NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.eDiscovery Specialist
Litigation and regulatory matters turn on emails, chats and documents in their thousands. The eDiscovery specialist collects them defensibly, processes them for review and keeps every step auditable.
Career guide8 skills5 courses
What the work is
- Scopes which custodians, systems and date ranges hold relevant data and documents the decisions.
- Issues and tracks legal hold notices so that data is not deleted in the normal course of business.
- Collects email, file shares, cloud collaboration data and mobile chats forensically, with hashes and collection logs.
- Processes data: de-duplication, removal of known system files, extraction of text and metadata, handling of encrypted or corrupt files.
- Loads data into review platforms, sets up searches and analytics and supports lawyers through the review.
- Produces documents in the agreed format with privilege and redaction handled, and prepares the documentation that shows the process was defensible.
- Handles cross-border matters where data protection law limits what can be moved and who can review it.
Skills to build
- Email systems and formats: Exchange, Microsoft 365, Google Workspace, PST and MBOX
- Collaboration platforms such as Teams and Slack and how their exports look
- Forensic collection from computers, phones and cloud sources
- Processing concepts: hashing, de-duplication, metadata fields, text extraction and OCR
- Search: keyword, Boolean and an understanding of analytics and technology-assisted review
- Chain of custody and defensibility documentation
- Data protection law, including the Digital Personal Data Protection Act 2023 and the General Data Protection Regulation for international matters
- Project management across lawyers, IT teams and vendors
Tools you will meet
How the role grows
Stages, not promises. Titles differ between employers and the time each stage takes depends on the cases you get to work on.
- 01eDiscovery Analyst or Litigation Support Analyst
Runs processing jobs, loads data, builds searches and learns the stages from hold to production.
- 02eDiscovery Specialist
Owns collections and processing on a matter, advises the legal team on scope and keeps the defensibility record.
- 03Senior Consultant or Project Manager
Runs large and multi-jurisdiction matters, manages vendors and budgets and testifies on collection and processing when needed.
- 04eDiscovery Practice Lead
Builds the practice, its workflows and its tooling, and answers to the firm or the client for how every matter was handled.
Start at DFRTI
NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.
LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.Disciplines to read first
Questions people ask
Is eDiscovery forensics?
It sits next to it. Collection uses forensic method. Processing and review are their own discipline with their own tools. Specialists who understand both are valued because they can defend the collection and run the review.
Do I need to know a particular review platform?
Employers often want experience on the platform they use, but the concepts transfer. Learn the stages well, from hold to production, and the platform becomes a tool you pick up.
Where do Indian specialists work?
Many Indian teams support matters in other countries for law firms and service providers, alongside domestic arbitration, regulatory and internal investigation work. Both need the same discipline.
Which DFRTI courses help?
Basics of Cyber Forensics for collection method, Legal & Court Procedures for how evidence is handled and challenged, and Cloud Storage Investigation for the collaboration data that now dominates review sets.
Career guides describe typical work and skills. They do not promise employment, placement or a salary, and roles vary between employers and countries.
Ready to start?
Tell a counsellor where you are today. They will suggest the first course and the track that leads to this role.