- Nationwide Digital Forensic & Cyber Investigation Services
Quick answer. E-Discovery services are the legal and technical process of identifying, preserving, collecting, processing, searching, reviewing, producing and analyzing electronically stored information (ESI) for litigation, arbitration, regulatory matters and internal investigations. Elite Digital Forensics performs E-Discovery with forensic methodology: read only acquisition, hash verification, metadata preservation and documented chain of custody, so the data is defensible and the same examiners can also determine what a user did with the files and testify about it.
| Question | Short answer |
|---|---|
| What does E-Discovery actually include? | Identification, preservation, collection, processing, search, review support, production, analysis and testimony. |
| What is ESI? | Electronically stored information: email, chats, texts, documents, cloud files, database records, logs and metadata. |
| Do you serve the whole country? | Yes. Remote collection nationwide, with on site collection scheduled anywhere in the United States. |
| Can data be collected without shipping devices? | Usually yes, through examiner supervised remote acquisition over an encrypted connection. |
| Is metadata preserved? | Yes. Metadata preservation is a requirement of every collection we perform, not an option. |
| How is integrity proven? | Hash values are recorded at acquisition and re verified at each transfer, with a written chain of custody. |
| Can you cut review volume? | Yes. DeNISTing, deduplication, threading, near duplicate grouping and targeted searching typically remove most of the raw volume. |
| Do you produce load files? | Yes. Native, PDF and TIFF productions with load files, extracted text, metadata and Bates numbering. |
| Can you prove files were stolen or deleted? | Often yes, through USB, LNK, shellbag, registry, event log, browser and cloud sync artifacts. |
| Can you testify? | Yes. Declarations, depositions, hearings and trial testimony from court qualified examiners. |
E-Discovery follows a lifecycle that most courts, ESI protocols and industry frameworks describe in roughly the same order. Every stage below is a service we perform, and each one produces documentation that supports the next.
Before anything is collected, the data map has to be understood. We interview custodians and information technology staff, inventory devices, mailboxes, cloud tenants, file shares, collaboration platforms, backup systems and personal devices used for work, and identify where relevant ESI is likely to live and how long each system retains it. Log retention windows in particular expire on fixed schedules, so identification is time sensitive.
Preservation freezes potentially relevant ESI so it cannot be altered, overwritten or deleted while the matter proceeds. That includes legal hold notices, in place holds on cloud accounts, suspension of automatic deletion policies, and forensic imaging of devices that are about to be reassigned, wiped or returned. See ESI preservation and litigation holds.
Collection is the acquisition of the data itself. We use write blocked or read only methods, calculate hash values at the source, preserve file system and application metadata, and record the acquisition in a chain of custody log. Collections are performed remotely or on site depending on volume, security constraints and the protocol in the matter. See forensic E-Discovery data collection and remote E-Discovery collection.
Processing converts raw collected data into a searchable, reviewable corpus: containers and archives are expanded, text and metadata are extracted, images are OCR processed, system files are removed, duplicates are eliminated and dates are normalized to a single time zone. See E-Discovery processing.
Targeted searching reduces the data set before expensive attorney review begins. Keyword and Boolean searches, date ranges, custodian scoping, file type and email domain filters, threading and near duplicate grouping are applied and documented so search terms can be defended or renegotiated.
We prepare, organize and load data for attorney review, apply tagging and coding structures, run privilege screens against counsel supplied criteria, and produce search reports and volume estimates that inform proportionality arguments. Substantive legal review remains with counsel.
Production delivers responsive material in the agreed format with the agreed metadata fields, numbering and endorsements, accompanied by a production log. See E-Discovery production.
When collection adequacy, authenticity, metadata, deleted data, spoliation or exfiltration becomes contested, our examiners provide analysis, written opinions and testimony. See E-Discovery expert witness services.
Between the formal stages sit the practical ones: assisting with Rule 26 conferences, drafting technical portions of ESI protocols, evaluating an opposing party's production for completeness, responding to discovery disputes and preparing exhibits and demonstratives.
