eDiscovery and Corporate Investigations

What it is and why it matters

Litigation and internal investigations run on documents, and almost every document an organisation holds today is electronic. Emails, chat messages, shared drives, ticketing systems and the laptops of a few key people may hold what a dispute turns on. eDiscovery is the process of identifying that material, stopping it from being deleted, collecting it in a defensible way, reviewing it for relevance and privilege and producing it to the other side, a regulator or a tribunal.

A corporate investigation uses the same machinery for a different purpose. Instead of answering an opponent's request, the organisation is asking its own question: did an employee leak a tender, did a vendor pay a kickback, did someone alter the books. The investigation is usually run by legal or compliance with forensic examiners doing the collection and analysis, and it may end in a disciplinary hearing, a police complaint or nothing at all.

What separates eDiscovery from ordinary IT housekeeping is defensibility. Every choice, from who was placed on hold to which search terms were run, may later be questioned by a court or an opponent. The Electronic Discovery Reference Model (EDRM) and The Sedona Principles give a shared vocabulary for those choices, and Indian law adds its own requirements on how electronic records are proved.

Types of digital evidence

Email and Mailboxes
Server-side mailboxes, PST and OST files and archive or journaling stores, with headers, attachments and the folder a message was filed in.
Chat and Collaboration Data
Teams, Slack and WhatsApp exports, channel history, reactions and edits, which carry conversation that never reached email.
Documents on File Shares and Cloud Drives
Office documents and their version histories on SharePoint, OneDrive, Google Drive and network shares, including who edited what and when.
Endpoint Data
Files, browser history, USB connection records and deleted material on the laptops of custodians, collected by forensic imaging where the matter justifies it.
Business System Records
ERP entries, CRM notes, HR records, access logs and approval workflows that show a transaction's path through the organisation.
Mobile Device Data
Messages, call logs and app data on company or personal phones used for work, collected only with the right authority and consent.
Audit and Access Logs
Authentication, file access and administrator logs that show who touched a record and when a hold or a deletion took place.
Structured Data Exports
Database tables and reports exported in a form that keeps field names, timestamps and record identifiers intact.

Devices and data sources

Microsoft 365 and Google Workspace tenants, including mail, drives and chat
On-premises Exchange servers and file servers
Laptops and desktops of named custodians
Company-issued and personally owned phones used for work, with consent and policy backing
Backup tapes and backup systems that hold earlier versions
Enterprise applications such as ERP, CRM, HR and ticketing systems
Cloud storage and SaaS applications used by teams, sometimes outside IT's knowledge
Printed documents scanned and coded alongside the electronic set
Third-party holders such as vendors, auditors and outsourcing partners

How an examination runs

The order matters. Each step protects the one after it.

01
Identify the Matter and the Custodians
Define the dispute or allegation, the date range and the people and systems likely to hold relevant material. Interview custodians about where they keep things, including personal devices and unofficial cloud tools.
02
Issue the Legal Hold
Send written hold notices, suspend automatic deletion and retention policies on the affected mailboxes and drives and record acknowledgements. A hold that was not logged is hard to prove later.
03
Collect Defensibly
Use tenant export tools, forensic collection software or full imaging depending on the matter. Record the method, the account used, the date and the hash of every export so the collection can be repeated or explained.
04
Process and Cull
Remove duplicates and system files, extract text and metadata and apply the date range and search terms agreed with counsel. Keep a log of what each step removed and why.
05
Review
Review documents on a platform for relevance, privilege and confidentiality, using tags, redactions and quality checks. Technology-assisted review can rank documents, but the protocol and the sampling must be defensible.
06
Analyse and Report
Build the chronology, link people to documents and summarise what the records show and do not show. In an investigation this is where the examiner separates fact from inference.
07
Produce or Act
Produce documents in the agreed format with a production log, or hand the findings to management, HR or the police. Where electronic records go to an Indian court they need a certificate under section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Electronically Stored Information: ESI, the general term for any information held in electronic form that may be subject to discovery, from email to database rows.
Custodian: A person whose records are collected because of their role in the matter. The custodian list drives the scope and the cost of the exercise.
Legal Hold: A written instruction to preserve records relevant to a matter and a matching technical freeze on deletion. Also called a litigation hold.
EDRM: The Electronic Discovery Reference Model, a widely used map of the stages from identification through preservation, collection, processing, review, analysis, production and presentation to disposition.
Processing: The technical step of unpacking collected data, extracting text and metadata, removing duplicates and preparing it for review.
Privilege: Protection for communications between a client and its lawyers. Privileged documents are identified in review and withheld or redacted, with a log of what was held back.
Technology-Assisted Review: Software that learns from reviewer decisions and ranks or classifies the remaining documents, used under an agreed protocol with sampling to show that it worked.
Production: The hand-over of reviewed documents in a set format, such as native files or images with load files, along with a log of what was produced.
Spoliation: The loss or alteration of evidence that should have been preserved. Tribunals may draw adverse inferences or impose costs when it happens.
Proportionality: The idea that the effort and cost of discovery should match the value and importance of the matter, which guides how wide a collection is cast.

