Devices and media
Forensic images and other preserved data acquired from devices or media within the approved scope.
Deliverables
Digital Evidence Deliverables
Deliverables include preserved data and documentation of authorization, preservation or acquisition activity, integrity verification, custody, transfer, and delivery.
Preserved Data
Mailboxes and cloud repositories
Authorized exports from mailboxes, cloud accounts, and shared repositories.
Files and system records
Files, logs, structured collections, and associated metadata preserved from applications, systems, or repositories.
Matter Records
Authorization and scope
Written intake identifies the primary contact and documents authorization, approved scope, sources, preservation deadlines, and expected deliverables.
Preservation or acquisition record
The record includes source identifiers, preservation or acquisition dates, methods used, and any material errors, exceptions, or limitations. The record does not include interpretive findings or conclusions.
Integrity verification
Verification records include the method, results, and any generated hash values for the preserved file set, export, or forensic image.
Custody and transfer
Custody records document receipt, storage, transfer, return, and delivery. Transfer records identify the item, transferring party, recipient, date, time, and purpose.
Transfer and Delivery
Handling Controls
Storage remains controlled through transfer and delivery. Access and handling are limited to authorized parties.
Transfer package
Labels, folder structure, and naming conventions link preserved data to the corresponding matter records.
Delivery instructions
Authorized recipient, destination, and delivery method are confirmed in advance. Data365 delivers by physical media or secure electronic transfer as authorized.
Return, retention, and destruction
Return, retention, or destruction instructions are confirmed in advance.