The distinction that matters. Many E-Discovery providers are document review shops. Their work ends with a produced document set. Because we are digital forensic examiners first, our collections are built to withstand challenge and our analysis can address what a user did with the data: what was opened, copied, uploaded, deleted or hidden.
ESI is not limited to documents and email. The sources below are all routinely collected, processed and produced in E-Discovery matters.
Collection is the stage most often attacked in discovery motions, and it is where forensic training separates a defensible collection from a convenient one. Copying files with ordinary tools can update access times, break folder provenance and drop embedded metadata. Our collections avoid that.
An examiner supervised agent or supervised remote session acquires a targeted or full image over an encrypted connection. Hashes are calculated at the source and verified on receipt. This is the fastest path for distributed workforces and matters where devices cannot leave the custodian's possession. See remote E-Discovery collection.
Examiners travel to the office, data center or residence when the volume is too large to move over a network, when the environment is sensitive, when a court ordered protocol requires physical presence, or when devices must be imaged and returned the same day.
A full forensic image captures the entire drive, including unallocated space where deleted file fragments live. A targeted collection captures defined folders, mailboxes, date ranges or file types. Full imaging is appropriate when deleted data, wiping or user activity is at issue. Targeted collection is appropriate for proportionality when the dispute is purely about document content.
Mobile collection is performed with advanced extraction platforms used by federal and state law enforcement, scoped to the categories the matter requires: messages, call logs, contacts, media, application data and location artifacts. See mobile device E-Discovery.
Cloud and mailbox collections use native legal hold and export interfaces so server side metadata and audit records are preserved with the content. See cloud E-Discovery, email E-Discovery, Microsoft 365 E-Discovery and Google Workspace E-Discovery.
The duty to preserve attaches when litigation is reasonably anticipated, which is frequently before a complaint is filed. Federal Rule of Civil Procedure 37(e) does not ask whether data was lost. It asks whether reasonable steps were taken to preserve it, which is why documented process matters as much as technology.
Time sensitive. Cloud audit logs, deleted item retention windows and license reclamation cycles all run on fixed schedules. In many matters, the data that would have answered the central question expired while the parties were still negotiating scope. Preservation is the one stage that cannot be revisited later. See ESI preservation and litigation holds.
Processing turns raw acquisitions into a searchable corpus. Each step is logged with input and output counts so volumes can be reconciled and defended.
| Processing step | What it does | Why it matters |
|---|---|---|
| Ingestion | Loads collected items with source and custodian tracking. | Establishes provenance for every document in the set. |
| Container expansion | Extracts contents of PST, OST, ZIP, RAR and nested archives. | Prevents relevant material from hiding inside containers. |
| Text and metadata extraction | Pulls document text and system and application metadata. | Enables searching and produces the metadata fields required by ESI protocols. |
| DeNISTing | Removes known operating system and application files by hash. | Eliminates thousands of irrelevant system files from review. |
| Deduplication | Removes exact duplicates globally or by custodian. | Cuts volume and prevents inconsistent coding of identical documents. |
| Email threading | Groups messages into conversations and identifies inclusive messages. | One review pass per conversation instead of one per message. |
| Optical character recognition | Makes scanned images and image only PDFs searchable. | Keyword searches otherwise miss scanned contracts and exhibits. |
| Time zone normalization | Converts timestamps to a single agreed zone. | Prevents date range filters and timelines from being off by hours or a day. |
| Exception handling | Identifies encrypted, corrupt or unsupported files. | Exceptions are reported rather than silently dropped. |
| Custodian organization | Structures data by custodian and source. | Supports per custodian volume reporting and proportionality arguments. |
No client wants to pay attorneys to read two million files. Data reduction is where E-Discovery budgets are actually controlled, and every filter applied is documented so it can be defended or renegotiated with the other side.
The goal is stated plainly: reduce the universe of data before expensive attorney review begins, and be able to show exactly how that reduction was accomplished.
