ESI Collection 101: Legal Obligations and Technical Methods

Table of Contents#

1. What is ESI Collection?
2. Core Legal Obligations for ESI Collection
3. Proven Technical Methods for Compliant ESI Collection
4. Step-by-Step Compliant ESI Collection Workflow
5. Common ESI Collection Mistakes to Avoid
6. Final Takeaways
7. References

---

1. What is ESI Collection?#

ESI refers to all data created, stored, or accessed via electronic devices, including but not limited to:

• Emails, calendar entries, and contact lists
• Instant messages (Slack, Microsoft Teams, WhatsApp) and social media posts
• Cloud storage files (Google Drive, AWS S3, Dropbox) and SaaS application data (Salesforce, HubSpot)
• Mobile device data (text messages, call logs, app data)
• Deleted, fragmented, or hidden data stored in device slack space or cloud recycle bins
• IoT sensor logs, security camera footage, and server access logs

ESI collection is the process of identifying, preserving, and gathering relevant ESI for use in legal, compliance, or investigative processes, without altering the original state of the data. Unlike manual file gathering for internal use, compliant ESI collection requires strict documentation and process controls to ensure the data is admissible as evidence.

---

2. Core Legal Obligations for ESI Collection#

Compliance with ESI collection rules is non-negotiable, regardless of the size of your organization. Key legal requirements include:

2.1 Duty to Preserve and Legal Hold Requirements#

As soon as an organization reasonably anticipates litigation, a regulatory investigation, or a formal audit, it is legally required to suspend all routine data deletion policies for relevant custodians (employees or third parties who hold relevant data) and data stores.

• For U.S. federal cases, this requirement is formalized in Federal Rules of Civil Procedure (FRCP) Rule 37(e), which explicitly holds organizations liable for failure to preserve ESI that should have been retained for a proceeding.
• Legal holds must be issued in writing to all relevant custodians, with documented proof of receipt and acknowledgment to avoid claims of accidental data deletion.

2.2 Evidence Admissibility Standards#

For ESI to be accepted as evidence in court or regulatory proceedings, it must meet three core criteria:

1. Authenticity: You must be able to prove the ESI is exactly what you claim it is, and has not been altered since collection.
2. Integrity: No changes were made to the original data during the collection process.
3. Chain of custody: You have a complete, unbroken log of who collected, accessed, modified, or transferred the ESI from the moment it was gathered to the moment it is presented as evidence.

• U.S. Federal Rules of Evidence (FRE) Rule 902(13) and (14) allow for self-authentication of ESI if it is collected with documented, forensically sound processes and unbroken chain of custody.

2.3 Cross-Border Data Privacy Compliance#

If ESI contains personal data of residents in other jurisdictions, you must align collection practices with local privacy laws:

• EU/EEA: GDPR requires data minimization (collect only ESI directly relevant to the investigation) and a valid legal basis to transfer personal ESI outside of the EU.
• U.S. California: CCPA/CPRA requires you to notify employees if their personal data is collected for legal proceedings, and redact any non-relevant personal information.
• China: PIPL prohibits the transfer of personal ESI of Chinese residents outside of the country without prior regulatory approval.

2.4 Penalties for Non-Compliance#

Real-world examples of penalties for improper ESI collection include:

• 2022: Morgan Stanley paid $60 million in court sanctions for failing to preserve ESI related to a customer data breach class action lawsuit.
• 2023: A small U.S. healthcare firm was fined $1.2 million under HIPAA for improper collection and exposure of patient ESI during a regulatory audit.
• Common sanctions also include adverse inference jury instructions (telling the jury to assume the lost ESI was unfavorable to the non-compliant party) or full dismissal of a case.

---

3. Proven Technical Methods for Compliant ESI Collection#

Choose collection methods based on the type of ESI, legal requirements, and scope of your investigation:

3.1 Forensically Sound Static Imaging#

This is the gold standard for collection from physical devices (laptops, desktop computers, mobile phones, external hard drives).

• Process: Create a bit-for-bit exact copy of the entire storage device, including deleted files, slack space, unallocated clusters, and hidden metadata. No changes are made to the original device, all analysis is done on the copied image.
• Tools: FTK Imager, EnCase, open-source DD utility, Cellebrite (for mobile devices).
• Key control: Generate a cryptographic hash (unique digital fingerprint) of the original device and the copied image to prove they are identical.

3.2 Targeted Filtered Collection#

For cases where full device imaging is unnecessary (and potentially a privacy risk), targeted collection uses pre-defined parameters to gather only relevant ESI, reducing collection time and cost.

