What Counsel Should Preserve Before a Forensic Collection

Forensic collection is often treated as the first technical step. In reality, the most important decisions may occur before an examiner touches a device. A phone can continue synchronizing, a laptop can install updates, a messaging platform can age out data, and an administrator can change an account configuration. Preservation should begin with a controlled decision about what must remain available and what ordinary activity should stop.

1. Preserve the source—not just a screenshot

Screenshots can be useful for immediate context, but they rarely preserve the underlying record, metadata, attachments, database relationships, or application state. Counsel should identify the original sources: the device, account, mailbox, cloud repository, collaboration workspace, backup, removable media, or system log that may contain the relevant information.

Where a screenshot is necessary, record who captured it, when, from which device or account, what was visible before and after the image, and whether the display may have omitted content. Treat the screenshot as one item of evidence, not a substitute for source preservation.

2. Confirm authority before access or collection

Ownership, custody, administrator rights, employment policies, consent, legal process, contractual rights, and jurisdiction can affect what may be preserved or collected. A company-owned device does not automatically resolve every privacy or access question, and possession of a password does not necessarily establish authority to use it.

Before collection, identify who owns the device or account, who has lawful authority to direct the work, whether consent is voluntary and documented, and whether any protective order, privacy law, employment rule, provider term, or licensing restriction applies. The examiner should receive a clear authority statement and escalation contact.

3. Record the device and account condition

Document the condition that may affect the available data or the collection method. Useful details include:

• Device make, model, visible identifiers, phone number, operating system if known, and physical condition
• Whether the device is powered on, locked, connected to a network, charging, damaged, encrypted, or subject to remote management
• Whether applications are open, messages are disappearing, the account is suspended, or a retention deadline is approaching
• Whether the user continues to use the device or account
• Known passwords or recovery methods—stored through an approved secure process, never in an ordinary intake form or unencrypted email

Do not experiment with passcodes, install software, update the operating system, reset credentials, open unfamiliar applications, or repeatedly connect and disconnect a device without a plan. Those actions can change evidence or trigger security controls.

4. Map related sources

A single communication may exist on a phone, in a cloud account, in the recipient’s account, in an enterprise archive, in a notification database, and in a platform export. A file may exist locally, in a synchronized folder, in version history, in email, and on external storage. Create a simple source map that identifies likely custodians, devices, accounts, systems, date ranges, and administrators.

This source map does not require collecting everything. It allows counsel to separate preservation breadth from collection and review scope. A broad preservation obligation may be satisfied while the initial forensic work remains targeted.

5. Preserve surrounding business records

Technical artifacts are interpreted in context. Preserve records that explain device assignment, account ownership, retention policies, system configuration, remote-management actions, employee status, time-zone settings, provider notices, legal holds, prior collection efforts, and any steps already taken. These records may explain why an artifact exists or why expected data is missing.

6. Establish custody and transfer instructions

Before evidence moves, decide who will package it, where it will go, how the transfer will be documented, and who may receive it. For a physical device, record the date and time, transferor, recipient, condition, packaging, identifiers, and any seal information. For electronic data, record the source, export method, date range, file name, size, checksum when appropriate, transfer channel, and recipient.

7. Define the questions the collection must answer

“Collect the phone” is not a forensic question. Counsel should identify the issues that matter: whether a communication existed, whether a file moved, whether an account accessed a repository, whether an image was created or modified, whether records align with a timeline, or whether an opposing production appears complete.

Clear questions help the examiner select a proportionate acquisition method, avoid unnecessary data, and create a report or review package that fits the litigation plan.

A concise pre-collection checklist

1. Identify all relevant parties, custodians, devices, accounts, and systems.
2. Confirm the legal authority, consent, ownership, and applicable restrictions.
3. Stop avoidable activity that could alter or delete relevant data.
4. Document device, account, network, and application condition.
5. Preserve related policies, notices, logs, and prior collection records.
6. Arrange secure custody, credential handling, and evidence transfer.
7. Define the questions, priority sources, date range, deadline, and desired deliverables.
8. Record decisions not to collect a source and the reason for that decision.

Early preservation does not need to be expensive or broad. It needs to be deliberate. A short consultation before devices are moved or accounts are changed can prevent gaps that no later forensic tool can repair.