What's the difference between forensic imaging and logical collection, and when do I need a full forensic image?

Both forensic imaging and logical collection are ways of capturing electronically stored information (ESI) for e-discovery, but they differ sharply in scope, cost, and the questions they can answer.

Logical collection

A logical (or “targeted”) collection gathers the active, user-accessible files and data relevant to a matter — for example, specific email accounts, documents, chat threads, or files within a date range or set of custodians. It captures the content along with its metadata (authorship, timestamps, folder paths) but does not capture deleted data, unallocated disk space, or system artifacts.

Logical collection is the default for most civil matters. It is faster, less intrusive, more proportionate to typical disputes, and easier to limit to relevant material — which helps control cost and avoid sweeping up privileged or irrelevant personal data.

Forensic imaging

A forensic image is a complete, bit-for-bit copy of an entire storage device, including deleted files, file fragments, unallocated space, and system-level artifacts. The image is verified with a cryptographic hash so its integrity can be demonstrated later, and the original is handled to preserve chain of custody.

Forensic imaging is far more resource-intensive and captures everything on the device, relevant or not. Because it can sweep in personal and privileged information, courts and proportionality principles generally discourage using it as a routine collection method.

When you actually need a full image

A full forensic image is usually warranted only when the device or its hidden data is itself at issue, such as:

• Suspected deletion, wiping, or tampering (spoliation concerns)
• Claims of data theft, trade-secret misappropriation, or unauthorized access
• A need to recover deleted files or analyze file-access and timeline artifacts
• A reasonable likelihood the device’s full contents will be evidence

Choosing proportionately

US civil discovery emphasizes proportionality — matching collection effort to the needs of the case. Default to targeted logical collection, and reserve forensic imaging for situations where device-level forensics genuinely matter. Always preserve relevant ESI promptly once litigation is reasonably anticipated, and document your method and chain of custody.

Rules and expectations vary by jurisdiction (federal courts, individual state courts, and other countries), so confirm the applicable standards and consult qualified counsel for any specific matter.