Full Imaging versus Targeted Collection Methods in eDiscovery
How to choose between capturing everything and capturing what matters and defending the choice.
Every collection starts with one question: how much of this device or account needs to be collected? The answer drives cost, timeline, privacy exposure, and how well the work holds up if challenged.
Full forensic imaging is a full bit-for-bit copy of the device. It captures active files, deleted files not yet overwritten, unallocated space, and metadata. Targeted collection copies only a defined subset, chosen by custodian, date range, file type, location, or search criria, using tools that preserve metadata. Both can be forensically sound. The difference is scope.
Legal Implications
In eDiscovery, proportionality governs discovery of what is relevant and proportional to the needs of the case, weighing burden against benefit. However, if electronically stored information is lost because a party failed to take reasonable preservation steps, courts can impose sanctions. The standard is reasonable and defensible.
Side-by-Side Comparison
Factor | Full Imaging | Targeted collection |
Scope | Entire device including deleted data | Defined subset |
Speed | Hours to Days per device | Minutes to hours, often remote |
Cost | Higher: more to store, process, review | Lower: smaller review population |
Deleted Data | Captured | Generally, not captured |
Privacy and Privilege Exposure | High | Lower |
Risks | Over-collection, proportionality objections | Does not capture all relevant data, defined subset errors |
Best Uses for Each Method
Full Imaging should be used whenever there is a need to examine file systems, metadata, or unallocated space without altering the original drive's timestamps or access times. Below are some specific examples of when to use full imaging:
Spoliation or Deletion Concerns: If there is a suspicion that data was deleted, wiped, or tampered with, only a full image captures unallocated space, deleted files, and remnants that logical collection misses.
Forensic Questions are Central to the Case: Examples include when a file was created, copied, accessed, or modified. These depend on metadata that targeted collection does not preserve.
Preservation of Key Custodians’ Devices: When a device may hold unique, critical data and is at risk of being lost, reissued, wiped, or replaced, imaging is a cheap insurance policy even if the data is not analyzed immediately.
Data that Cannot be Reliably Collected: Corrupted, encrypted, or non-standard systems, or sources where the metadata fidelity of a logical copy would be questionable.
Chain-of-Custody and Defensibility: A fully imaged device provides an unalterable preserved copy that can be examined repeatedly without touching the original.
Targeted Collection suits routine litigation and regulatory responses with defined custodians and subsets. The key to targeted collections is both parties understanding that the scope of relevant data is reasonably well understood and a full forensic image is not needed to defend the process.
Two cautions apply to targeted work. Keyword culling before collection is risky because terms miss synonyms and misspellings, so validate any filters by sampling. Unsupervised self-collection by custodians can alter or omit data and has drawn judicial criticism. Below are some specific examples of when to use targeted collection:
Proportionality: The claim’s value, the issues, and the likely volume of relevant data do not justify the cost and burden of imaging an entire device. Generally, expect collection efforts to be scaled to the case.
Relevant Data Sources are Known: You can identify where the relevant material lives: a specific email account, a cloud-synced folder, a particular chat app, a project directory, or a defined date range.
Privacy and Sensitivity Concerns Exist: Personal devices, phones with mixed personal and business content, or devices holding privileged, medical, or otherwise sensitive data unrelated to the matter. Targeted collection limits exposure of non-relevant information.
Speed or Logistics Demand It: Remote custodians, tight deadlines, or large numbers of custodians where full imaging each device is impractical. Remote targeted collection tools are common here.
Mobile Devices: Logical or selective collection of specific apps, threads, or date ranges is often the practical approach.
Making the Choice Defensible
Issue a legal hold and preserve early.
Document who decided the scope, why, and what was excluded.
Use qualified personnel and tools that preserve metadata and produce logs.
Keep chain-of-custody records.
Agree on scope with the other side where possible, such as in an ESI protocol.
Understanding what collection tool to use and when is critical to the integrity of a case and the financial management of a client’s resources. Use targeted collection when the issues are well defined, the data locations are known, and proportionality or privacy favors a narrower approach. Move to full imaging when device level evidence, deleted data, or user behavior is at issue. Match the method to the matter, preserve broadly when loss is a real risk, collect narrowly when the issues are clear, and document every decision.
For questions or more information on Legal Eagle’s eDiscovery services please email us at info@legaleagleinc.com or call at 864-467-1373.
Comments