Remote vs. On‑Site Collection: Choosing the Right Approach for the Matter in Front of You

Remote data collection has become a critical capability for legal teams navigating distributed workforces, compressed timelines, and increasing cost pressure. But despite its growing adoption, remote collection is not a universal solution and treating it as one can introduce risk.

The most defensible collection strategies start with a simple premise: the right approach depends on the matter, the data, and the people involved. Knowing when remote collection is appropriate—and when on‑site collection is the better choice—is a mark of experience, not conservatism.

Understanding the Difference: Remote vs. On‑Site Collection

At a high level, the distinction is straightforward.

Remote collection allows data to be acquired without a physical examiner present, typically by guiding a custodian through a secure process using their own device or a provided kit. The same forensic principles apply, but execution relies more heavily on communication, planning, and technology.

On-site collection involves a forensic examiner physically accessing devices or systems, allowing for deeper inspection, real-time judgement, and hands-on control, often important in complex or sensitive matters.

Both approaches are defensible when properly executed. The difference lies in how much certainty, flexibility, and human involvement the situation requires.

When Remote Collection Is the Right Option

Remote collection is often the most effective choice when speed, efficiency, and proportionality are priorities.

Speed and Responsiveness
Remote collection can often be initiated far more quickly than onsite work. In some cases—particularly with tools like ModeOne—collections can occur the same day, without waiting for travel logistics or equipment shipping. Importantly, the limiting factor is rarely the extraction itself; it is the speed of response and coordination from the service provider. When that response is immediate, remote collection can significantly accelerate early case insight.

Cost Efficiency
Many clients today are intensely cost focused. Remote collection typically avoids travel expenses, minimises examiner time, and reduces operational disruption. For straightforward data sources—such as email or standard mobile data—remote collection can deliver defensible results at a materially lower cost than onsite alternatives.

Well-scoped, Targeted Matters
When the data sources are known and the scope is clearly defined, remote collection is often sufficient and preferable. Targeted collection—rather than broad imaging—can help teams collect what they need while avoiding unnecessary downstream review costs.

Custodians Comfortable with Guided Technology
In remote workflows, custodians may be asked to install an application, connect a device to a computer, authenticate with a passcode, and follow guided steps while an examiner establishes a secure connection and performs the extraction. For many custodians, this is straightforward and minimally disruptive.

Remote Collection Options in Practice

Remote collection is not a single method—it includes multiple approaches, each with different strengths.

iOS Remote Collection Kits (e.g., iMazing based workflows)
This approach involves shipping a preconfigured laptop and encrypted storage to the custodian to perform an iOS backup. It is effective in the majority of iOS cases that do not require acquisition of encrypted messaging apps such as Signal or Telegram. The custodian authenticates using their standard device PIN, and the collection mirrors a traditional backup process.

ModeOne
ModeOne removes the need to ship hardware by leveraging the custodian’s own PC or Mac. It captures a dataset similar to an iOS backup and allows for limited Android collection, subject to platform restrictions. Because it relies on the custodian’s existing device, ModeOne enables same-day or short-notice collections and can apply basic filtering at the point of collection (for example, collecting only Messages).

Each option has trade‑offs, and selecting the right one requires understanding both the technical environment and the investigative goals.

When Remote Collection Is Not the Right Choice

Remote collection is powerful—but it is not always sufficient.

Complex or Evolving Investigations
For matters that may deepen over time, there is risk in choosing the “cheapest” or narrowest option too early. Teams sometimes realise—too late—that key data sources were never collected. In those cases, an initial broader or onsite collection, followed by culling, may have been the better long-term decision.

Geographic and Platform Considerations
Custodian location matters. In parts of the EU and Asia, Android devices and applications like WhatsApp are far more prevalent. Due to platform limitations and encryption, remote options may not reliably capture these data sources. In-person collections can open additional avenues of evidence that simpler remote methods may miss.

Highly Technical or Uncommon Applications
Applications such as Signal, Telegram, private chats, or niche technical tools often require hands-on expertise and deeper access than remote workflows can provide. These scenarios frequently warrant an onsite examiner.

Custodian Experience and Sensitivity
For high-net-worth individuals or matters involving personal, sensitive, or high stress circumstances, remote collection may not be the right fit. Many custodians strongly prefer having an expert physically present—someone to guide the process, answer questions, and reduce anxiety. In those cases, onsite collection can be less stressful and more effective, even if it is not the fastest option.

The Importance of Scoping Before Choosing

One of the most important—and often overlooked—steps in collection strategy is the initial scoping call. An experienced forensic professional should be involved early to assess:

• Custodian location and usage patterns
• Device types and operating systems
• Applications in use (including private or encrypted messaging)
• Potential for the matter to expand
• Jurisdictional and privacy considerations

Without this scoping, teams risk choosing an approach that is efficient in the short term but insufficient in the long run.

Avoiding the False Tradeoff

Remote collection is frequently framed as “faster and cheaper,” while on‑site collection is seen as “safer and deeper.” In reality, the distinction is more nuanced.

Both approaches are defensible. Both can be efficient. The real difference lies in how much judgement, adaptability, and human presence the situation demands.

The strongest collection programs avoid defaulting to one method. Instead, they apply the right tool to the right job—sometimes combining approaches as a matter evolves.

Final Thought

Remote collection is no longer a backup plan; it is a core component of modern investigations and discovery. But expertise lies in knowing when to use it, when not to, and how to scope matters so that early decisions do not limit future options.

In today’s environment, defensibility is not about choosing remote or on‑site. It is about making intentional, informed choices—and being able to explain them later.