Forensic Collections Guide 2026

Collections have changed. GenAI evidence, modern cloud attachments, encrypted mobile data. This guide covers what broke in 2025 and what your team needs to do differently in 2026.

Defensible collection in 2026 means more than keeping up with cloud and chat. Your team is now dealing with GenAI evidence that carries hallucinated metadata, modern attachments that live in SharePoint instead of the email, and mobile data locked behind encryption and MDM policies. If your collection playbook has not changed in the last year, this guide will show you where the gaps are and what to do about them.

In This Guide, You’ll Learn

1. How to collect evidence from generative AI platforms (Microsoft Copilot, Google Gemini, ChatGPT) while preserving forensic integrity and flagging hallucinated metadata.

2. The modern attachment problem: why links shared via SharePoint and OneDrive break traditional email collection, and how to capture the full picture using Microsoft Purview.

3. Defensible collection workflows for Google Workspace, Microsoft 365, Slack, and social media platforms, with platform-specific recommendations for each.

4. Mobile device collection strategies: physical extraction vs. full file system vs. selective remote collection, and when to use each.

5. How Lineal’s forensic collection team applies these methods across 5 continents with tools like Cellebrite, Purview, and Google Vault.