Following a cybersecurity incident at an organization, a forensic investigator is tasked with collecting Electronically...

As defined in the CHFI v11 Procedures and Methodology domain, directed collection is an eDiscovery methodology in which investigators deliberately limit evidence collection to specific data sets, file types, directories, custodians, or system areas that are known or highly likely to contain relevant information. This approach is commonly used to reduce data volume, minimize business disruption, and lower legal and operational costs while maintaining forensic relevance.

In the given scenario, the investigator intentionally restricts the scope of ESI by targeting specific directories and file types , rather than collecting full disk images or all user data. CHFI v11 explicitly describes this as directed (or targeted) collection , which is aligned with the Electronic Discovery Reference Model (EDRM) best practices. Directed collection helps investigators remain compliant with legal proportionality requirements and reduces exposure to irrelevant or private third-party data.

The other options do not match the scenario. Custodian self-collection introduces risk and is generally discouraged due to evidence integrity concerns. Incremental collection focuses on changes since a prior collection, not selective scope reduction. Remote acquisition refers to the method of access, not the collection strategy itself.

CHFI v11 emphasizes directed collection as a preferred methodology when investigators already understand where relevant evidence resides and need to collect it efficiently and defensibly. Therefore, the correct and CHFI v11–verified answer is directed collection of definite data sets and system areas , making Option D correct.