A defensible matter can be compromised long before document review begins. The legal data collection workflow guide below is designed for counsel, litigation support teams, and legal operations professionals who need to preserve relevant information without altering it, losing context, or creating chain-of-custody questions that surface later in discovery.
Collection is not simply a technical handoff. It is the point where legal obligations, information governance, employee cooperation, security controls, and evidentiary reliability meet. A workflow that is clear before the first device is touched gives the legal team control over scope, timing, cost, and risk.
Start With Scope, Custodians, and Preservation Duties
Before collecting data, define what the matter requires. Counsel should identify the claims, relevant time periods, likely custodians, key communication channels, repositories, and data sources that may contain discoverable information. This includes obvious enterprise systems such as Microsoft 365, Google Workspace, shared drives, and email archives, but it may also include text messages, iPhones, personal devices used for work, collaboration platforms, cloud storage, network shares, paper files, and legacy systems.
The legal hold should be tailored to the matter and issued promptly. A broad hold may be appropriate at the outset, but it should not become an excuse for indiscriminate collection. Overcollection increases hosting, processing, and review costs while introducing privacy and proportionality concerns. Undercollection creates a more serious problem: a gap that opposing counsel, regulators, or a court may view as a failure to preserve.
A practical scoping discussion should establish who has authority to make collection decisions, what information is potentially relevant, whether data is likely to be volatile, and whether any source presents special access or privacy issues. Document those decisions. A written collection plan does not eliminate judgment calls, but it shows that the team used a reasoned, repeatable process.
Build the Legal Data Collection Workflow Before Capture
The strongest legal data collection workflow assigns ownership at every stage. Counsel directs legal scope. IT or system owners provide access and technical context. A qualified forensic or eDiscovery provider performs collection according to documented procedures. Litigation support tracks inventories, exceptions, processing status, and delivery to review.
At minimum, the workflow should answer four operational questions: What will be collected? Who will collect it? How will the original source be preserved? Where will the resulting data be stored and tracked?
For each custodian or source, create a collection record that identifies the matter, custodian, data type, date range, collection method, collector, date and time, device or account identifier, and destination media or repository. If access is delayed, a device cannot be located, a password is unavailable, or a source contains personal or regulated information, record the exception and the resolution effort. Exceptions are part of the record, not administrative noise.
Use the Right Method for the Source
Collection method should fit the data source and the legal need. A targeted export from a cloud email environment may be appropriate when account-level metadata and mailbox structure can be retained. A forensic image may be warranted where deleted files, system artifacts, local user activity, or authenticity questions matter. For a mobile device, a logical, file-system, or full forensic extraction may be available depending on the device model, operating system, encryption status, and consent or authority to collect.
There is no universal “best” collection. A full image can preserve more context, but it can also collect substantial irrelevant or personal data. A narrowly targeted export can reduce volume, but may omit artifacts needed to answer later questions. The correct choice depends on the allegations, proportionality, technical feasibility, and anticipated dispute.
Email and mobile communications deserve particular attention because they are often central to modern disputes. Screenshots and forwarded messages may be useful for a quick factual assessment, but they are generally not a substitute for defensible collection. They can omit metadata, conversation context, attachments, or information needed to establish authenticity. When the matter is high stakes, collect from the original account, device, or authoritative system whenever possible.
Preserve Chain of Custody and Data Integrity
A chain of custody should make it possible to account for evidence from source to review platform and production. It should show who possessed the device or data, when it changed hands, what was done to it, and where it was stored. This is especially important for phones, removable media, employee laptops, and physical records that move between locations.
Forensically sound collection procedures reduce the risk of changing source evidence. Depending on the collection type, this can include documenting device condition, using appropriate write-protection methods, generating hash values, preserving original media, and validating copies against collected data. Hash values do not solve every evidentiary question, but they provide a useful integrity check when files or images are transferred and processed.
Security is equally important. Sensitive collections may contain privileged communications, trade secrets, health information, financial records, employee personal information, or government-regulated data. Limit access to personnel with a defined role, use secure transfer methods, maintain controlled storage, and confirm that retention and deletion procedures match the engagement requirements. Bonded and insured providers with established handling protocols offer an added layer of confidence when the source material is sensitive or the collection must occur on an accelerated schedule.
Process Data Without Losing What Makes It Usable
Collection is only valuable if the data is usable in review and production. After capture, data typically moves through intake, virus scanning, de-duplication, metadata extraction, text extraction, OCR, date filtering, culling, and loading into a review environment. Each step should be documented well enough to explain what was done and to reproduce the result if needed.
Do not assume that all collected files are searchable. Scanned paper records, image-only PDFs, photographed documents, handwritten notes, and poor-quality faxes may require OCR. Quality control matters here. A flawed scan or weak OCR result can make relevant material effectively invisible to keyword searches. For paper-heavy matters, the physical workflow should connect directly to the electronic workflow: secure pickup or onsite scanning, document preparation, image quality review, Bates labeling where appropriate, and loading into the designated review database.
Native files also require care. Processing choices can affect extracted text, metadata fields, family relationships, spreadsheet handling, and the display of embedded content. Counsel and litigation support should agree on review specifications early, particularly when a matter involves complex Excel files, databases, nonstandard file types, foreign-language materials, or large volumes of communications.
Create a Defensible Handoff to Review
Before data is loaded to an attorney review platform, reconcile the collection inventory against what was received and processed. Confirm that each custodian and source has a status: collected, unavailable, excluded by scope, pending, or escalated. This reconciliation often exposes the most consequential gaps, such as a departed employee’s laptop, an overlooked shared mailbox, or a phone that was replaced during the relevant period.
The review workspace should be organized around the legal questions, not merely the data volume. Apply consistent custodian names, source labels, date fields, confidentiality designations, and family relationships. Set up workflows for privilege review, quality control, issue coding, and escalation of potentially significant documents. If the matter will require productions or trial exhibits, plan ahead for production numbering, redactions, load files, and exhibit-ready formatting.
Concord Document Technologies supports this continuum from forensic collection and email or iPhone capture through scanning, processing, RelativityOne-based review, legal copying, and trial exhibit production. Keeping these functions coordinated helps reduce handoff failures when deadlines are tight and the record must remain defensible.
Treat Collection as an Ongoing Process
A collection plan should be revisited as the matter develops. New custodians emerge, systems change, employees leave, and factual theories narrow or expand. Regular status reviews allow counsel to refine scope while maintaining a documented rationale for what was collected and why.
The best time to solve a collection problem is before a deposition, meet-and-confer, regulatory request, or trial deadline forces the issue. A disciplined workflow gives the legal team something more valuable than a large data set: a clear record that the information was handled carefully, consistently, and with the matter’s real risks in view.
