How to forensically image a debtor's servers and laptops once and reuse the copy

The short answer: image once, early, under a written protocol

Image the debtor's computers once, as soon as the estate controls them, and design the protocol so that one copy can answer every later question: what happened before the filing, what the estate owns, and whether the records themselves carry value. A forensic image made through a write blocker, verified with hash values and tracked on a chain-of-custody log is the copy an investigation needs. It is also the copy a records assessment can draw on later, provided privilege, personal data and any legal holds are dealt with first.

The pressure comes from the calendar, not the statute. Landlords reclaim space, the auctioneer wants the hardware, the managed service provider stops answering once invoices go unpaid, and the Microsoft 365 or Google Workspace tenant lapses when the card on file declines. Each of those events can destroy records that no later motion can bring back.

What to have in place before anyone touches a device

Settle four things before the examiner arrives.

• Authority over devices and accounts. Confirm the estate controls the hardware and the cloud accounts. If records sit with a former officer, an outsourced IT provider or a hosting vendor, the turnover of debtor records route may need to come first.
• An examiner, a scope and a budget. Retain a forensic examiner the way you retain other estate professionals, with court approval where your district requires it, and agree a scope that covers servers, endpoints and cloud tenants rather than laptops alone.
• Credentials and keys. At the meeting of creditors, ask the debtor's representative for admin passwords, the MSP's contact details and the BitLocker or FileVault recovery keys, which are often escrowed in the company's directory service.
• Existing preservation duties. List pending litigation, regulatory inquiries and insurance claims that already require preservation, so the protocol satisfies them rather than running beside them.

How to image the debtor's systems, step by step

1. Freeze disposal. Send a short written hold to the landlord, the auctioneer and any IT asset disposal vendor: no wiping, recycling or sale of drives until the examiner releases each device. Pause retention policies that auto-delete mail and chat.
2. Build an image register. List every server, NAS box, laptop, desktop, company phone and removable drive with serial number, assigned user, location and encryption status. Add every cloud system with its admin owner: mail, chat, file shares, CRM, accounting, ticketing and code repositories.
3. Write the protocol. One or two pages is enough: what will be collected, by which method, how images are verified, where copies are stored, who may access them and what the examiner delivers at the end.
4. Capture the hardware. Take full images through write blockers, record a hash value at acquisition and again at verification, and photograph each device with its label and serial plate.
5. Collect the cloud. Use each platform's own administrative export or eDiscovery tools, keep the export logs, and confirm what the subscription level allows before the tenant lapses. The vendor's current documentation, not anyone's memory, sets those limits.
6. Log the chain of custody. For each item, record who collected it, when and where, its hash, where it is stored and every later transfer, signed at each handoff.
7. Store two verified copies. Keep them encrypted and in separate locations, with at least one under the estate's control rather than the examiner's alone.
8. Screen before review. Run a privilege filter and tag personal, health and client-confidential material before anyone reads content.
9. Ask for a system map. Have the examiner produce a metadata-only summary listing each system, its date range, approximate item counts and number of users. No content leaves the evidence store.
10. Release the hardware. Once images verify, equipment can be sanitized and sold. Destroying the records themselves follows the court's process; the guide to a motion to abandon and destroy books and records covers it.

What to screen first: privilege, personal data and client files

Screening is what turns one copy into a copy that can serve more than one purpose.

• Privilege. Which privileged communications the estate controls, and which belong to former officers personally, is a question for estate counsel. Tag traffic with outside law firms and in-house counsel so nothing privileged is reviewed or shared by accident.
• Health information. HR, benefits and leave files on a laptop can hold health information. Where any of it is protected health information, the HIPAA Privacy Rule recognizes two de-identification methods, expert determination and the safe harbor removal of 18 specified identifiers, as HHS guidance on de-identification explains.
• EU personal data. A debtor that offered goods or services to people in the EU may hold personal data covered by the General Data Protection Regulation, which can reach organizations based outside the EU.
• Client confidential material. Services firms often hold files that belong to their clients. Tag them so they never enter a licensing discussion.
• Personal devices. Do not image an employee's own phone or laptop without consent or a court order.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Common imaging mistakes and how to avoid them

How the same copy supports a records assessment later

A preserved, documented copy is what makes a records license possible after the business stops. AI labs and data buyers want long histories of real work, such as support tickets with their resolutions, project files, engineering history and decision trails, because agents that perform tasks are trained and tested on records like these, and such records rarely appear on the public web. Once the systems are switched off, the images and cloud exports may be the only complete record left.

SourceX can begin from the examiner's system map alone. It looks for a US business that reached 50+ full-time employees at peak (contractors excluded), operated for several years with documented records, holds the rights to license them and has someone with authority to sponsor the deal; in a chapter 7 case that decision rests with the trustee, subject to whatever court approval the case requires. A company that has stopped operating can still qualify if its data survives. The company fit checker gives a quick, non-binding read, and who qualifies sets out the full baseline.

Nothing moves until the estate decides. Price and terms are agreed with the trustee and signed before any data is prepared; de-identification and redaction rules are set first, and delivery draws on the preserved copy only under those terms. When the estate markets its assets, a records inventory folder in the bankruptcy sale data room keeps bidders' questions about the archive in one place.

Illustrative example: one imaging pass, three uses

Illustrative, fictional scenario. A 180-person freight software company converts to chapter 7. In the first week the trustee sends a no-wipe hold to the landlord and the equipment auctioneer, pays to keep the cloud tenant alive for one more billing cycle and retains an examiner. The examiner images four servers and 140 laptops, exports mail, chat, the ticketing system and the code repositories, and hashes every item.

Three uses follow from that single pass. Estate counsel reviews pre-filing transfers from the images. The auctioneer, engaged through the court's process for retaining an auctioneer or broker, sells the sanitized hardware. And the examiner's system map, showing roughly nine years of tickets, shipment exception records and engineering history, goes to SourceX for a preliminary assessment without any content leaving the evidence store.

Where referral partners fit in an estate case

Examiners, estate advisers and former executives often spot the value of a debtor's archive before anyone else. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and the reward is paid only after the buyer pays and SourceX receives its fee. It is never deducted from what the estate receives, and no reward is guaranteed.

Anyone with a role in the case, including professionals retained by the estate, should treat a referral relationship as something to disclose and should check it against their engagement terms and the court's rules before registering. The trustee can also bring the estate to SourceX directly, with no partner involved.

Next step

Before the next device leaves the premises, send the no-wipe hold and start the image register. If you advise estates and want to make introductions, register as a partner; a trustee who wants a preliminary view of the archive can apply directly at sourcex.si/apply.