eDiscovery and the digital forensics methods used in investigations are generally considered to be two distinct approaches that, like oil and water, don’t always mix well. But while each process does have its own unique characteristics and goals, they’re surprisingly complementary to one another, making them more like oil and vinegar. When combined, the whole is greater than the sum of its parts, leading to higher efficiency and better results.
If your organization conducts both eDiscovery and forensic investigations in house, learning how to blend the two and leverage each at the appropriate time can save you valuable time and money.
In this post, we’ll discuss the basics of eDiscovery and digital forensics, pointing out their similarities and differences. We’ll then give you the run-down of best practices for taking a combined approach to these two processes.
Contents:
Basics and use cases for eDiscovery and digital forensics
eDiscovery vs Digital Forensics: Comparing and contrasting the two
3 best practices for combining eDiscovery and digital forensics
Deliver repeatable, defensible results by combining eDiscovery and digital forensics
eDiscovery and Digital Forensics basics and use cases
Before we get into the interplay between eDiscovery and digital forensics, let’s define each term and go over use cases for each.
What is eDiscovery?
eDiscovery is the process of seeking, locating, securing, and searching electronically stored information (ESI) for use in a legal case. Under the Electronic Discovery Reference Model (EDRM), the stages of eDiscovery are information governance, identification, preservation, collection, processing, review, analysis, production, and presentation.
What are the eDiscovery use cases?
eDiscovery generally involves investigating data and reviewing a large volume of documents or other types of data. But the exact process and goals of eDiscovery vary with each case. eDiscovery may involve a wide variety of matters, from corporate investigations into money laundering or fraud to litigation matters involving intellectual property disputes, employment claims, or commercial and shareholder disputes. eDiscovery approaches are also used in compliance matters concerning anti-trust, environmental, and privacy regulations, among others. Finally, an eDiscovery process is also commonly used during mergers and acquisitions as companies review documents during due diligence.
Each of these types of cases comes with its own challenges and demands. When it comes to internal investigations, for example, an organization must prioritize fact-finding as the primary goal. On the other hand, data subject access requests (DSAR) require organizations to rapidly identify relevant documents and prepare them for disclosure by removing sensitive or confidential details.
What is Digital Forensics?
Digital forensics, on the other hand, is the use of scientific methods for preserving, collecting, validating, identifying, analyzing, interpreting, documenting, and presenting ESI as part of an investigation, usually into unlawful activity. The stages of a digital forensics investigation are preparation, identification, preservation, collection, examination, analysis, and presentation.
What are the Digital Forensics use cases?
Digital forensics requires broad knowledge of various investigative techniques. Digital investigators typically aim to:
- find deleted files;
- reconstruct timelines using artifacts such as operating system and web histories; and
- analyze operating systems and metadata to draw conclusions.
Imagine that your organization suspects an employee of unlawfully retrieving information from a company computer and saving it to a USB drive. If your organization uses Microsoft Windows, your forensic investigator would need to access the Windows Registry, a collection of databases that stores information and settings for Windows operating systems. Your investigator would then analyze the Registry to see whether a USB drive was present in the suspect’s laptop at a given time.
But digital forensics isn’t just about understanding computers and data. Depending on the nature of the investigation, digital forensics can also require specific subject matter expertise, such as automotive or heavy machinery forensics. For example, your company may own a piece of equipment like an elevator or forklift that is alleged to be the source of a devastating fire. A heavy equipment forensic investigator can use their expertise to determine whether the fire can be linked back to your equipment.
Where do eDiscovery and digital forensics overlap and where do they differ? Let’s go over their key differences and similarities.
eDiscovery vs Digital Forensics: Differences & similarities
eDiscovery and digital forensics have some overlap, but they are not entirely the same.
Understanding the differences between eDiscovery and forensic challenges is paramount to leveraging each and performing effective and comprehensive investigations. By the same token, understanding the similarities between eDiscovery and digital forensics can help you understand how to take a strategic, combined approach that incorporates each at the appropriate time.
Here are some of the key differences and similarities between the two processes.
Key differences
eDiscovery is about gathering relevant ESI and combing it for evidence. Unlike digital forensics, eDiscovery does not directly contemplate ESI that has been deleted, tampered with, or hidden.
Digital forensics, on the other hand, often comes into play when ESI is unavailable or inaccessible, such as when a bad actor has deleted files or falsified information. Put simply, digital forensics is all about finding and uncovering ESI. As such, digital forensics tends to be a more technical task than eDiscovery and requires different tools, training, and experience.
Similarities
While the aims and approaches are different, both eDiscovery and digital forensics involve preserving, collecting, analyzing, and presenting large amounts of ESI.
Further, eDiscovery teams and forensic investigators both use case information to refine their searches and process the material they find to ensure it is reviewable by users. They also share many of the same goals, including making the best use of valuable resources, sharing their workloads, and automating their processes wherever possible.
The following table outlines the differences and similarities described above plus a few additional details to provide a complete picture of eDiscovery versus digital forensics.
.png)
Now that we’ve covered the key differences and similarities between eDiscovery and digital forensics, let’s discuss best practices for taking a combined approach.
3 best practices for combining eDiscovery and digital forensics
While eDiscovery relates to and overlaps with digital forensics, both processes are necessary parts of performing a comprehensive investigation.
Here are three ways to combine eDiscovery and digital forensics practices for greater efficiency and effectiveness.
- Avoid using only readily available and extractable ESI
When it comes to internal investigations in particular, it can be tempting to assume that all of the information you need is readily available and extractable and therefore to focus only on the ESI that is right in front of you. However, this can jeopardize your investigation if there is important data that has been removed or hidden, leading to inadequate eDiscovery and potential liability. When performing an investigation, leave room for the possibility that evidence may have been accidentally or deliberately hidden, modified, or deleted.
- Use digital forensics results to aid your eDiscovery process
As explained above, digital forensics may reveal evidence that has been hidden, tampered with, and deleted. In addition to being collected as part of eDiscovery, this evidence can also be used to inform the search process and point to other data that should be assessed for eDiscovery purposes.
- Employ the right technology
Technology plays an increasingly major role in both eDiscovery and digital forensics practices.
For example, ZyLAB’s comprehensive eDiscovery platform uses defensible eDiscovery strategies and lets you complete the process faster than ever. The platform features multiple templates to assist you with taking different approaches to different kinds of cases and achieving specific goals.
To perform in-house investigations to the best of your ability, you can use a combination of tools that assist with both eDiscovery and digital forensics. These tools can help you adapt to the ever-expanding amount and types of data your organization must deal with. By investing in the right technology, your organization can perform comprehensive investigations more efficiently than ever.
For more valuable insights about successfully combining eDiscovery & digital forensics practices, access our most recent webinar recording.
Deliver repeatable, defensible results by combining eDiscovery and digital forensics
When you combine eDiscovery and digital forensics practices, you can achieve results that are comprehensive, defensible in court, and easy to replicate during future investigations.
As noted above, combining eDiscovery with digital forensics can help ensure that you collect all of the ESI that is relevant to the case at hand. Digital forensics can also help inform the eDiscovery process.
[View source.]
