Recommendations for collection (text not held): choose among the available tools and methods, from forensic imaging that recovers deleted material to targeted exports by the user, according to the device, the data, the matter and the jurisdiction; accept custodian self-collection only where it is instructed, verified and defensible; use validated tools and verify copies, for example by hash values; document the collection so that it can be explained later; and prepare collection capability in advance, as ISO/IEC 27050-4 addresses under proactive collection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.