Digital Forensics

Digital evidence can establish chronology, communications, account activity, file movement, device use, application activity, or relationships among different records. Timestamps, metadata, logs, message records, file properties, and account histories can be compared to determine whether separate pieces of evidence are consistent with one another and with the events alleged in the case.

Electronic evidence can include emails, messages, files, photographs, account records, application data, logs, metadata, cloud records, and other information created or stored electronically. Its significance often depends on where it originated, how it was preserved, what associated metadata exists, and whether other digital records corroborate or contradict it.

A computer program may become relevant when its logs, configuration files, databases, user records, temporary files, or other artifacts document disputed activity. Digital forensic analysis focuses on what evidence the program created or retained. Questions involving how the program was designed, coded, or developed are better suited to the retained Software or Computer Programming Expertise pages.

Digital Forensics focuses on extracting, reconstructing, correlating, and interpreting technical evidence from digital sources. Electronic Discovery focuses more broadly on identifying, preserving, collecting, processing, reviewing, and producing electronically stored information during litigation. The two can overlap when forensic methods are needed to locate or understand information within an e-discovery process.