Sometimes IT departments become very concerned when receiving litigation hold letters.  It isn't always easy to manage users and keep them from deleting documents.   Doing a forensic collection of the custodian's desktop can be an excellent way to alleviate some of these concerns with only minimal business disruption.  When a technician takes a forensic collection, the entire hard drive, including the deleted files, slack space, and unallocated space is included in the image.  The image is checked for consistency and authenticity against the original, and the image meets the requirements of "Best Evidence" under the federal rules.  The analyst can take the forensic image and store an copy, to be left untouched on a server.  The subsequent analysis to search for files and email to produce can be done away from the custodian's office.  If the scope of discovery later expands, the full disc has been preserved.  This can save dozens of hours in attorney time, going back and forth on the phone, inquiring about files that were later determined to be relevant.  It also allows the option of doing a deeper forensic analysis should one become necessary, and it reduces of the risk of spoliation because there is a reference copy of the original disc available.