Arlington, Virginia · Washington DC, Maryland & Nationwide
Pro-Legal Services, Inc. performs forensic data collection under documented chain of custody, and we are regularly asked to assess collections somebody else ran. Collections almost never get challenged on the technology. They get challenged on the record — who had the data, when, what was taken, what was left behind, and who decided. Chain of custody for digital evidence is a documentation discipline more than a technical one, which is why competent vendors still produce collections that cannot be defended. These are the six places it goes wrong, and what to require from whoever is doing your collection.
1. Custodian self-collection
A custodian forwarding what they think is responsive is the most common defect and the hardest to repair. There is no record of what was not sent, no verification, and an interested party made the scoping decisions. If self-collection has already happened, it is worth knowing before you build a production on top of it. Where self-collection has already happened we document what was done, identify what is recoverable, and tell you plainly whether a defensible recollection is needed. That is a far cheaper conversation before a production than after one.
2. Scope decisions nobody wrote down
Every collection excludes something — a date range, a device, a mailbox, an archive. Those calls are defensible when they were made deliberately and recorded at the time. They are indefensible when they surface a year later as a question nobody can answer. Require that scoping decisions be documented as they are made, not reconstructed afterwards.
3. Informal handoffs
A drive handed over in a lobby, a file dropped into a shared folder, a device that sat in someone’s office over a weekend. Each handoff is a link, and a chain with an undocumented link is the one opposing counsel will find. Ask how transfers are recorded and who signs for what.
4. Cloud collection without an exclusion record
Targeted collection from Microsoft Purview, Microsoft 365, Teams, SharePoint, OneDrive, Google Workspace, or Slack is usually the right approach and far cheaper than imaging everything. It becomes a problem when the record shows what was collected but not what the query excluded. The exclusion record is the part that answers the later question.
5. Metadata altered by the method
Opening a file, copying with the wrong tool, or collecting through an interface that rewrites timestamps can change the metadata you are going to rely on. Ask what method was used for each source type and what hash verification confirms the result matches what was taken.
6. Documentation written after the fact
A custody record assembled at production time from memory and calendar entries is worth very little. Contemporaneous documentation is the whole point. Ask to see the form of the record before the collection starts, not after.
What to Require
A written collection plan with scope and exclusions recorded before work begins. Hash verification on every item. A custody record with named individuals and timestamps for every transfer. A per-source statement of the collection method used. Contemporaneous notes on scoping decisions. A declaration-ready summary you can hand to counsel without rebuilding it.
How Pro-Legal Handles It
Every collection we perform runs under documented chain of custody from intake to delivery, with hash verification, per-source methodology recorded, scope and exclusion decisions captured as they are made, and a single named contact who can explain any step of it years later. We provide forensic data collection services across endpoints, mobile devices, email, and the major cloud platforms, on site and remotely, with 24/7/365 availability for urgent preservation.
Pro-Legal also provides ESI processing and managed document review, AI document review for litigation, confidential business information redaction, and certified legal translation where the collection comes back in another language.
We collect on site and remotely throughout Washington DC, Maryland, and Virginia, including Alexandria, Fairfax, Tysons, Northern Virginia, Richmond, Bethesda, Rockville, Silver Spring, Baltimore, and Annapolis, and support matters nationwide, including New York, Chicago, Boston, Philadelphia, Dallas, Houston, Austin, Los Angeles, San Francisco, Seattle, Atlanta, Miami, Wilmington, and Newark.
Inherited a collection you are not sure about? Contact Pro-Legal Services, Inc., 1550 Wilson Blvd, Suite 250, Arlington, VA 22209, at info@pro-legal.com or 202-955-9400. We will tell you what is salvageable and what needs recollecting before you build a production on it. Available 24/7/365.