I’m writing this from the lab, somewhere between hour nine and hour fourteen of another mobile device collection, watching a progress bar crawl across the screen like it, too, is questioning its life choices.

This is no longer a storage arms race. It’s an arms escalation.

We now live in a world where 1TB smartphones are routine, and 2TB devices are entering the market. What used to be enterprise-scale storage now fits in a pocket, rides in an Uber, and refuses to be without Wi-Fi for more than fifteen minutes.

And yet, somehow, the expectations around collecting that data haven’t changed.

Clients expect collections to be fast.
Custodians expect to be without their devices for no more than a few hours.
Legal teams expect completeness, defensibility, and precision—without compromise.

Those expectations no longer coexist comfortably.

Because the reality on the ground looks very different.

Over the course of two days, I imaged two separate 1TB iPhones. The first took approximately eight hours and contained over 11,000 videos—an immediate lesson in how modern users don’t just create data, they accumulate it, at scale. The second device held roughly 600GB of user data but expanded into a 1.2TB Cellebrite extraction—what we see in practice as “data bloom,” where the underlying structure, iCloud content, application data, and recoverable artifacts dramatically increase the footprint once collected.

That second device still took over six hours to acquire with a custodian’s hand nearly “pulling the plug” with a hard stop to head to the airport. “I’ll transfer it to my car and drive her to the airport” I mouthed silently to myself, in the hopes of buying 45 more minutes.

And that’s with experienced hands, proper tooling, and a controlled environment.

This is the new baseline.

What we’re dealing with now isn’t just “more data.” It’s a different kind of data environment entirely—what I’ve started calling the Terabyte-o-taurus era. Devices swollen with photos, videos, chat threads, duplicates of duplicates, and cloud-synced redundancies that exist simultaneously everywhere and nowhere.

Users are no longer just generating data. They are archiving their lives—indiscriminately.

And that has consequences.

From a forensic standpoint, the traditional approach; collect everything, process everything, sort it out later—is becoming increasingly difficult to justify. Not just operationally, but legally.

Because this is where discovery scale collides directly with proportionality and cost.

The fact that a device can hold a terabyte of data does not mean a case should involve collecting all of it. Yet for years, defensibility has been tied to completeness. That mindset made sense when datasets were measured in gigabytes. It breaks down when we are routinely generating terabyte-scale outputs from a single custodian.

At that scale, over-collection is no longer neutral. It drives cost, delays review, increases privacy exposure, and burdens every downstream phase of discovery.

So, something has to change.

The old adage, “collect large-produce small’ model didn’t mean THIS large.

The solution is not to abandon defensibility, it is to modernize methodology.

At Veracity, we’ve leaned into that reality. We’ve invested in the hardware, software, and most importantly, the training required to handle these oversized datasets without defaulting to outdated workflows. That means moving away from a one-size-fits-all collection model and toward a methodology-driven approach grounded in proportionality and case strategy.

Not every device requires a full physical or file system extraction. In many civil matters, advanced logical or even standard logical collections, properly scoped, capture the relevant data while significantly reducing burden and cost. Remote and cloud-based collections can further minimize disruption to custodians while still preserving critical evidence streams.

The key is not choosing the most aggressive method. It is choosing the right method.

That decision depends on the device, the operating system, the user behavior, the claims at issue, and the proportionality factors that govern modern discovery. It requires early case assessment, informed conversations at the Rule 26(f) stage, and a willingness to define scope before the first cable is plugged in.

Because here’s the reality: the longer we pretend every case justifies collecting everything, the more we amplify the very problems we’re trying to solve.

Longer collections.
Higher costs.
Slower review.
Greater risk.

The frustration many forensic practitioners feel right now is real. The tools are working. The devices are working. But the expectations haven’t caught up to the environment those tools are operating in.

That gap is where cases get inefficient and where strategy matters.

Handled correctly, these large datasets don’t have to be a liability. They can be managed, scoped, and defensibly reduced to what actually matters. But that requires a shift in approach from reactive collection to proactive methodology.

It also requires the right partner.

Veracity has built its practice around exactly this problem set. We understand the pain points because we see them every day, devices that take 6 to 14 hours to acquire, custodians who can’t be offline, datasets that double in size once processed, and legal teams trying to balance cost against completeness.

And we’ve structured our workflows to address them.

That means:
– Selecting collection methods aligned with proportionality, not defaulting to maximum depth
– Leveraging targeted and remote acquisition where appropriate
– Managing data expansion and downstream processing from the outset
– Advising counsel early so scope decisions are intentional, not reactive

The landscape has changed. The devices are bigger. The data is denser. The expectations are higher.

But the solution isn’t to push harder against the problem, it’s to approach it differently.

Everyone may be a data hoarder now.

That doesn’t mean discovery has to pay the price.