• Process: Use filters including keyword searches, date ranges, custodian IDs, file types, and folder locations to identify and extract only relevant ESI.
• Tools: Relativity Collect, Nuix, Microsoft Purview eDiscovery.
• Key control: Document all search parameters and filters to prove you collected all relevant ESI and did not intentionally exclude unfavorable data.

3.3 Native Cloud ESI Collection#

Over 75% of modern ESI is stored in cloud applications, and manual downloading of cloud files changes critical metadata (creation date, access date, edit history) that makes evidence inadmissible.

• Process: Use native cloud application programming interfaces (APIs) to pull ESI directly from cloud platforms, with full metadata and audit trails intact.
• Tools: Onna, CloudNine, Google Vault, Slack Discovery API.
• Key control: Request a compliance letter from your cloud provider confirming their API collection method meets legal admissibility standards.

3.4 Deleted/Fragmented Data Recovery#

If relevant ESI was deleted before a legal hold was issued, specialized recovery methods can retrieve data from device slack space, unallocated clusters, or cloud backup systems.

• Process: For physical devices, use forensic tools to scan for and reconstruct fragmented deleted files. For cloud data, access long-term backup systems or cloud recycle bins that retain deleted data for 30-180 days by default.
• Key control: Only conduct deleted data recovery with a certified digital forensic analyst to avoid overwriting or destroying remaining recoverable data.

3.5 Automated Chain of Custody Tracking#

Manual chain of custody logs are prone to human error and often rejected by courts. Automated tools log all collection activity in real time, with tamper-proof audit trails.

• Process: Automatically log who collected the ESI, collection timestamp, tools used, hash values for collected files, and all subsequent access or transfer of the ESI.
• Tools: Casepoint, LogRhythm, Exterro.

---

4. Step-by-Step Compliant ESI Collection Workflow#

Follow this repeatable workflow for all ESI collection requests:

1. Initiate legal hold: As soon as a proceeding is anticipated, issue a written legal hold to all relevant custodians, suspend routine data deletion policies, and document all acknowledgments.
2. Map data locations: Conduct a full audit to identify all locations where relevant ESI is stored (endpoints, cloud apps, mobile devices, third-party vendor systems).
3. Select collection method: Choose the appropriate collection method based on data type, legal requirements, and investigation scope.
4. Collect ESI: Execute collection, generate hash values for all collected files, and confirm hash matches for original and copied data.
5. Validate collection: Cross-check that all relevant custodians and data sources are included, and no non-relevant personal data is collected (redact if necessary).
6. Store securely: Save the original ESI in an encrypted, access-controlled repository, with a full automated chain of custody log.

---

5. Common ESI Collection Mistakes to Avoid#

1. Manual cloud file downloads: Manual downloading alters metadata and makes ESI inadmissible, always use native API collection for cloud data.
2. Lack of documentation: If you cannot prove what search parameters you used for targeted collection, courts may reject your ESI as incomplete.
3. Ignoring unstructured data: 60% of high-impact evidence comes from unstructured data (Slack messages, Teams chats, social media posts) that many teams overlook during collection.
4. Mixing personal and business data: Collecting non-relevant personal employee data can lead to fines under GDPR, CCPA, and other privacy laws.
5. No custodian training: Even if you issue a legal hold, if custodians delete data accidentally, your organization is still liable. Train all relevant custodians on legal hold requirements.

---

6. Final Takeaways#

ESI collection is equal parts legal compliance and technical execution. For low-stakes internal investigations, targeted collection with automated chain of custody tracking is sufficient, but for high-stakes litigation or cross-border regulatory audits, work with certified e-discovery and digital forensic experts to avoid costly missteps. Always prioritize data integrity, full documentation, and alignment with both e-discovery rules and global data privacy laws to ensure your ESI is admissible and compliant.

---

7. References#

1. Federal Rules of Civil Procedure (FRCP) Rule 37(e): Failure to Preserve Electronically Stored Information. Retrieved from https://www.uscourts.gov/sites/default/files/2023-12/frcp_2024.pdf
2. Federal Rules of Evidence (FRE) Rule 902: Evidence That Is Self-Authenticating. Retrieved from https://www.uscourts.gov/sites/default/files/2023-12/fre_2024.pdf
3. EDRM 2023 E-Discovery Trends Report. Retrieved from https://www.edrm.net/resources/reports/2023-edrm-trends-report/
4. General Data Protection Regulation (GDPR) Article 5: Principles Relating to Processing of Personal Data. Retrieved from https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
5. HIPAA Security Rule: Requirements for Electronic Protected Health Information. Retrieved from https://www.hhs.gov/hipaa/for-professionals/security/index.html