Within the legal environment, Discovery is the process of identifying, locating, preserving, securing, collecting, preparing, reviewing, and producing facts, information, and materials for the purpose of producing/obtaining evidence for utilization in the legal process. Electronic Discovery (e-Discovery) is the application of these processes into the digital environment to collect Electronically Stored Information (ESI). Legal departments are ill prepared to deal with the digital environment of a business. Increasingly they are turning to the company’s Information Technology (IT) department to identify, locate, preserve, and collect ESI. This is not break/fix work, typical in most IT operations, but a more complex set of processes. This paper explores the tactical processes necessary to comply with an increasingly demanding US Federal court system. This analysis includes the processes and controls necessary for a defensible e-Discovery program, including a review of identifying the record owner, methods for identifying, collecting, and preserving custodial data, and the management of custodian equipment.SANS Institute Infosec Reading Room: E-Discovery Operations:

E-Discovery Operations: Tactical considerations for defensible eDiscovery