Guide
Remote Employee Collection
17 pages · 25 min read
Remote employee collection is now the ordinary case for e-discovery.
- Forensic collection and imaging
- Employment and departing employees
§ Guide
Remote Employee Collection
This guide explains how to preserve and collect evidence from devices that cannot be physically accessed, a common challenge in modern e-discovery.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 17 pages · 25 min read · Published 2026-08-31
The collection of electronically stored information from remote employees presents unique challenges for UK litigators, in-house counsel, and investigators. When evidence resides on a device that cannot be physically reached, traditional forensic collection methods are often impractical or impossible. This scenario has become the ordinary case, requiring careful consideration of how to defensibly obtain necessary data while navigating issues such as custodian cooperation, data protection, and technical limitations.
This guide sets out the methods available for remote collection, including the use of agents, cloud-side collection, supervised self-collection, and shipped media. It provides a framework for choosing the appropriate method based on factors like cooperation, completeness, control, and risk. The guide also addresses critical aspects of defensibility, such as maintaining a full chain of custody, verifying data integrity, and managing reluctant custodians. Furthermore, it explores data protection and privacy concerns, particularly when dealing with personal devices, and examines where else relevant evidence might reside within an organisation's source architecture.
By following the principles and practical advice within this guide, practitioners can confidently approach remote employee collection. It offers insights into preserving devices the moment a duty arises, understanding common mistakes, and identifying red flags that signal when to involve a digital forensic expert. The guide includes questions to ask various parties and suggested wording for instructions, enabling a structured and defensible approach to collecting evidence from remote employees, regardless of their location or device ownership.
Share
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. The authority behind this subject is ICO guide to the UK GDPR, which you should read alongside this guide. See every guide's author and source.
§ Read Remote Employee Collection
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
Page 1
REMOTECOLLECTION · A GUIDE FOR UK LAWYERS Remote Employee Collection Preserving and Collecting Evidence From Devices You Cannot Put Your Hands COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM SUPERVISED SELF-COLLECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the evidence is on a device you cannot reach 03 The methods: agents, cloud-side, supervised self-collection and shipped media 04 Choosing the method: cooperation, completeness, control and risk 05 Preserving a device you cannot touch 06 Defensibility: chain of custody, verification and the reluctant custodian 07 Data protection, privacy and personal devices 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: REMOTECOLLECTIONISTHEORDINARYCASENOW, ANDITIS DEFENSIBLEWHENTHEMETHODISMATCHEDTOTHECUSTODIAN ' SCOOPERATIONAND SHIPPEDMEDIA, EACHDOCUMENTED, VERIFIEDANDDATA - MINIMISED, WITHTHE DEVICEPRESERVEDTHEMOMENTTHEDUTYARISES
§ 02 · FIRST PRINCIPLES The problem in plain English: the evidence is on a device you cannot reach
§ 03 · THE METHOD S The methods: agents, cloud-side, supervised self-collection and shipped media
Page 2
§ 04 · CHOOSINGTHEMETHOD Choosing the method: cooperation, completeness, control and risk
§ 05 · PRESERVINGADEVICEYOUCANNOTTOUCH Preserving a device you cannot touch
§ 06 · DEFENSIBILITY Defensibility: chain of custody, verification and the reluctant custodian
§ 07 · DATAPROTECTIONANDPRIVACY Data protection, privacy and personal devices
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION REMOTE + CLOUD CLOUD MANAGEMENT COUNTERPARTIES LOCAL THE MAILBOX SA AS + DEVICE- DELETED / DEVICE DRIVES INFRA PLATFORM ONLY
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECOOPERATIVECUSTODIANANDTHESEQUENCEDCOLLECTION EXAMPLE2 · THEADVERSECUSTODIANWHOWASNEVERALLOWEDTOSELF - COLLECT EXAMPLE3 · THEPERSONALDEVICEANDTHEINDEPENDENTEXAMINER
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or a reluctant custodian) Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAREMOTECOLLECTION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The remote-collection checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can a device be collected forensic all y without anyone touching it? Can we just ask the employee to send us the relevant files? The custodian works from home abroad. Does that change things? How do we collect from a personal device without invading privacy? Is a remote collection as defensible as a bench image? What do we do the moment we know a remote custodian is relevant?
§ 14 · REFERENCE Glossary BYOD Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
§ Related documents
Brochure
Digital Forensics Services
10 pages · 14 min read
A complete guide to how Computer Forensics Lab handles electronic evidence for UK litigation, internal investigations and regulatory work.
- Forensic collection and imaging
- Expert evidence and reports
- Chain of custody and defensibility
Brochure
UK Digital Forensics for US Litigation Teams
6 pages · 8 min read
A capability overview written for US counsel who need evidence that sits in the United Kingdom handled properly, then delivered into the review workflow their firm already runs.
- US litigation support
- Cross-border and data protection
- Forensic collection and imaging
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.