Practitioner resource
Checklist for Preparing for a Computer Forensics Scoping Call
November 1, 2026
(212) 561-586024/7: (800) 868-8189
A useful first call establishes the question, the sources that may answer it, the authority to act and the next deadline. You do not need to inspect a disputed device or collect confidential material to prepare. Gather what the responsible people already know, identify uncertainties and avoid changes that could remove relevant records. This checklist is a conversation record, not permission to access another person's device or account.
Define the issue and the immediate decision
Write the event or dispute in a short factual description. Identify what you need the examination to help determine: file movement, account access, deletion, authenticity, chronology or another specific issue. Record the relevant period and the deadline. Separate an allegation from an observed fact. If you have an opposing report or a proposed collection protocol, note its existence and arrange secure sharing rather than pasting it into a public form.
Ask who will use the result and in what form. A preliminary triage discussion, a defined technical examination, a report for counsel and potential testimony are different assignments. Identify the person authorized to agree on scope and cost, and the legal or business owner who can resolve a question during the work.
Identify computers, storage and physical custody
List the computers, servers, virtual machines, external drives and other media that may be relevant. Record known operating systems, asset identifiers, locations, owners and current custodians. State whether each item is company supplied or personally owned, and whether it is currently running, stored, damaged or in another party's possession. Do not power a device on or off merely to complete the list.
Document relevant handling already performed: use after the event, attempted recovery, copying, resets, repairs, encryption changes or an earlier collection. Name the person who can explain each action. If a device is about to be reassigned, wiped or shipped, make that timing clear on the call. A prompt preservation decision may be more urgent than a detailed examination plan.
Map email, collaboration and cloud records
Identify the actual email service, such as Microsoft 365, Google Workspace or another provider, and any reseller relationship. List relevant accounts, shared mailboxes, cloud drives and collaboration spaces. Ask whether an archive, retention policy, legal hold or backup exists and who can demonstrate its coverage. Do not treat any one of those controls as a complete substitute for the others.
Record who has administrative access and what logs may still be available. Include outside IT providers and the owner who can authorize their work. If records have already been exported, note the source, dates, method and known filters. A screenshot or forwarded message can help explain the issue, but it should not be described as a complete native record without examining its origin and scope.
Separate mobile ownership from account registration
List relevant phones and tablets separately from computers. Ask whether each is company owned, personally owned or managed through a bring-your-own-device arrangement. Identify the person or organization controlling the Apple, Google or Samsung account associated with the device. Ownership of the handset, account registration, unlock access and authority to collect are separate facts.
Ask whether mobile device management is in place, whether a work profile is used and whether any wipe, retirement or account-removal action is pending. Do not request passwords or unlock codes in this checklist. Record who can arrange authorized access and who must approve handling before a collection method can be selected.
Confirm encryption and access arrangements safely
Ask whether the computer uses BitLocker, FileVault or another encryption mechanism. Record whether an authorized recovery method is available and who controls it. Do not write the key into this document or email it with the scoping request. An administrator should confirm the actual recovery record for the relevant device rather than assume every company computer is covered.
Identify credentials, permissions or provider assistance that may be needed, without collecting secrets on the initial form. Note any personal information, protected records or unrelated data that require a handling restriction. Counsel should determine the authority and limits for access. The technical team can then explain which acquisition methods are feasible within those limits.
Prepare the source and exception register
Use one row per source with the following fields: source description, owner, custodian, location, relevant period, availability, preservation risk and person who can confirm the answer. Mark unknown information plainly. Add a short handling history and the date each answer was confirmed. Keep the completed register in the location counsel or the business approves.
Before the call, identify the three decisions that cannot wait: preserving an expiring source, obtaining authority or coordinating access. Have the relevant IT or legal owner available if possible. Ask the examiner what should be preserved now, what should remain untouched, what secure transfer method to use and what information is needed for a written scope. A useful scoping call ends with clear next steps and limits, not a promise that every device or record can be recovered.
Information Gathering Q&A Checklist
Use this Q&A with the people who own the systems and the relevant legal or business decisions. Mark unknown or not applicable answers explicitly. Record an owner, a confirming source and the date. The public guide-request form asks for your email, not the answers below.
Do not write passwords, recovery keys, unlock codes or authentication secrets here. Record whether authorized access is available, who controls it and how a secure handoff can be arranged. Keep completed copies in the location counsel or the company approves. Do not send a completed record containing sensitive account or employee details through a public contact form.
- Who is directing the matter and who can authorize technical access?
Identify directing counsel, the business decision maker, the IT security owner and any outside administrator. Record the immediate deadline, relevant period and known preservation risk. An employee's possession of a device or an administrator's ability to access an account does not by itself settle the authorized examination scope.