We do not position ourselves as the law firm performing substantive legal review. We help legal teams identify, organize, search and prioritize potentially relevant ESI so attorney review is faster, cheaper and better targeted.
Productions are delivered to the specification in the ESI protocol, court order or agreement between counsel.
Traditional E-Discovery answers one question: here are the documents. Digital forensics answers a different one: what happened to the documents. That second question decides trade secret cases, departing employee disputes and spoliation motions.
| Question | Artifacts examined |
|---|---|
| Which files did the user open and when? | Recent file lists, jump lists, LNK files, shellbags and application history. |
| What was copied to an external drive? | USB device registry entries, event logs, LNK targets and volume serial correlation. |
| Was data uploaded to personal cloud or webmail? | Browser history and cache, upload artifacts, cloud client logs and provider audit records. |
| Were files deleted? | Recycle bin records, file system journals, unallocated space and cloud deletion logs. |
| Were anti forensic tools used? | Installation and execution artifacts for wiping and cleaning utilities, plus timeline gaps. |
| What did the user do overall? | Logon and logoff records, program execution artifacts, registry keys and event logs. |
| How does it fit together? | A reconstructed timeline correlating endpoint, mobile and cloud activity. |
Common findings include mass file copying in the days before a resignation, personal cloud storage clients installed on a work laptop, company documents routed to a personal mailbox, and drive wiping performed after a preservation letter arrived. See data exfiltration investigations.
The natural intersection between E-Discovery and digital forensics is the internal investigation, where an employer needs both the documents and the conduct surrounding them.
Departure investigations are the most time sensitive engagements we handle. Once a laptop is reimaged for the next hire or a cloud license is reclaimed, the evidence is usually gone. Preserving the device and account before that happens preserves the option to investigate later.
Our E-Discovery work supports counsel across the commercial docket.
Text messages are now central evidence in most commercial disputes. We collect iPhone and Android devices for SMS, MMS, iMessage, recoverable messaging application content, call logs, contacts, photos, video, application data and location related artifacts, with deleted content recovered where it survives. Collections can be scoped narrowly to protect personal privacy on a device that carries both business and personal data. See mobile device E-Discovery.
Email remains the highest yield source in most matters. We collect from Microsoft 365, Exchange, Outlook, Gmail and Google Workspace, and process PST, OST and MBOX containers with headers, attachments and metadata intact. Where a message's authenticity is disputed, header and transport analysis can address whether it was actually sent as claimed. See email E-Discovery.
Cloud work has two distinct halves that are frequently confused. Collecting documents from a cloud repository produces the files. Forensically investigating the account produces the activity: who accessed, shared, downloaded, synchronized or deleted the files, and from where. We do both. See cloud E-Discovery.
Remote collection makes nationwide coverage practical. Evidence is acquired from computers, cloud accounts and mailboxes over encrypted connections under examiner supervision, with hashing, provenance and chain of custody handled exactly as they would be in a lab. See remote E-Discovery collection.
Defensibility is not a marketing word. It is the ability to explain, under oath, exactly how data was handled and to prove it has not changed.
Federal Rules of Evidence 902(13) and 902(14) allow electronic records and hash verified copies to be authenticated by certification of a qualified person, which is only useful when the underlying process was documented at the time of collection rather than reconstructed later.
The cheapest place to fix an E-Discovery problem is at the front of the case.
When discovery itself becomes the dispute, our examiners address the technical issues directly.
