Collection
Collection in eDiscovery is the acquisition of potentially relevant electronically stored information from the sources that hold it, done so that the data and its metadata are unchanged, what was taken is recorded, and a hash value proves the copy is complete and unaltered. It follows preservation and precedes processing.
Also called: forensic collection · targeted collection · self-collection · data collection · acquisition
Updated September 9, 2026
How does collection work?
Collection sits between preservation and processing. Preservation stops data being destroyed. Collection takes a copy of it.
The method depends on the source. Cloud and enterprise systems are collected through vendor APIs, which return messages and files with their server-side metadata intact and produce a log of what was requested and returned. Microsoft 365, Google Workspace and Slack all work this way, which has moved most routine collection from a forensic exercise to a scoped export. Local devices are collected either as a targeted copy of named paths or as a full forensic image, depending on whether the device itself is in issue. Mobile devices need a device-specific extraction, because messages sit in application databases rather than files.
Three things are recorded whatever the source: the scope actually collected per custodian, including what was deliberately excluded and why; a hash value computed at acquisition, not later; and a chain of custody entry with the tool, the version, the operator and the time zone.
The reason for that discipline is that collection is the step most often attacked, and the attack is almost never about the copying. It is about scope: which sources were searched, which custodians were left out, and how anyone knows. A collection log answers that. A folder of files does not.
What does collection look like in practice?
A collection scope record for one custodian, of the kind a declaration would later rely on:
| Field | Entry |
|---|---|
| Custodian | Mendez, Jane (Operations Manager) |
| Sources | M365 mailbox, OneDrive, Teams 1:1 and channel messages |
| Excluded | Personal mobile, not company-issued, not used for the matter per interview |
| Date range | 1 January 2023 to 14 March 2024 |
| Method | Microsoft 365 eDiscovery export API, tool version recorded |
| Verification | SHA-256 recorded at acquisition, recomputed and matched on receipt |
The excluded row matters as much as the included ones. A scope that records what was not taken, and why, is the difference between a decision and an omission.
How does collection show up on an eDiscovery invoice?
Collection fees are charged per custodian, per source, or at hourly forensic rates, and this is the line where the market has moved fastest. The Fee Field Guide notes that standard cloud collections are largely API-driven and automated now, so forensic hourly rates applied to routine mailbox pulls deserve scrutiny. Genuine device imaging and mobile extraction remain skilled work and reasonably cost what skilled work costs.
Collection also sets every volume-based fee downstream. A broad collection is the defensible one and the expensive one: every gigabyte taken is a gigabyte that processing is charged on, and, unless culling happens before the meter reads, that recurring hosting is charged on too, for the life of the matter.
Worth asking: what is the rate per custodian and per source, are cloud connectors automated or billed as forensic time, and are the acquisition hashes and custody documentation delivered as part of the collection or as an extra.
Sources
- Fed. R. Civ. P. 26(b)(1) on proportionality, which governs how broadly collection is scoped.
- Fed. R. Evid. 902(14) on certified data copied from an electronic device.
- EDRM, Collection standards and the EDRM model stages.
- The Sedona Conference, Glossary: eDiscovery & Digital Information Management, “collection.”
- NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response.
- Fee structure: the Fee Field Guide dataset.
Related terms
Custodian · Chain of custody · Litigation hold · Hash value · Metadata · Processing
eDiscovery at one flat monthly rate
$3,250 a month on a 12-month agreement. No per-user fees and no per-GB hosting charges.
Common questions
What is self-collection and is it defensible?
Self-collection is a custodian gathering their own documents, usually by copying files into a folder or forwarding emails. It is defensible only where it is supervised, documented and verifiable, and it fails on all three by default: copying rewrites system dates, no acquisition hash is created, and nobody independent can say what was searched or skipped. Courts have criticized unsupervised self-collection where completeness was later challenged, which is why key custodians are normally collected with a tool.
What is the difference between a targeted collection and a forensic image?
A targeted collection takes the sources and date ranges in scope: a mailbox, named folders, a specific device path. A forensic image copies an entire storage device bit for bit, including deleted-file remnants and unallocated space. Targeted is the norm because it is proportionate and far smaller. Full images are for cases where deletion, concealment or device use is itself the issue.
Does collection change metadata?
Done properly, no. Done with drag-and-drop or a plain copy, yes: created and last-accessed dates are commonly rewritten to the moment of the copy, and that metadata is often the evidence. Defensible tools and cloud collection APIs read the data without touching those fields, and record a hash so the copy can be verified against the source afterwards.