One way in which e-disclosure can differ from forensic investigation is that it may be limited to active documents, as opposed to deleted documents or system data. This may be due to an agreement between the parties to attempt to reduce cost, or because the nature of the case is such that deleted data is deemed to be unlikely to be relevant.

Imaging all systems to create exact copies of all data on target storage devices is rarely required. In some circumstances, however, both active documents and some deleted documents or other e-evidence may be required. When that is the case, collection may need to be conducted in accordance with the Association of Chief Police Officers (ACPO) guidelines that govern the proper collection of evidence in forensic investigations.