Handbook of Digital Forensics and Investigation

Chapter 3. Electronic Discovery

James O. Holley, Paul H. Luehr, Jessica Reust Smith and Joseph J. Schwerha IV

Contents

Introduction to Electronic Discovery63

Legal Context66

Case Management74

Identification of Electronic Data78

Forensic Preservation of Data83

Data Processing106

Production of Electronic Data130

Conclusion132

Cases132

References132

Introduction to Electronic Discovery

Electronic discovery or “e-discovery” is the exchange of data between parties in civil or criminal litigation. The process is largely controlled by attorneys who determine what data should be produced based on relevance or withheld based on claims of privilege. Forensic examiners, however, play crucial roles as technical advisors, hands-on collectors, and analysts.

Some ...