The Pros & Cons of Remote Collections: Lessons from a Digital Forensics Expert
On October 21, 2025, Robert B. Fried, our EVP of Forensics & Chief Investigative Officer, presented on The Pros & Cons of Remote Collections. The keynote offered a deep dive into the evolving field of digital forensics and eDiscovery. Drawing on more than 20 years of experience, the session highlighted practical considerations, real-world challenges, and guiding principles for ensuring defensibility, documentation, and adaptability in modern workflows.
As organizations increasingly rely on distributed teams and cloud-based systems, understanding how remote data collections can be leveraged has become essential. The session explored not only what remote collections entail, but also when they are most effective and how to navigate both technical and human elements.
What Are Remote Data Collections?
Remote data collection is defined as:
“A series of defined procedures—manual or automated—configured under the direct supervision of a collection specialist who is not physically near the data source.”
While the concept predates COVID-19, it became essential when on-site access was limited. Remote collections have been performed long before they became mainstream and are now the preferred method when collecting data from cloud-based sources, addressing hybrid teams, and urgent cases.
When to Use Remote vs. On-Site
Remote Collections
Preferred method for cloud data or geographically dispersed teams
May be useful when speed is essential
On-Site Collections
Preferred for large data volumes or being hands-on with physical / local devices
Necessary when physical verification or strict chain-of-custody documentation is required
Documentation Is Key
Effective documentation is non-negotiable. Every collection—whether cloud-based or physical—requires:
An accurate complete chain of custody throughout the lifecycle of a matter
Repeatable procedures so results can be reproduced by another examiner, if required
Defensibility in court depends on the ability to demonstrate consistent, well-documented methods that have been validated and accepted by the digital forensics community.
Navigating Technical & Logistical Challenges
Remote collections can be impacted by:
Connectivity issues: Wi-Fi limitations, firewall blocks, port restrictions
Hardware constraints: Older devices, limited storage, unsupported operating systems
Tool limitations: Not all apps and platforms are fully supported
Security policies: IT restrictions can prevent installations or connections
Human Considerations
Successful collections also depend on managing people effectively:
Custodian sensitivity: Individuals may worry about data exposure
Executive expectations: Speed, transparency, and timely device return are priorities, especially for tight deadlines
Collaboration: Calm communication with IT and Legal teams and custodians ensures smoother workflows
Ensuring Evidence Integrity
Even remotely, maintaining forensic standards is critical:
Uphold repeatability and chain of custody
Validate tools and maintain equipment
Consider what may be lost without physical inspection, including fingerprints, trace DNA, or visual cues
Operational Realities
Practical aspects of remote collections include:
Maintaining remote collection kits
Managing shipping risks, such as lost / delayed or damaged packages
Ensuring cloud storage compliance with local privacy laws (i.e. GDPR) and ISO standards.
Conducting validation testing before tool deployment
Lessons from the Field
Real-world experiences underscore the importance of preparation:
Shipping delays and damaged equipment can disrupt workflows
Forensically unsound methodologies may require recollection of data
Not preserving metadata or encountering unsupported app versions can force repeated efforts
High-stakes cases sometimes reveal the tension between data priorities and human safety
Guiding Principles for Practitioners
Document everything
Validate tools and methods – Not on real evidence
Maintain chain of custody
Balance efficiency with defensibility
Adapt to each case’s unique needs
Be prepared to testify, even as a junior examiner
Closing Thoughts
The overarching message: remote data collections demand flexibility, collaboration, and continuous learning. Success isn’t just about completing the job; it’s about doing it in the best possible way for each case.
