Self-Collection vs Forensic Collection: Texas eDiscovery Guide 2026

Collection is the step between preservation and review. You have already stopped deletion (see our departing-employee legal hold guide); now you copy the relevant data out of its original home so attorneys can process and review it. How you copy it matters, because metadata such as created, modified, and sent dates is often the very thing a dispute turns on.

Self-collection means the custodian or your internal staff gathers the data: dragging files into a folder, forwarding emails, or exporting a mailbox to PST. It is quick and costs almost nothing up front. It also carries real risks:

• Altered metadata. Copying, forwarding, or opening files can change timestamps and strip properties.
• Incomplete results. A custodian searching their own mailbox may miss archives, deleted items, or files in personal cloud folders.
• Conflict of interest. The person whose conduct is in question is deciding what gets handed over.
• No audit trail. Without a documented chain of custody, you may struggle to show what was collected, when, and by whom.

Courts have criticized parties who relied on unsupervised custodian searches, and our overview of spoliation and sanctions for electronic evidence shows how quickly a collection error can turn into a sanctions motion.

Forensic collection uses specialized tools and trained personnel to capture data in a way that preserves metadata and produces a verifiable record. Typical elements include hash values that prove a copy matches the original, write-blockers for physical devices, and a written chain of custody. It costs more per source, but it is the standard when authenticity is likely to be contested.

For cloud data, collection often does not require imaging anything. Microsoft 365 compliance tools can search and export mailboxes, OneDrive, SharePoint, and Teams content with logging, and tools such as Microsoft Purview eDiscovery Premium add custodian management and review sets. Which features you have depends on your licensing, so confirm with your provider before a matter starts. Mobile devices are the usual exception; see our guide to text message eDiscovery for why phones often need specialist handling.

1. Low stakes, low dispute risk: a routine records request for clearly identified files. Supervised self-collection by IT, not the custodian, is often reasonable.
2. Moderate stakes: use admin-level export from Microsoft 365 performed by IT or your provider, with logging and a written record.
3. High stakes or contested authenticity: employment disputes, trade secret claims, suspected tampering, or anything involving a departing executive. Use forensic collection.
4. Anything involving a device: laptops, phones, and USB drives should be quarantined and imaged forensically, not browsed.

Ask your attorney to confirm the right tier for the matter. The cost of getting this wrong usually dwarfs the cost of a forensic vendor, a point we expand on in our eDiscovery cost control guide.

Businesses that handle collection well have decided in advance who authorizes it, who performs it, and where the records go. That groundwork is part of litigation readiness, and it aligns with the stages in our EDRM workflow for in-house counsel. Pay attention to backups, too: knowing what your Microsoft 365 backup does and does not retain tells you what is recoverable.

This week, write a one-page collection protocol: who is allowed to collect data, which matters require forensic help, and who keeps the chain-of-custody log. Then identify a forensic provider before you need one. Our eDiscovery services help Texas SMBs and law firms plan defensible collection, and our Microsoft 365 managed services make sure the right retention and export tools are configured. For a broader look, read our eDiscovery guide for Houston law firms. This article is general information, not legal advice; consult your attorney about your specific matter.

• Managed IT services in Houston
• Managed IT services in Katy
• Managed IT services in The Woodlands