Comparison
Targeted Collection vs. Full Forensic Imaging
Most matters need the first. Some genuinely need the second. Here is how to tell.
| What matters | Targeted collection | Full forensic imaging |
|---|---|---|
| Scope | The conversations and files the case turns on | A bit-for-bit image of the entire device |
| Where it happens | The client's own computer, wherever they are | A lab, with the device in an examiner's hands |
| Device custody | The client keeps their phone throughout | The phone is surrendered, often for days or weeks |
| Deleted messages | Gap artifacts reported; Recently Deleted captured | Best chance at recovering overwritten data, still not guaranteed |
| System artifacts | Not the point of the exercise | Location history, app usage, deletion timing, system logs |
| Locked or hostile device | Needs a cooperating custodian | The usual reason to go to a lab |
| Timeline | About an hour to an hour and a half | Days to weeks, depending on the queue |
| Cost shape | Pay-per-use, no seat fees | A per-device lab engagement |
| Best for | Family law, employment, most civil discovery | Spoliation allegations, criminal matters, contested devices |
The honest answer first
If your case is about what people said to each other, a targeted collection is what you need. If your case is about what someone did to a device, you need a lab.
That distinction decides almost every instance of this question, and it is worth being clear that Hearsay is built for the first one. We would rather tell you to go elsewhere than sell you the wrong thing.
What a targeted collection is for
A cooperating custodian, usually your own client, has messages on their phone that matter. You need those messages, complete, with timestamps and sender identifiers, verified well enough to withstand an authentication challenge, and formatted so a court can read them.
That is the overwhelming majority of family law and employment litigation. The client runs the collection on their own computer, keeps their phone, selects which conversations are shared, and you receive a searchable PDF per conversation plus Excel and RSMF, with hashes, an audit log and chain-of-custody documentation.
What full forensic imaging is for
Go to a lab when the device itself is the evidence. That means allegations that someone deleted messages and you need to establish when and how. It means a locked or uncooperative device. It means criminal exposure. It means you need location history, app usage patterns, or system logs rather than conversations. And it means anything where a court-appointed neutral examiner has been ordered.
Imaging captures unallocated space, which is where overwritten fragments live. That is the real capability a targeted collection does not have, and it is why spoliation cases go to a lab.
The middle case
Sometimes you start with one and escalate to the other. A targeted collection that reports gap artifacts across the exact period in dispute is itself a reason to seek imaging, and it is a far cheaper way to find that out than beginning with a lab engagement. Running the collection first is not wasted work; it is how you build the record that justifies the next step.
Getting the other side's device
A targeted collection covers your client's side of every conversation, which includes everything the other party sent them. For the other party's own device, Hearsay supports collection requests sent to opposing parties, run through your account with a review-and-release step on their side, so the process is agreed and documented rather than litigated.
Frequently asked questions
Is a targeted collection forensically sound?
Yes, within its scope. It records hashes at collection, maintains an audit log, and produces chain-of-custody documentation, and signed affidavits and expert testimony are available. What it does not do is image unallocated space, which is why a spoliation question belongs in a lab.
How do I know whether I need imaging?
Ask what you are trying to prove. If it is the content of conversations, collect. If it is conduct involving the device itself, image. If you are unsure, a collection will usually tell you whether there is a gap worth investigating.
Can a targeted collection be challenged?
Anything can be challenged. The point of the hashes, the audit log and the process documentation is that the challenge has to engage with a record rather than with a client's recollection.
Does Hearsay perform full forensic imaging?
No. Hearsay performs targeted collections from cooperating custodians. In-person extraction can be arranged where a matter needs it, but whole-device lab examination is a different service and you should engage a forensic examiner for it.
