From the practice of digital evidence.
Articles on eDiscovery, forensics and evidence preservation: how data is secured, examined and prepared so that the findings hold up later. Written for law firms and compliance leads who work with it.
Articles
Four foundational articles on digital evidence. They build on one another; we suggest reading them in this order.
Investigate
eDiscovery or forensics? Where the difference lies and why it matters for your case
Investigate
Beyond E-Mail
Investigate
The Art of Chain of Custody
Investigate
Who Saw What?
What the articles are about
The right method: eDiscovery asks what the data contains, forensics what happened on a system. Settle this early and you preserve the right data and do not pay for depth you do not need.
New sources of evidence: decisions are increasingly made in chat. Preserve only e-mail and you see the official version. Chats belong preserved as threads with metadata, not as screenshots.
The unbroken path: evidence is only as strong as the documentation of its path, from preservation through every handover to submission, with a matching hash value at each step.
Access: the chain of custody also includes proof of who could see the data on the review platform, and when — complete, dated and readable.
The line to legal advice: we refer to legislation and recognised standards. The legal assessment of your case belongs with your law firm.