Imaging vs Active Data

Unlike Computer Forensics, e-disclosure may be limited to ‘active’ documents, (as opposed to deleted documents or system data). This limitation may be as a result of a cost reduction agreement between the parties, or because the nature of the case is deemed to be such that deleted data is unlikely to be relevant.

Imaging all systems to create exact copies of all data on target storage devices is rarely required.

In some circumstances, however, both active documents and some ‘deleted’ documents or other e-evidence is required, and the caveats concerned with the collection of computer forensics evidence may apply.