Embracing Differences? Interplay of Digital Forensics in eDiscovery

Editor’s Note: From time to time, ComplexDiscovery highlights publicly available or privately purchasable announcements, content updates, and research from cyber, data, and legal discovery providers, research organizations, and ComplexDiscovery community members. While ComplexDiscovery regularly highlights this information, it does not assume any responsibility for content assertions.

Contact us today to submit recommendations for consideration and inclusion in ComplexDiscovery’s data and legal discovery-centric service, product, or research announcements.

Industry Report

Interplay of Digital Forensics in eDiscovery

By Sundar Krishnan and Narasimha Shashidhar

Shared with permission from authors Sundar Krishnan and Narasimha Shashidhar, the following paper explores the relationship between the disciplines of digital forensics and eDiscovery and highlights key areas of interest ranging from digital forensics skills to forensic opportunities relative to the eDiscovery industry.

Abstract

Digital forensics is often confused with eDiscovery (electronic discovery). However, both the fields are highly independent of the other but slightly overlap to assist each other in a symbiotic relationship. With decreasing costs of cloud storage, growing Internet speeds, and growing capacity of portable storage media, their chances of being used in a crime have grown. Sifting through large volumes of evidential data during eDiscovery or forensically investigating them requires teams from both these fields to work together on a case. In this paper, the authors discuss the relationship between these disciplines and highlight the digital forensic skills required, sub-disciplines of digital forensics, the possible electronic artifacts that can be encountered in a case, and the forensic opportunities relative to the eDiscovery industry. Lastly, the authors touch upon the best practices in digital evidence management during the eDiscovery process.

Introduction Extract

When a civil lawsuit is filed, both the parties in the lawsuit engage in a pre-trial process known as “discovery”. During this process, each party may request documents and other evidence from the other or compel the other to produce such evidence using subpoenas or other legal instruments.

When such documents or evidence are in an electronic/digital format, this process is known as eDiscovery. Any potentially relevant digital evidence deemed necessary by either party may be subject to the eDiscovery process. This corpus of electronic/digital documents or other evidence is known as Electronically Stored Information (ESI). When civil litigation is reasonably anticipated by an organization or individual, they are expected to preserve prospective ESI from destruction. If/When litigation commences, eDiscovery follows wherein each party may be required to declare their ESI relevant to the case. Suppose the other party to the litigation requests this ESI for their own case preparation, the other party may produce this ESI in its original format if it seems related to the case, not privileged, within reasonable costs, and is reasonably accessible. Such ESI may not always be readily available and may need skilled professionals to forensically extract it from electronic devices. Thus, digital forensic professionals may participate alongside Discovery teams from both parties in forensically producing ESI during litigation. Parties to the case may engage digital forensic professionals on both sides if needed to assist in forensically producing ESI and also in validating the other’s ESI production methods.

Initially, the field of digital forensics was limited to personal computer disks. However, over the last few decades as computers have become connected through networks (local and the Internet) coupled with the growth of the cloud and smart devices such as smartphones, Internet Of Things (IoT), smart medical devices, smart energy grids, smart wearables, etc., personal computer forensics has now grown into digital forensics to encompass the investigation and analysis of these smart devices. The field of digital forensics has also expanded to include network forensics as well, which focuses on investigating networks for security breaches, hacking attempts, and data theft. In the last few decades, federal/state criminal investigators, global corporations, law firms, and private/public enterprises have relied on digital forensic investigators to investigate issues involving criminal activities, intellectual property theft, patent infringement, data theft, misconduct, and embezzlement. A digital forensic professional is someone who has a desire to follow the evidence, thereby assisting the lead investigators by identifying and analyzing digital clues from a pile of digital evidence. Digital forensic experts require a specialized skills to investigate various platforms such as the Internet, computers, smartphones, cloud, IoT, medical devices, accounting data, etc. To become a part of a digital forensic team, a digital forensic professional needs to coordinate with different teams in the investigation. Other teams in an investigation may be from law enforcement when in criminal cases and eDiscovery teams when in non-criminal (civil) litigation.

Complete Paper: Interplay of Digital Forensics in eDiscovery (PDF) – Mouseover to Scroll

Read the original paper.

Reference: Krishnan, S. and Shashidhar, N., 2021. Interplay of Digital Forensics in eDiscovery. [online] International Journal of Computer Science and Security (IJCSS), pp.19-44. Available at: https://www.cscjournals.org/manuscript/Journals/IJCSS/Volume15/Issue2/IJCSS-1602.pdf.

Additional Reading

• An Economical Impact? How Cyber Insurance Shapes Incident Response
• Defining Cyber Discovery? A Definition and Framework

Source: ComplexDiscovery