eDiscovery and defensible collection
Proportionate, documented collection of email, chat, files and phone data for small and mid-sized matters, done so that how it was gathered never becomes the argument.
Reviewed by the ITRS security team · Last updated
What makes a collection defensible
Rule 29.1.03 of Ontario's Rules of Civil Procedure requires parties seeking documentary or oral discovery to agree a discovery plan, and to consult and have regard to The Sedona Canada Principles Addressing Electronic Discovery. A defensible collection follows that plan: proportionate scope agreed with counsel, forensic copies verified by hash values, and a chain-of-custody record for every source.
'Defensible' does not mean perfect. It means that if the other side or the court asks how documents were identified and gathered, there is a clear, reasonable answer backed by records. The Sedona Canada Principles Addressing Electronic Discovery (Third Edition, 2022) frame this around reasonableness, good faith, proportionality and cooperation rather than exhaustive collection.
In practice a defensible collection has five qualities:
- Scope agreed with counsel and, ideally, discussed with the other side (Sedona Canada Principle 4 encourages a joint discovery plan)
- Methods that preserve metadata, such as sent and received dates, authors, folder paths and file system timestamps
- A record of exactly what was collected, from where, when and by whom
- Hash values that show the collected data has not changed since collection
- A written description of the process that can be put in an affidavit if challenged
Sources we collect from
| Source | How it is typically collected |
|---|---|
Exchange Online mailboxes | Microsoft Purview eDiscovery search and export (PST or individual messages), with hold placed first where needed |
Teams chats and channel messages | Purview eDiscovery, which covers Teams content stored in Microsoft 365 |
SharePoint and OneDrive | Purview eDiscovery export, with a decision on document versions and linked (cloud) attachments |
Gmail and Google Drive | Google Vault matters, holds and exports, on editions that include Vault |
Laptops and desktops | Forensic image or targeted logical collection, depending on the issues |
Phones | Logical or file-system extraction as the device allows, or collection of cloud backups with consent |
Other cloud apps (Slack, Dropbox, practice management) | Native export functions or APIs, documented step by step |
Proportionality and scoping with counsel
Sedona Canada Principle 2 asks that discovery steps be proportionate to the nature and scope of the litigation, the importance and complexity of the issues and amounts at stake, the relevance of the available data, its importance to the court's adjudication, and the costs, burden and delay involved. For a small or mid-sized matter, that usually means collecting from a defined list of custodians, for a defined period, rather than everything.
We help counsel make those choices with data rather than guesses. A short scoping step identifies the custodians, systems and date ranges, and Microsoft Purview's search statistics or Google Vault counts show how many items each option would bring in. Counsel then decides, knowing the cost and volume implications.
Principle 6 provides that a party should not be required, absent agreement or a court order based on demonstrated need and relevance, to search for or collect deleted or residual data. Full forensic imaging is therefore a deliberate choice for specific custodians or issues, not a default.
Chain of custody and hash verification
Every collection is logged on a chain-of-custody record and verified with cryptographic hash values (typically SHA-256) at the point of collection, on transfer, and before processing. If anyone later asks whether the data changed, the hash values answer the question. Our approach follows ISO/IEC 27037 guidance on the identification, collection, acquisition and preservation of digital evidence.
This matters for admissibility too. Under the Canada Evidence Act and Ontario's Evidence Act, the integrity of an electronic record can be shown through the integrity of the system that recorded or stored it, and evidence of the standards and procedures followed can be presented. A documented collection is that evidence.
For the analysis and reporting that follows collection, see litigation support for counsel and digital forensics in Toronto.
Processing and production formats for review
Collected data is processed so reviewers can work efficiently: duplicates removed, email threads grouped, container files such as PSTs and ZIPs expanded, and searchable text extracted. Sedona Canada Principle 8 encourages parties to agree early on the format of production, which avoids paying to convert data twice.
We deliver in the format counsel's review platform or the other side expects: native files with a metadata load file, searchable PDFs with metadata fields, or exports suitable for the review tool counsel already uses. Privilege review and relevance decisions remain with counsel.
Common collection mistakes
- Forwarding emails to counsel as the collection, which strips header data and changes dates
- Copying files by drag-and-drop, which can overwrite created and modified dates
- Letting a custodian select their own 'relevant' emails with no record of how
- Screenshots of text messages instead of an extraction that captures timestamps and participants
- Deleting a departed employee's Microsoft 365 account before placing a hold, which can mean losing the mailbox
- No hash values or custody log, leaving integrity to be argued from memory
FAQ
Sometimes, for straightforward Microsoft 365 or Google exports, if the process is documented and the exports hashed. If collection is likely to be challenged, or devices are involved, an independent collector avoids putting your IT staff in the witness box.
We deliver data in the format your review platform or counsel's chosen vendor needs, rather than tying you to one.
Collection gathers data; it does not review it. Privilege review is counsel's. We restrict access to collected data and can segregate known privileged sources, such as a legal department mailbox, on counsel's instruction.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyEmail Authentication for a Vaughan Smart-Home IntegratorHow IT Rapid Support audited a Vaughan smart-home integrator's email authentication and implemented DKIM and DMARC to shut down domain spoofing.
Related.
- PracticeLegal TechnologyeDiscovery and forensic collection for counsel, expert-ready reports and legal-tech advisory for firms.
- ServiceLitigation holds and preservationPreservation comes before collection. We help counsel and clients scope a hold, apply it technically in Microsoft 365 and Google Workspace, notify custodians, and avoid…
- GuideMicrosoft 365 litigation hold and content search for law firms and legal teamsHow Microsoft 365 preserves and finds content for legal matters in the current Microsoft Purview eDiscovery experience: holds versus retention, creating a case and hold…
- GlossaryHash values and forensic imagesA plain-language explanation for lawyers, HR and managers of what a hash value is, how a forensic image differs from a copy, and how to read the hash references in a…
- GlossaryChain of custody (digital evidence)The documented record of who collected, held, transferred and examined an item of digital evidence, from the moment it was identified to the moment it is presented or…
Acting on a matter that turns on electronic evidence?
Tell us who you act for and what is at issue. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.