| Term | Definition |
|---|---|
| ESI | Electronically stored information. Any information created, stored or best used in digital form, expressly discoverable under Federal Rule of Civil Procedure 34. |
| Metadata | Data about data: creation, modification and access timestamps, authorship, file paths, email headers and application specific fields. |
| Hash value | A fixed length digital fingerprint of a file or image, commonly MD5, SHA1 or SHA256, used to prove data has not been altered. |
| Chain of custody | The documented history of who handled evidence, what they did to it, and when. |
| Provenance | The record of where each item came from: source device, account, custodian and original path. |
| Write blocking | Hardware or software that permits reading from a source device while preventing any write to it. |
| Forensic image | A bit for bit copy of a storage device, including unallocated space where deleted data can persist. |
| Targeted collection | Acquisition limited to specified folders, accounts, date ranges or file types rather than an entire device. |
| DeNISTing | Removal of known operating system and application files using a published hash set. |
| Deduplication | Elimination of identical files or messages, either globally across the matter or within each custodian. |
| Email threading | Grouping related messages into conversations and identifying the inclusive message containing all prior text. |
| Load file | A structured file that tells a review platform how to import documents, images, text and metadata. |
| Bates numbering | Sequential identifiers applied to produced pages or documents for unambiguous reference. |
| Litigation hold | A directive suspending deletion and preserving potentially relevant ESI once litigation is reasonably anticipated. |
| Spoliation | The loss, destruction or material alteration of evidence that a party had a duty to preserve. |
| Consideration | Conventional review focused vendor | Elite Digital Forensics |
|---|---|---|
| Primary output | A hosted document review set and production. | A defensible evidence set, a production, and findings about user conduct. |
| Collection method | Often self collection by the client or logical file copy. | Forensic acquisition with write blocking, hashing and provenance records. |
| Metadata handling | Preserved for produced documents in most cases. | Preserved at the file system and application level from acquisition forward. |
| Deleted data | Generally out of scope. | Recovered from unallocated space and artifacts where it survives. |
| User activity analysis | Not offered. | USB, LNK, shellbag, registry, event log, browser and cloud artifact analysis. |
| Spoliation questions | Referred out to an expert. | Addressed in house by the examiners who performed the collection. |
| Testimony | Rarely available. | Declarations, depositions and trial testimony from court qualified examiners. |
| Factor | Full forensic image | Targeted collection |
|---|---|---|
| Scope | Entire device, including unallocated space. | Specified folders, accounts, date ranges or file types. |
| Best used when | Deleted data, wiping, or user conduct is at issue. | The dispute is about document content and proportionality is a concern. |
| Cost and time | Higher acquisition and processing cost. | Lower cost, faster turnaround. |
| Privacy exposure | Captures personal data that may need protective handling. | Limits exposure of unrelated personal data. |
| Later flexibility | Supports questions no one thought to ask at the outset. | Re collection may be required if the theory of the case changes. |
They can copy files, and in doing so they frequently alter access timestamps, break folder provenance and drop embedded metadata. They also usually cannot testify about method. Self collection is the most common source of authenticity and completeness challenges.
They overlap but answer different questions. E-Discovery produces the documents. Forensics explains what was done with them. See digital forensics compared with E-Discovery.
Often not immediately. Deleted files, message fragments, thumbnails and cloud deletion records can persist for a period. What is fatal is continued use of the device, reimaging, or expiration of a retention window.
A PDF export strips the metadata that establishes when a document was created, modified and accessed. It is a convenience copy, not evidence of provenance.
Text and chat messages are ESI and are routinely ordered produced. Scoped mobile collection allows relevant messages to be produced without exposing an entire personal device.
The duty attaches when litigation is reasonably anticipated. Waiting for service is how devices get reimaged and cloud licenses get reclaimed.
We decline engagements where lawful authority over the data or device is not established.
Each page below covers one part of the E-Discovery process in depth and links back to this hub.
Engagements typically follow the same path. A confidential consultation establishes the claims, the custodians and the data sources at issue. We identify what must be preserved immediately and put holds or forensic preservation in place. Collection follows, remotely or on site, with hashing, metadata preservation and chain of custody documentation. Processing and filtering reduce the volume to a defensible review set. We support review, then produce in the required format with a production log and hash manifest. Where conduct is contested, our examiners analyze the artifacts and provide written opinions and testimony.
