What to Do
Plan collection against the hypotheses, not against curiosity. Check the legal and ethical boundary before touching anything. Preserve before you analyze: capture, hash, log. Collect the minimum that answers the question.
How It Fails
The evidence that evaporates. A page taken down, an account deleted, a disk mounted read-write. Also the collection that was never lawful, which poisons everything it touches.
Check
- Collection is tied to a hypothesis it can test
- The legal basis is written down before collection
- Every item is preserved before it is read closely
- Data minimization applied: nothing collected “just in case”