Collection & Preservation

Aim: Establish the collection methodology for acquiring ESI and protect it in ways that are legally defensible, reasonable, proportionate, efficient, auditable, broad but tailored and that mitigate risk.

Collection is the acquisition of potentially relevant electronically stored information (ESI) as defined in the identification phase. Today’s dispute resolution and investigation matters necessitate the collection of ESI and its associated metadata in a manner that is legally defensible, proportionate, efficient, auditable, repeatable and targeted. Collection and identification of ESI are not isolated processes; rather, one may impact and expand the other in an iterative process, which our team has vast experience in providing advice to ensure best practices are adhered to.

Apogee Forensic Technology and eDisclosure

At Apogee, we capture all potentially relevant ESI and then interrogate it to determine its relevance to the investigation. We have the ability to collect anything from a single computer, to a complex IT system or combination of systems, a smart phone or a tablet. All accessible material, including files and folders, deleted files, internet activity and other system files that can be used to determine user activity is incorporated into our investigation.

In order to disclose documents for any purpose, a reasonable search must first take place. Apogee’s team of experts is highly experienced in advising the types of searches which can be most reasonable and, critically, efficient – both from a time and cost perspective. The collection process must be conducted in such a way that facilitates such searching and, importantly, does not change the ESI’s metadata. Oftentimes, a collection can go awry if conducted by people without the necessary skillset.

Often, a collection can be as straightforward as receiving monthly backup tapes from a client’s email server. However it is usually more complex, requiring accredited and experienced experts. Apogee’s team has conducted a wide array of complex, cross-jurisdictional collections covering the globe.

All collections conducted by our team adhere to the Association of Chief Police Officers’ (ACPO) guidelines on digital evidence. Failure to collect evidence in the proper manner can result in it being deemed inadmissible and our experts’ thorough knowledge of both IT and court procedure ensures this never happens. We will make sure there is a complete chain of custody and all media and devices collected by us will be stored in appropriate tamper-proof evidence bags. For any purpose, whether that be to support an EDQ or to report to the end client, we can provide detailed reports on the entire collection process.

The Apogee team are certified in the latest forensic and collection techniques:

Apogee FTE-cdactCDaCT – is a certification in securing, collecting, acquiring and the preserving of digital evidence by getting a practical understanding of the legalities, best practice and current techniques used for cyber investigations, eDisclosure, or other regulatory proceedings in accordance with ISO 27037.

Apogee FTE - CFIPCFIP – is a certification to gain an understanding of digital forensics analysis by learning about forensic principles, evidence continuity and methodology to employ when conducting a digital forensic investigation.


The first point in which preservation comes into play is when a hold notice should be sent to all departments concerned with where potential ESI may exist. There is a duty to use a hold notice so that electronically stored information is promptly isolated and the potentially relevant data is protected. Apogee can help you make sure that the hold data has been preserved in a legally defensible manner, that the volumes are proportionate to the matter, audit trails are maintained and so that the risks are diminished.

Apogee utilises Relativity’s Legal Hold functionality to allow you to easily create every email, hold notice, questionnaire, and acknowledgment from scratch or based on existing templates. That includes reminders and prompts for next actions which can be automatically sent to custodians or escalated to managers based on response time or their questionnaire answers.

With Legal Hold, you can manage multiple holds simultaneously, set up repeatable workflows, and create a variety of project types that meet your organisation’s needs, from Legal to IT to HR. Legal Hold also integrates with HR systems, so you can add and track custodians and retain all correspondence in a single repository, creating a centralised process and eliminating the need for disparate software.

Built-in reports and dashboards track holds from beginning to end, helping you gauge the status of your legal holds at a glance. You can track and analyse responses either by question or custodian, monitor a custodian portal of ongoing preservation obligations, gain insight into the scope of each matter, decide when to escalate your communications, and drill into questionnaire responses.

The second phase of preservation comes during the forensic collection. All ESI that Apogee collect is maintained in forensic containers, meaning that data collected is preserved in that moment in time and is a true copy of the original data. This ensures that the collection of the ESI is legally defensible, repeatable and auditable.