Challenges and limits

What makes it hard

Data volume keeps growing while deadlines do not, so culling and review strategy decide whether a matter is affordable
Chat platforms split a conversation across channels, threads and reactions that do not read naturally when exported
Personal phones and private accounts used for work raise consent and privacy questions before anything can be collected
Cloud tenants retain data under their own rules, and an export may not include everything a forensic image would
Privileged and confidential material mixed into the set must be found before production, because it cannot be recalled afterwards
Indian evidence law needs a certificate for electronic records, so a collection done casually may be hard to prove in court
The Digital Personal Data Protection Act, 2023 governs personal data in the set, including the duty to report a personal data breach, which shapes how review and transfer are run

Keeping the evidence intact

Hash every export and image at collection and keep the hash in the collection log
Record the tool, version, account and filters used for every collection and processing step
Keep processing logs that show exactly what de-duplication and search terms removed
Apply redactions on copies and keep the unredacted set under access control
Track every transfer of data between the organisation, counsel and vendors in a custody record

Standards and legal considerations

EDRM Model
The Electronic Discovery Reference Model sets out the stages of eDiscovery from identification to disposition and gives lawyers, IT and examiners a shared vocabulary. EDRM 2.0 was released in 2026.
The Sedona Principles, Third Edition
Best practice recommendations from The Sedona Conference on preserving and producing electronic documents. Written for US practice, but widely read for its reasoning on proportionality and cooperation.
ISO/IEC 27050 Series
International guidance on electronic discovery. Part 1 gives an overview and concepts and ties the process to the evidence handling practices in ISO/IEC 27037:2012.
Bharatiya Sakshya Adhiniyam, 2023
Section 63 sets the conditions under which electronic records are admitted in Indian proceedings and requires the certificate in the Schedule, which records device details and hash values.
Read the guide
Digital Personal Data Protection Act, 2023
Applies when personal data is collected, reviewed or transferred in a matter. Section 8(6) requires a data fiduciary to inform the Data Protection Board and each affected individual of a personal data breach.
Read the guide

In practice

A Tender Leak
A company suspects that its bid price reached a competitor. Legal places a hold on five mailboxes and the shared bid folder, the examiner collects the tenant data and images two laptops and review finds a draft bid sent from a personal webmail account the evening before submission. The report sets out the chain of documents and leaves the question of intent to management.
A Regulator's Request With a Short Deadline
A regulator asks for all communications about a product recall over eighteen months. The team identifies twelve custodians, exports mail and chat with search terms agreed with counsel, removes duplicates and privileged advice and produces the set with a log that records every filter applied.
A Resignation Followed by a Competitor Launch
An engineer resigns and a rival announces a similar product months later. The imaged laptop shows a cloud sync client installed in the final fortnight and a folder of design files uploaded to a personal account. The finding is presented with the sync logs and timestamps rather than as a conclusion about what the engineer intended.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.IntermediateDCFA

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.IntermediateCloud / Network

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

Standards for this area

Careers that use it

Questions people ask

Is eDiscovery only for lawsuits?

No. The same identification, hold, collection and review steps are used for internal investigations, regulatory requests, audits and breach response. The difference is who asks the question and what happens with the answer.

Can we just ask IT to search the mail server?

An administrator search is fine for a quick look, but it rarely records how it was run, it changes nothing about retention and it misses deleted and archived items. If the matter may end in a dispute, use a collection method that is logged, hashed and repeatable.

Do we need to image every laptop?

Usually not. Imaging is reserved for custodians whose device behaviour matters, such as a suspected data theft. For most custodians a targeted collection of mail and documents is proportionate and far cheaper.

What does Indian law require when we produce electronic records?

The Bharatiya Sakshya Adhiniyam, 2023 requires a certificate under section 63 in the form given in its Schedule, signed by the person in charge of the device or activity and by an expert, with the hash values of the records. This page is educational, so take advice from counsel on your own matter.