Answer:
Owner, source, date and unresolved questions:
- Who provides the email service and who administers it?
Identify Microsoft 365, Google Workspace, an internal Exchange environment, a hosted service or a combination. Record the tenant or organization reference, relevant domains, mailbox owners, aliases, shared mailboxes and the MSP or administrator responsible. Identify available preservation and export permissions and any licensing question that needs confirmation.
Answer:
Owner, source, date and unresolved questions:
- Does the company have archiving, backups or preservation holds in place?
Name each service and distinguish an archive or journal from a backup, a retention policy and a matter specific hold. Identify what each covers, the available dates, deletion or rotation rules and who can export or restore records. Record whether preservation has actually been verified, rather than treating the existence of a subscription as proof of coverage.
Answer:
Owner, source, date and unresolved questions:
- Does the company supply the computers or do employees use their own?
Record company owned, personally owned, leased and shared equipment separately. Identify the assigned user, operating system, asset or serial reference and present location. Note any employee owned computer used for business and the applicable access agreement. Company ownership and permission to examine particular personal material should not be assumed to be the same.
Answer:
Owner, source, date and unresolved questions:
- Are mobile devices company owned, employee owned or a mixed arrangement?
Identify the phone or tablet, assigned user, model and operating system where known, and who currently holds it. Distinguish the owner of the handset from the owner of the cellular service account. Record whether work data is separated into a managed profile and whether a replacement, return or wipe is already scheduled.
Answer:
Owner, source, date and unresolved questions:
- Whose Apple, Google or Samsung account is registered or signed in on each phone?
Record each relevant account as personal, company controlled or unknown, and identify who can lawfully arrange access. For Apple devices, note any organization enrollment and known Activation Lock status separately from the signed in Apple Account. For Android devices, distinguish personal and work profiles and note relevant Google and Samsung accounts separately. Do not sign out or reset an account to answer this question. [S14] [S15]
Answer:
Owner, source, date and unresolved questions:
- Does the company use MDM and what does it actually manage on these devices?
Name the management service, administrator and enrollment mode, including supervision or work profile details where applicable. Record the last known device contact and any pending retire, lock or wipe command. A device appearing in a management console does not establish access to every personal application, message or backup. Preserve the management record without issuing a command merely to test capability.
Answer:
Owner, source, date and unresolved questions:
- Can the company recover the BitLocker or other encryption keys for each relevant computer?
Ask whether recovery material is actually available for the identified device and drive, where it is escrowed and who has authorized retrieval permission. Possible locations include Microsoft Entra ID, Active Directory or another approved store. Note FileVault or other encryption separately. Do not assume that MDM enrollment guarantees key availability, and do not place the key itself on this record. [S13]
Answer:
Owner, source, date and unresolved questions:
- Who controls identity, administrator access and multifactor authentication?
Identify the identity provider, relevant privileged accounts, outside administrator and person who can approve an export or collection. Note access dependencies such as an unavailable administrator or authentication device without recording secrets. Shared or delegated access should be identified because account activity may require additional evidence before it can be attributed to an individual.
Answer:
Owner, source, date and unresolved questions:
- Which cloud storage, collaboration and messaging services contain relevant work?
Identify shared drives, Teams, SharePoint, OneDrive, Slack, Google Chat and other platforms actually used for the relevant work. Note external ownership, linked documents, personal accounts used for business and any unsupported or unavailable source. A mailbox export should not be assumed to include the contents of every linked file or separate conversation.
Answer:
Owner, source, date and unresolved questions:
- What activity logs and endpoint records are available now?
Ask the responsible administrator which email, identity, endpoint, cloud sharing, USB, security and data protection records exist for the relevant period. Record actual date coverage, export permissions, known gaps and the next expiration or rotation point. Enabling a logging feature today should not be described as recovering activity that was never recorded.
Answer:
Owner, source, date and unresolved questions:
- What has already changed on the devices or accounts?
Record password resets, access restrictions, account deletions, mailbox conversions, software installations, cleanup activity, repairs, cloud sync changes and any device reset or wipe. Identify who acted, when and why. Include informal handling or earlier collections so the examiner can distinguish relevant historical activity from changes made during the response.
Answer:
Owner, source, date and unresolved questions:
- What has happened to the device or account since the event?
Record use, repairs, exports, resets and the people who can confirm them.
Answer:
Owner, source, date and unresolved questions:
- Which source may change or expire before the next decision?
Identify the preservation risk and the owner who can address it.
Answer:
Owner, source, date and unresolved questions:
Primary sources and further reading
Prepared November 1, 2026. Sources explain the general framework; applicability, licenses, available records and legal requirements vary. This guide is technical preparation, not legal advice or an assurance of compliance or admissibility.