Same data, different questions
The laptop of an employee who has left, his Exchange mailbox, a Teams channel: at the start, both disciplines have the same material on the table. The difference lies in the question you ask of it.
- eDiscovery asks: What is in the data – and which of it is relevant to the case?
- Forensics asks: What happened on the system – who did what and when, and was anything hidden or deleted?
Confuse the two and you either pay for depth you do not need, or find out too late that the decisive trace was never preserved.
eDiscovery: from a mountain of data to the relevant document
The reference framework for eDiscovery is the Electronic Discovery Reference Model (EDRM). It describes nine stages, from information governance through identification, preservation and collection to processing, review, analysis, production and presentation [1]. Importantly, the EDRM explicitly sees itself as a conceptual model, not a rigid sequence. Stages can be skipped, run in a different order or repeated several times [1].
Three stages form the core:
- Processing reduces the data volume and puts the data into a form that can be reviewed [1].
- Review assesses documents for relevance and for protected content (privilege) [1].
- Analysis evaluates content and context – patterns, topics, people, conversation threads [1].
The result is a reviewed, coded document set: the basis for a production, a response to an authority or a robust chronology of the facts. eDiscovery works in breadth – many custodians, often hundreds of thousands or millions of documents.
Forensics: reconstructing events
According to the definition of the US National Institute of Standards and Technology (NIST), digital forensics is the application of science to the identification, collection, examination and analysis of data while preserving its integrity [2]. NIST divides the process into four phases: collection, examination, analysis and reporting [2].
Forensics works in depth. It is less interested in the content of a document than in the traces an action leaves behind: deleted files, unallocated space, system logs, connected USB devices, browser and synchronisation artefacts. The result is a report with findings, a timeline and a traceable, reproducible methodology – something that has to withstand scrutiny by the opposing party or a court.
The course is set at preservation
Both disciplines begin with preservation – and that is exactly where the most consequential decision is made. The EDRM Collection Standards distinguish, among others [3]:
- Forensic image: an exact, sector-by-sector copy of the storage medium that captures active and inactive data. Verifiable at device and file level, but more effort.
- Targeted collection: only active files and folders from the file system.
- Non-forensic copy: copying via the operating system. Highly dependent on the custodians; filters applied during collection can miss files.
The EDRM also recommends that a forensic image be examined by a qualified examiner with courtroom experience as part of a forensic analysis [3].
This leads to a simple rule: a targeted collection is enough for eDiscovery – but it rules out forensics after the fact. What was not preserved cannot be analysed. Once the laptop has been reimaged and handed to the next person, the traces are gone.
The difference at a glance
| eDiscovery | Forensics | |
|---|---|---|
| Key question | What does it say, what is relevant? | What happened – how, when, by whom? |
| Data basis | Active data: emails, documents, chats, cloud | Also deleted, hidden and system-level data |
| Focus | Breadth: many people, large volumes | Depth: few devices, detailed traces |
| Methods | Processing, deduplication, search terms, AI-assisted review | Imaging, hashing, artefact analysis, timeline |
| People involved | Lawyers, reviewers, project management | Forensic examiners |
| Result | Reviewed document set, production, chronology | Expert report with findings and methodology |
| Cost drivers | Data volume and review hours | Number of devices and depth of analysis |
When you need which
eDiscovery when it is about content: production requests in civil proceedings, information requests from regulators, internal investigations into suspected corruption or compliance breaches where the communication itself is the evidence.
Forensics when it is about actions: suspected data exfiltration via USB or cloud, suspected deletion or manipulation, doubts about the authenticity of a document, cyber incidents.
Both when content and action belong together – and that is more common than you might think. A typical example: the suspicion that an employee who has left took trade secrets with him. Forensics shows that design data was copied to a USB stick on the evening before he resigned. eDiscovery shows in the emails whom he had been talking to about a move in the weeks before. Only together do they produce a picture that holds.
The disciplines also feed each other: file names and timestamps from forensics become search terms in review; leads from review point to further devices that need forensic examination.
The legal framework
The reference models come from the Anglo-Saxon world; internationally, ISO/IEC 27037 adds guidelines for the identification, collection and preservation of digital evidence [4]. For investigations in Switzerland, the Federal Act on Data Protection [5], employment law in the Code of Obligations [6] and – where foreign proceedings or authorities are involved – the Swiss Criminal Code [7] are particularly relevant.
Which requirements apply in a specific case, and how far a data collection may go, is a legal question and belongs with a law firm. In such mandates we work closely with our clients’ legal counsel.
Regardless of that, one thing applies to both disciplines: complete documentation of the chain of custody is not an extra, but a precondition for the evidence to be usable.
Conclusion: three questions before you start
- Is it about content or about actions? Content points to eDiscovery, actions to forensics.
- Could anyone dispute that the data is complete and unaltered? Then you need forensic methods – at least for preservation.
- Who will scrutinise the result? The opposing party, a court and an authority each set different requirements for method and proof.
And if the answers are not yet clear: preserve forensically, analyse selectively. The analysis can always be deepened. Preservation cannot be done after the fact.
This article is for general information only and does not constitute legal advice. For a legal assessment of your case, please consult a law firm.
Sources
[1] EDRM (edrm.net): EDRM Model – https://edrm.net/wiki/edrm-model/
[2] Kent, K. et al.: NIST Special Publication 800-86 – Guide to Integrating Forensic Techniques into Incident Response, National Institute of Standards and Technology, 2006 – https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
[3] EDRM (edrm.net): EDRM Collection Standards – https://edrm.net/frameworks-and-standards/edrm-model/edrm-stages-standards/edrm-collection-standards/
[4] ISO/IEC 27037:2012 – Guidelines for identification, collection, acquisition and preservation of digital evidence – https://www.iso.org/standard/44381.html
[5] Federal Act on Data Protection (FADP), SR 235.1 – https://www.fedlex.admin.ch/eli/cc/2022/491/en
[6] Swiss Code of Obligations (CO), SR 220 – https://www.fedlex.admin.ch/eli/cc/27/317_321_377/en
[7] Swiss Criminal Code (SCC), SR 311.0 – https://www.fedlex.admin.ch/eli/cc/54/757_781_799/en
Content from edrm.net is licensed under Creative Commons Attribution 4.0 International.