Who may lawfully collect what
Before anything is collected, the question is whether you have the right to collect it. A company-issued laptop covered by a written policy the employee acknowledged is treated very differently from that same employee's personal phone or their private email and cloud accounts, even when work was done on them. The same line runs through family matters: quietly getting into a spouse's phone, laptop, email, or cloud account can create serious legal exposure for the person doing it, and it often makes the material unusable for the purpose it was gathered for. Knowing a password, paying the bill, or sharing a device does not by itself mean you are permitted to go through everything on it. We work this out first, and where consent or a court's permission is needed we go that route rather than around it. It is slower, and it is the difference between material you can use and material that becomes the problem.
Imaging rather than browsing
An examiner normally makes a verified copy of the storage and works from the copy, leaving the original as it was. Clicking through a live phone or computer changes it while you look: files get marked as opened, caches are rewritten, synced accounts update themselves, and automatic cleanup can run without anyone asking it to. Those changes are visible afterward and are routinely used to argue that the evidence was altered. Chain of custody is simply the record of who held the device, when, and what was done to it, and a gap in that record can matter more than the content itself. Whether deleted material can be brought back depends entirely on the device, the encryption, and what has happened since, so nobody should assure you in advance that it can.
What the first conversation covers
We ask what you are trying to establish, which devices and accounts exist, who owns and controls each of them, and whether anything has already been done to any of them. If a device is in your hands, the usual advice is to stop using it and keep it powered down or off the network rather than to preserve it by continuing to work on it. Where a dispute is already underway, preservation obligations may attach to both sides, and routine deletion and device turnover should be paused. We will also be direct about the material that is out of reach, because a digital forensic investigation that produces results nobody can use has cost you twice.
