Defensible Remote Forensics Collections;
If you find yourself in a situation where data has to be collected for an ediscovery matter, or corporate investigation, ensuring that the evidence is admissible is extremely important to ensure important evidence is not destroyed.
1- Engage a trusted advisor to ensure evidence isn't destroyed
2- Evidence provided by your forensic analyst must be repeatable, reproducible, and defensible in court. In the event that the opposing side provides their own specialist, the information needs to match to maintain a defense that the data that you have is the data that you say it is and that it represents what you say it represents.
3-When evaluating providers, ask the following questions.
"How do you maintain a chain of custody?"
"What kind of forensic images are you putting data into?"
"Do you employ the use of verification hashes?"