eDiscovery vs digital forensics: the difference and the overlap

eDiscovery and digital forensics answer different questions about the same data. eDiscovery asks which documents are relevant to a dispute and puts them in front of lawyers in a form the other side has agreed to. Digital forensics asks what happened on a device or an account: what was deleted, what was connected, what the sequence was. Most matters need only the first. The ones that need both need them at the same point, which is collection.

How does digital forensics differ from eDiscovery?

On six dimensions, and the first of them decides the rest.

eDiscovery and digital forensics compared on six dimensions

Dimension	eDiscovery	Digital forensics
What it answers	Which documents are relevant, and what do they say	What happened on this device or account, and when
Data it touches	Active ESI taken as files and messages: mailboxes, documents, chat, cloud accounts	The storage medium itself, including deleted remnants and unallocated space
Who performs it	Counsel and a service provider, working in a review platform	A trained examiner instructed for the purpose
What comes out	A production: images or natives with a load file, and a privilege log	A report, with the examiner available to give evidence on it
Cost of being wrong	Usually repeated work: a re-collection, or a re-production	A finding that cannot be relied on
When you need it	Whenever ESI is discoverable, which is most matters	When the device, the deletion or the sequence is itself in issue

Two rows repay a second reading. The data row is where the disciplines physically part: a collection takes files and messages as objects, while a forensic acquisition takes the storage medium and everything on it, including space the file system no longer claims.

The cost row is not a difference of degree. A production that fails to load is re-run, and the production checklist exists to catch that before it happens. A forensic finding that cannot be relied on is not re-run, because the device has usually moved on by the time anyone knows.

Is digital forensics part of the eDiscovery process?

Not a stage of it, but it meets one stage.

The nine stages set out in the eDiscovery process guide describe a workflow that ends in a production, and forensics is not among them. Where the two meet is collection. A forensic acquisition can be the way data comes off a source, and when it is, everything downstream proceeds exactly as it otherwise would: the same processing, the same review, the same production.

That is the useful way to hold the relationship. Forensics is a method available at one stage, and separately a discipline that answers questions the workflow never asks. A matter can use the method without ever needing the discipline, which is what happens whenever a departing employee’s laptop is imaged as a precaution and nobody ever looks at what was deleted from it.

What can a forensic examiner recover?

Things that are no longer files, and things that were never documents.

Deleted data is the obvious case, and it is recoverable only through forensic reconstruction, which is why Rule 26(b)(2)(B) treats it as a candidate for the not reasonably accessible tier rather than as ordinary discovery. A forensic acquisition reaches it because it copies the medium rather than the file system’s view of it.

Beyond deleted content there are artifacts that were never documents at all: which devices were attached, which accounts were signed in, what a phone’s application databases still record about a message that was removed. None of that surfaces in a collection, because a collection takes the things a custodian has and these are traces of what a custodian did.

The acquisition itself is made with tooling that reads the source without writing to it, a write blocker in the device case, and a hash value is computed at the moment of acquisition so the copy can be verified afterwards. That is the discipline the chain of custody entry describes, applied to a whole device rather than to a mailbox export.

When do you need both on the same matter?

Three situations, and none of them announces itself when the matter is scoped.

A question about deleted data. Someone says a document existed and it is not in the collection. Answering that is not a review task, because it needs the source examined rather than searched. Where the data is reachable only by reconstruction it may also be argued into the inaccessible tier, which turns the question into a proportionality argument before it becomes an examination.

A device standard tooling cannot collect. Mobile is the usual one: messages sit in application databases rather than in files, so a phone needs a device-specific extraction rather than an export. A custodian whose personal device is in scope, or a machine with no management agent on it, arrives at the same place.

A spoliation allegation. This is the one that converts work already done. A collection that was proportionate and properly documented becomes the subject of a motion, and defending it means establishing what existed and when it stopped existing, which is forensic analysis. How expensive that gets is decided by the documentation: acquisition hashes and a custody record answer most of it on paper, and neither can be assembled afterwards.

The pattern across all three is that forensics arrives late, on a matter everyone had scoped as ordinary. That is the argument for collecting defensibly while nothing suggests you will need to.

Who pays for forensic work, and on which invoice?

On a different one, usually, and that is the practical difference rather than the price.

The Fee Field Guide sets out nineteen fee types across five categories and forensics is not one of them. The category that touches it is collection, billed per custodian, per source, or at hourly forensic rates, which is the line a forensic acquisition performed as part of a collection falls under. An examination is a different thing from an acquisition, and normally a separate engagement with its own scope and its own rate, because it is answering a question rather than producing a set.

So what this page can tell you about the cost is which side bills it, not what it comes to. There is no market range to quote here and inventing one would be worse than leaving the question open. What is worth asking a provider is whether the collection rate covers device imaging and mobile extraction or whether those are quoted separately, which is the same scrutiny the Fee Field Guide applies to forensic hourly rates charged for routine cloud pulls.

How this works on a flat rate

Kavarn, the flat-rate eDiscovery service Konvergence Inc operates, covers processing, hosting, review access and productions in one instance rate. A forensic examination is not part of that and should not be presented as though it were: an examiner is a separate instruction whoever holds the data.

What the flat rate changes is the downstream consequence of a forensic acquisition. An image of a whole device is far larger than a targeted collection from the same custodian, and under per-gigabyte billing that difference is charged on the way in and again every month it is held. On an instance rate the decision about how much to take is a proportionality question rather than a metering one. The pricing page publishes the rate. See what the platform includes, or book a walkthrough.

Sources

• EDRM for the stage model the process guide follows, and for collection standards.
• Fed. R. Civ. P. 26(b)(2)(B) on sources that are not reasonably accessible, and Fed. R. Civ. P. 26(b)(1) on proportionality.
• Fed. R. Evid. 902(14) on certified data copied from an electronic device.
• NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, and ISO/IEC 27037:2012 on the identification, collection, acquisition and preservation of digital evidence.
• Fee categories and the collection line: the Fee Field Guide dataset.