The evidentiary value of electronic material depends on how it was collected. Self-collection by custodians is the most common and most damaging shortcut.

Preservation first. A litigation hold to identified custodians, suspension of automatic deletion, and a documented instruction to IT. The hold should be acknowledged, tracked and reissued periodically.

Sources to map. Email and its archives; file shares; endpoint devices; mobile devices, including messaging applications; collaboration platforms; cloud storage; ticketing and CRM systems; badge and access logs; and structured databases. Each has a different collection method and retention profile.

Forensic imaging preserves metadata, deleted content and system artefacts. It is warranted where the conduct itself may involve concealment, or where device activity is at issue.

Chain of custody. Contemporaneous records of who collected what, when, from where, and how it was verified. Hash values at collection make later authentication straightforward.

Personal devices. Where work is done on them, collection raises consent, privacy and, for multinational operations, data protection questions that should be resolved before any device is taken.

Cross-border. Transferring personal data out of certain jurisdictions for review requires a lawful basis, and blocking statutes in some countries constrain production to foreign authorities entirely.