Evidence must remain defensible.
Evidence preservation, forensic support, data recovery and controlled erasure — delivered under documented chain-of-custody, POPIA-aligned evidence handling and reporting that separates fact from interpretation.
Preservation, examination, recovery and controlled erasure.
| Capability | What is delivered |
|---|---|
| Digital forensics | Approved evidence intake, imaging, integrity recording, examination support and technical fact reporting. |
| Data recovery | Triage, non-destructive assessment, imaging and controlled return of recoverable data; logical recovery in-house, physical and cleanroom-level recovery through vetted specialist laboratories under CollectiveIS case management. |
| Data destruction | Software erasure with verification and certificates once licensed tooling is operational — currently under evaluation and stated as such — and witnessed physical destruction through controlled partners. |
| Incident evidence | Logging, evidence preservation, response procedures and escalation support alongside the incident-response service. |
No-guarantee rule: recovery, breach prevention, forensic findings and legal outcomes cannot be guaranteed. Every engagement states scope, authority, limitations, dependencies and evidence-handling requirements.
A documented evidence lifecycle.
CollectiveIS applies a documented evidence lifecycle from initial instruction to final return, retention or authorised destruction. Access to evidence is restricted, duties are segregated between intake, examination and review, and each action is recorded in an audit trail.
| Control stage | Required record |
|---|---|
| Authority and scope | Written instruction, legal basis, authorised contact and defined examination scope. |
| Evidence intake | Unique case number, item identifier, description, source, date, time and receiving person. |
| Condition recording | Photographs, visible condition, seals, packaging and device state. |
| Transfer | Date, time, person releasing, person receiving, purpose and signatures or approved digital acknowledgement. |
| Acquisition | Tool, method, operator, date, source identifier, destination and hash values. |
| Examination | Analyst activity log, tools used, queries performed, findings and review points. |
| Storage | Controlled location, access records, environmental requirements and retention period. |
| Closure | Client-approved return, transfer, retention, erasure or destruction record. |
Controlled conditions for physical media work.
Physical media work requires environmental control, contamination management and strict case separation. Cleanroom capability is planned and not yet in service: physical and cleanroom-level recovery is currently delivered through vetted specialist laboratories, and CollectiveIS will only advertise its own cleanroom capability when the facility, equipment and operating procedures are in place and verified. The controls below define the standard that any facility must meet.
- Restricted access to authorised technical personnel.
- Controlled entry, work-area preparation and contamination precautions.
- Case separation and item-level labelling.
- Tool cleaning, consumables control and workstation preparation.
- Photographic recording before, during and after intervention.
- Parts and donor-component records where applicable.
- Quality review before media is resealed or transferred.
- Environmental and maintenance records appropriate to the facility class.
Personal information protected throughout the engagement.
Forensic and recovery cases may contain personal information, special personal information, confidential business records and legally privileged material. Processing must be limited to an authorised purpose and protected throughout the engagement.
- Document the responsible party, operator relationship and authorised processing purpose.
- Limit collection and examination to the approved scope.
- Restrict access according to role and case need.
- Use secure transfer, storage and return methods.
- Maintain confidentiality commitments and conflict checks.
- Define retention, legal hold and destruction instructions.
- Record security incidents and support required notifications.
- Separate client data from training, demonstration and test environments.
Reporting controls that separate fact from interpretation.
Technical reports must distinguish observed facts, tool output, interpretation, limitations and matters outside scope. CollectiveIS will not state a legal conclusion where the evidence supports only a technical finding.
- Use neutral language and identify the source of each finding.
- Record material limitations, damaged data, inaccessible areas and tool constraints.
- Apply peer or supervisory review for significant reports.
- Preserve working notes and supporting artefacts under the case-retention rule.
- Disclose subcontractor involvement and specialist dependencies.
- Escalate conflicts of interest, disputed authority and scope changes before proceeding.
Evidence release and intake. Evidence is released only against a client-approved closure record. Forensic and evidence-handling enquiries are accepted through a controlled intake process. General website forms must not be used to transmit evidence or confidential case material.