What is e-discovery?

What is e-discovery?

E-discovery, short for electronic discovery, is the process of identifying, preserving, collecting, reviewing and producing electronically stored information (ESI) as evidence in a lawsuit, regulatory investigation or other legal proceeding. ESI covers almost anything digital: email, chat and collaboration messages, documents, spreadsheets, databases, logs, voicemail, text messages, cloud storage and the metadata attached to all of it. In US federal courts, the Federal Rules of Civil Procedure have addressed ESI explicitly since amendments in 2006, so a party can be required to produce electronic records just as it once produced paper files.

Legal counsel runs e-discovery. IT and security teams find the data, preserve it, collect it in a defensible way and hand it over; they don't decide what is relevant or privileged.

The stages of e-discovery

The common industry reference is the Electronic Discovery Reference Model (EDRM), which describes these stages:

1. Information governance: managing data well before any dispute, with retention schedules and known data locations.
2. Identification: finding the custodians and systems that hold potentially relevant ESI.
3. Preservation: protecting that data from deletion or change, usually through a legal hold.
4. Collection: gathering the data with its metadata intact, using methods that can be explained and repeated.
5. Processing: reducing volume by removing duplicates, often matched by hash, filtering by date range and keyword, and converting formats.
6. Review: attorneys examine the data for relevance and privilege.
7. Analysis: evaluating content for patterns, key topics and people.
8. Production: delivering the relevant, non-privileged data to the other side in an agreed format.
9. Presentation: using the evidence in depositions, hearings or trial.

Example: a breach lawsuit

A retailer suffers a breach of customer card data, and a class action follows. Counsel issues a legal hold the day the breach is confirmed, so mailbox purges and log rotation stop for the incident team, the payments team and executives. Months later the plaintiffs request incident tickets, firewall and SIEM logs for the attack window, the forensic report and internal messages about a delayed patch. IT runs searches with the email and chat platforms' eDiscovery tools, exports the results with metadata, and hashes each export so its integrity can be shown later. Counsel reviews the results, withholds privileged communications and lists them on a privilege log, and produces the rest. Because the hold went in early, nothing relevant was lost to routine deletion.

Why e-discovery matters to security teams

• Anything written during an incident may be produced. Tickets, chat and email should be factual and free of speculation.
• Retention is a security decision. Keeping data longer than needed means more to protect and more to produce; deleting it too early, or after a hold, can bring sanctions.
• Architecture affects discovery. Data an organization can't search, such as end-to-end encrypted messages it holds no keys for, is harder to preserve and produce.
• Collection must be defensible. Exports should keep metadata, be logged and be verifiable by hash.

E-discovery vs. legal hold vs. digital forensics

• Legal hold is one step inside e-discovery: the instruction to preserve relevant data and suspend deletion.
• E-discovery is the whole legal process, from identification to production.
• Digital forensics investigates what happened on systems, including deleted files, memory and attacker activity. Forensic findings can become ESI produced in e-discovery, and some e-discovery collections use forensic methods.

E-discovery on the CompTIA Security+ exam

E-discovery is covered in objective 4.7 on SY0-801, with the evidence handling concepts of the incident response process. A question about finding and producing electronic records, such as email, chat and documents, for a lawsuit or regulatory request points to e-discovery. The usual distractors are legal hold, which is the preservation step rather than the whole process, chain of custody, which tracks who handled a specific piece of evidence, and digital forensics, which investigates the technical facts of an incident. If the scenario is about stopping deletion because a lawsuit is expected, choose legal hold; if it is about searching for and handing over the records, choose e-discovery.