 8 min read
A capability overview written for US counsel who need evidence that sits in the United Kingdom handled properly, then delivered into the review workflow their firm already runs.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
