eDiscovery in digital forensic investigations – Home Office publishes guidance

The Home Office has published a report to introduce the area of eDiscovery, known more widely in the UK as eDisclosure.

The Guidance in the report is the result of a survey of the typical functionality available and describes how eDiscovery can be employed within criminal investigations.

The report entitled: ‘eDiscovery in digital forensic investigations’ says that there is, as yet, no ideal tool to support the technical and investigative needs of digital investigations – although some tools meet key requirements and could be used in a combined solution.

It highlights that the widespread uptake of sophisticated mobile devices, coupled with the affordability of storage, has resulted in huge growth in the volume of digital information being created and stored.

Acknowledging the continual challenge within the digital forensics industry that practices need to keep pace with this trend, the report identifies areas how examiners and investigators might coordinate better to help secure convictions quicker.

In conjunction with the Metropolitan Police Service (MPS), the Centre for Applied Science and Technology (CAST) recently conducted an assessment of commercial products offering an eDiscovery approach to reviewing large volumes of data. The assessment revealed some interesting differences between the way that eDiscovery tools approach an investigation and the standard workflow in a criminal investigation involving digital evidence.

The report goes on to say: “The widespread uptake of sophisticated mobile devices, coupled with the affordability of storage has resulted in huge growth in the volume of digital information being created and stored.”

Given the challenges brought about by ever increasing data volumes the eDiscovery  or eDisclosure approach would appear to be applicable to the world of digital investigations.

“Lawyers working in-house and within law firms need to understand why a digital investigation is needed, what steps should be taken within an investigation, and who should be involved. This Home Office Report provides useful guidance on the benefit to companies of adopting eDiscovery as a technique both in response to disclosure requests and to provide intelligence to assist with a digital investigation.”

Electronic Discovery Reference Model

The report describes the EDRM (Electronic Discovery Reference Model), which has been created to help parties engaged in electronic discovery conceptualise the framework and describe the standard steps in an eDiscovery process which have obvious parallels to the stages in a digital investigation.

The report does not focus on the detailed performance of a few tools but on the ways in which the eDiscovery approach can assist the world of digital forensics and investigations.