Question 1

Is a protocol really necessary for a small, single-device matter?

Accepted Answer

At one page, yes: source, method, hashing, custody, the encryption contingency, and who decides surprises. The habit standardises quality, the page takes twenty minutes, and small matters have a way of growing: the one- page protocol from month one reads very well in the witness box of month eighteen. What scales with matter size is the document's depth, never the existence of the discipline.

Question 2

Should we show our collection protocol to the other side?

Accepted Answer

Usually, and often before execution: methodology is process-plane material (per this series' cooperation guide), exchanging it forecloses later disputes cheaply, and the cover letter's "observations before execution rather than after" framing shifts the burden of silence onto them. Hold back only genuinely strategic elements (which sources you consider contested, escalation reasoning that reveals theory), which belong in a privileged annex rather than the exchanged body.

Question 3

What is the difference between the collection protocol and the DRD's methodology sections?

Accepted Answer

Sequence and status: the protocol is the operational instrument, written first, at full technical depth, and executed against; the DRD summarises it for the court at the level PD 57AD requires. Writing the protocol first means the DRD reports a designed exercise rather than promising an undesigned one, and when the DRD is questioned, the protocol and its execution record are the annexes that answer.

Question 4

Can the client's IT team execute parts of the protocol to save cost?

Accepted Answer

Yes, under the hybrid conditions of Example 3: examiner-written per-source methods, training and a supervised first run, provided verification tooling, manifests, sample re-collection, and daily deviation reporting. Without those, in-house collection is the cheapest way to buy the most expensive problem; with them, it is a legitimate proportionality tool the protocol makes visible and defensible.

Question 5

What happens when execution has to depart from the protocol?

Accepted Answer

It departs, in the open: the deviation is logged (what, why, who decided, when), material departures are made as amendments approved by the named owners, and the collection report reconciles plan against execution including every delta. Deviations are expected and survivable; drift is not: the difference is whether the departure has an entry, a decider and a reason, or is discovered by comparison two years later.

Question 6

Who signs off the protocol, and does the client need to?

Accepted Answer

The instructing lawyer (scope, privilege, legal basis) and the executing examiner (method, feasibility) must; the client signs where its people perform steps, where business disruption is authorised, or where the protocol embodies its UK GDPR decisions, which in corporate collections it usually does. Signature blocks are not ceremony: they are the answer, two years on, to "who approved this?", and the protocol exists to make that answer boring. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 17 of 20

Preparing A Forensic Collection Protocol