What is data collection?¶

Data collection is gathering information for later use or transfer. Searching for or opening data is not automatically collection, and collection is not automatically exfiltration.

Separate the data stages¶

Distinguish discovery, access, selection, copying or export, staging, transfer and later use. A directory listing shows names; a read event shows interaction; a database export or copied file can show collection; a network event may show transfer.

File, application, database, cloud, process, archive and network records should be joined using stable object identifiers and time. For applications and databases, query and export parameters may define the selected scope more reliably than later filenames.

Account for non-file collection¶

Screenshots, clipboard capture, printing and on-screen viewing can gather information without a conventional copied file. Preserve the relevant process, session and application audits.

Indexing, backup and security tools can also access many files. Context, account, process and targeted sequence distinguish routine handling from deliberate selection. Keep the account holder separate from a remote or automated controller.