Elite Digital Forensics is an independent digital forensics firm providing nationwide E-Discovery services, computer and mobile device forensics, cloud and email investigations and expert witness testimony. Our examiners include former law enforcement forensic examiners and court qualified expert witnesses. We work for law firms on both sides of the docket, for corporations and in house legal departments, and for insurers. When retained through counsel, our work is generally treated as attorney work product prepared in anticipation of litigation. Reports are written for attorney review, negotiation, mediation or court.
E-Discovery services cover the identification, preservation, collection, processing, review support, production and analysis of electronically stored information (ESI) for litigation, arbitration, regulatory matters and internal investigations. Elite Digital Forensics performs these services with forensic methodology, meaning every collection is hash verified, metadata is preserved, and the chain of custody is documented so the resulting data can be authenticated in court.
ESI stands for electronically stored information. Under Federal Rule of Civil Procedure 34, ESI includes email, text messages, chat and messaging application data, documents, spreadsheets, images, video, audio, cloud files, database records, log files and metadata. Anything stored in a digital form and reasonably accessible can be discoverable ESI.
Ordinary collection often copies files with normal operating system tools, which can alter access timestamps and drop embedded metadata. Forensic collection uses write blocking or read only acquisition, creates a hash value for every item, preserves system and file metadata, and records who collected what, when, and how. That difference matters when authenticity, spoliation or deleted data becomes an issue.
Yes. Elite Digital Forensics provides nationwide E-Discovery services. Most cloud, email and computer collections are performed remotely under examiner supervision. On site collections are scheduled anywhere in the United States when devices cannot leave a facility or when volume, network limitations or court ordered protocols require an examiner on location.
In most matters, yes. Remote collection uses an examiner supervised agent or a supervised session to acquire a targeted or full forensic image over an encrypted connection, with hashing performed at the source and verified on receipt. Cloud sources such as Microsoft 365 and Google Workspace are collected through native export and legal hold interfaces with audit logs preserved alongside the data.
Data reduction happens during processing. System files are removed through DeNISTing, exact duplicates are eliminated across custodians, archives and containers are expanded, dates are normalized to a single time zone, and then date ranges, custodians, file types, email domains and keyword or Boolean searches are applied. Email threading and near duplicate grouping further shrink the review set. It is common to reduce a raw collection by 70 to 95 percent before a single document reaches attorney review.
Chain of custody is the documented record of every person who handled the evidence and every action taken on it, from acquisition through production and eventual return or destruction. A defensible record includes device identifiers, acquisition method, examiner name, timestamps, hash values at each transfer and storage location. Federal Rules of Evidence 902(13) and 902(14) allow electronic records and hash verified copies to be self authenticated through a qualified person's certification.
A hash value is a fixed length digital fingerprint calculated from the contents of a file or drive image, commonly using MD5, SHA1 or SHA256. If a single bit changes, the hash changes. Recording the hash at acquisition and recalculating it later proves the data has not been altered, which is the technical foundation for authenticity, deduplication and self authentication under Rule 902(14).
A review platform shows the documents that still exist. Forensic analysis explains what happened around them: which files were opened or copied, which USB devices were attached, what was uploaded to personal cloud or webmail accounts, which files were deleted and when, whether wiping or cleaning tools were run, and how the activity fits into a reconstructed timeline. That is often the difference between producing data and proving conduct.
Common deliverables include native files, searchable PDFs, single page or multi page TIFF images with extracted text, load files compatible with mainstream review platforms, metadata fields specified in the ESI protocol, Bates or control numbering, privilege and confidentiality endorsements, and a production log. Custom formats are produced to match the discovery specification or court order in the matter.
Outside counsel and litigation support teams retain us most often, followed by in house legal and human resources departments handling internal investigations, and insurers or corporate clients responding to regulatory requests. When we are retained through counsel, the engagement is generally treated as attorney work product prepared in anticipation of litigation.
Yes. Our examiners provide declarations and affidavits, testify at deposition and hearing, and appear at trial on issues including collection adequacy, preservation, metadata, authenticity, deleted data, spoliation, production deficiencies and rebuttal of an opposing expert's methodology.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic and E-Discovery services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder