Logical Collection

Stage four of the EDRM is collection . Be sure to recognize that the are two basic forms of collection - physical collection and logical collection. Physical collection is the imaging of an actual hard drive - including its unallocated space. Logical collection involves collecting from the virtual constructs presented to a user by an operating system - for example in Windows one may have the C drive logical volume and the D drive logical volume - each actually part of one drive. A volume level logical collection may consist of a single volume from multiple hard drives - perhaps a Redundant Array of Independent Disks (RAID). A distinction may be made between logical volume collection and folder level logical collections.

Robocopy

When you copy data from a hard drive on to a flash drive or other storage device, normally you'll notice the meta data for the file is altered. Instead of the date created on the source, you end up with the current time & date at the point of transfer. For the purposes of data collection you want to preserve the original meta data values intact. In order accomplish this, make use of the Robocopy command in Windows.

You just need to go to the folder you want to copy data from, press SHFT + CTRL + Right click and choose 'Open Command Window Here' , and then enter the file path of the folder from which data is to be collected (use quotes if the path has spaces), the path of the destination, and forward slash 'E'. See for example this command:

I:\Litigation Support\Electronic Discovery\EDRM>Robocopy "I:\Litigation Support\ Electronic Discovery\EDRM" H:\ /E

So when we collect data from a folder like this:

. . . and run the Robocopy command - 'Robust File Copy for Windows' . . . the data is copied in a special fashion

. . . so the Date Created field is not altered.

#Datacollection #Robocopy