Jonathan Chan & Andrew Pimlott consider new possibilities of electronic discovery
There is an undisputed requirement for electronic discovery projects to maintain a minimum forensic standard to preserve the evidential value of the documents and of the process itself. IT forensic investigations also share these principles. However, the proliferation of electronic documents poses issues of volume that contribute towards increased cost and time requirements in an IT forensic investigation. IT forensic investigations are generally structured around collection, examination, analysis and reporting.
This close alignment to the Electronic Discovery Reference Model (EDRM) allows us to integrate eDiscovery techniques with a traditional investigation, as the EDRM is a proven model of increasing relevance whilst decreasing volume. Given the shared goals and forensic principles of both disciplines, and that IT Forensic investigations are constantly growing in volume and sophistication, why do we rarely take advantage of lessons learned, and developed technologies in the eDiscovery arena?
Clearly, the earlier in an investigation that irrelevant data sources can be excluded will present time and cost savings in the processing and investigative review of data. The identification stage
