Beyond the Hard Drive

Digital forensic collection was once closely associated with securing a computer, creating a forensic image and examining the data stored on its drives. Those techniques remain essential, but they no longer tell the whole story. Business records now span cloud platforms, mobile applications, shared workspaces and conversations designed to disappear. Acquiring the device is now only the starting point. The harder work is identifying where evidence exists, understanding how it changes and preserving enough context to explain what actually happened.

From device-centric to evidence-centric

A laptop can provide valuable evidence of user activity without containing complete copies of the documents or communications that matter. A locally synchronised folder may hold only selected files, while browser access can leave limited traces of content held elsewhere. So imaging an endpoint cannot automatically be treated as collecting the user’s entire digital workspace.

Modern collection planning must map people, accounts, devices and services together. Depending on the circumstances, an investigation may require endpoint acquisition alongside authorised cloud exports, mobile collections and relevant audit records. The appropriate combination should follow the questions being investigated, rather than a standard instruction to collect everything from the computer.

M365 modern attachments: collecting the relationship

Microsoft 365 modern attachments illustrate this shift. Rather than embedding a separate document in an email or Teams message, users can share a link to a file stored in SharePoint or OneDrive. Collecting the message alone may therefore capture the reference without capturing the underlying evidence.

The linked document can also change after sharing. A spreadsheet collected today might differ materially from the version available when an earlier decision was discussed. Investigators must consider which versions are relevant, whether they remain available and how the document connects to the communication.

Microsoft Purview supports collection options for linked content, including the live version and, in supported circumstances, the version shared. However, availability and extraction are subject to platform limitations. A defensible workflow should validate the selected approach, record exceptions and preserve message-to-document relationships through processing and review. A successful export is not, by itself, proof that every linked file or relevant version was collected.

Ephemeral messaging: when timing becomes critical

Ephemeral messaging introduces a different pressure: evidence may have a deliberately short lifespan. Applications with disappearing-message features can remove content after a configured interval, making preservation decisions time-sensitive. Signal, for example, describes different timer triggers for sent and received messages, demonstrating why assumptions about a single universal expiry period are unsafe.

The response must be platform-specific. Investigators need to establish which applications were used, whether disappearing messages were enabled, what devices were linked and what data remains accessible through supported methods based on mobile device model and operating system.

Disappearing from an application does not always mean disappearing from every evidence source. In Teams, appropriately configured retention can preserve certain edited or deleted message data for compliance searches, even when users no longer see it. That is different from recovering expired content from an application without equivalent retention capabilities. Neither universal recoverability nor universal destruction should be assumed.

Mobile devices: security changes the collection plan

Mobile devices present another evolving challenge. A smartphone is both an evidence source and a gateway to cloud accounts, business applications and messaging platforms. Collection coverage depends on the device model, operating system, security state, application behaviour and available acquisition method. A backup or logical collection should not automatically be described as a complete copy of the phone.

Apple’s Stolen Device Protection illustrates how stronger security changes collection planning. Available from iOS 17.3, it requires Face ID or Touch ID, without a passcode fallback, for certain sensitive actions. Some security changes require an hour’s delay followed by a second biometric authentication. These protections normally apply away from familiar locations, but can be configured to apply everywhere. Knowing the passcode therefore does not guarantee access to every function needed for a proposed workflow.

For authorised forensic collections, this means assessing requirements before the appointment, arranging the device owner’s availability where appropriate, and allowing for authentication requirements or security delays if protected actions are necessary. Stolen Device Protection should not be treated as a blanket barrier to every acquisition method: its practical impact depends on the device configuration and proposed technique.

Defensibility requires more than acquisition

As collection methods diversify, documentation matters even more. Examiners should record the source, scope, permissions, tools, settings, collection times and known limitations. Hash values help demonstrate that acquired files have not changed, but cannot establish that an export was complete or that a linked document represents its historical state.

Validation must therefore consider both integrity and coverage. Were the intended accounts and locations included? Were linked files resolved? Were relevant versions available? Did errors, unsupported content or retention gaps affect the result? Clear answers allow legal teams to distinguish what the evidence demonstrates from what remains uncertain.

The principle remains; the approach must evolve

The fundamentals of digital forensics have not changed: preserve evidence, maintain integrity and explain findings transparently. What has changed is the environment in which those principles must operate. Modern collections require earlier collaboration between legal, IT and forensic specialists, supported by platform knowledge and tested workflows, so the right evidence, its relationships and its limitations are preserved before technology changes the picture again.

How Lineal can help

Lineal’s forensic team plans and runs collections across endpoints, cloud platforms and mobile devices in the U.S., EMEA, APAC and Brazil, with documented scope, validation and known limitations at every step. Once the evidence is preserved, Pepper, Lineal’s AI-powered investigation platform, brings it together from wherever it lives so investigators can start with the question rather than the data set. To plan a collection before the next matter starts, download our Forensic Collections Guide 2026.

__

About Author

Laura Herbert is an accomplished digital forensics examiner, currently serving as Vice President of Shared Services & Forensics at Lineal. With extensive experience overseeing global forensic operations, complex investigations, and eDiscovery delivery, she has built her career across corporate, legal, and incident‑response environments. Laura’s background spans hands‑on forensic analysis, major incident response, and leading high‑performing teams to deliver innovative, defensible solutions for clients worldwide. Recognised for her operational leadership and deep technical expertise, she is committed to advancing high‑quality forensic services while driving collaboration, efficiency, and excellence across the organisation.

__

About Lineal 

Lineal is an innovative eDiscovery and legal technology solutions company that empowers law firms and corporations with modern data management and review strategies. Established in 2009, Lineal specializes in comprehensive eDiscovery services, leveraging its proprietary technology suite, AmplifyAI™ to enhance efficiency and accuracy in handling large volumes of electronic data. With a global presence and a team of experienced professionals, Lineal is dedicated to delivering custom-tailored solutions that drive optimal legal outcomes for its clients. For more information, visit lineal.com