Knowledge base · Digital forensics
What is eDiscovery?
Short answer
eDiscovery, or electronic discovery, is the process of identifying, preserving, collecting, processing, reviewing and producing electronically stored information such as emails, chats, documents and databases for a legal matter, regulatory inquiry or internal investigation. It combines legal judgement with technology so that large data volumes can be searched defensibly.
Definition of eDiscovery (also: electronic discovery, e-discovery, ESI review, electronic document review, e-disclosure)
eDiscovery is the structured process of finding, preserving, reviewing and producing electronically stored information (ESI) that is relevant to a legal matter. The term comes from US civil litigation, where parties must disclose relevant documents to each other, but the methods are now used worldwide in arbitration, regulatory inquiries, competition investigations and large internal investigations. The aim is to handle very large volumes of data in a way that is complete, proportionate and defensible.
What are the stages of eDiscovery?
The Electronic Discovery Reference Model (EDRM) is the most widely used framework. The classic model runs from information governance through identification, preservation, collection, processing, review, analysis, production and presentation. The current EDRM page presents an updated 2026 version that treats analysis as a continuous activity across the stages and adds disposition at the end. In plain terms:
- Identification: work out which people (custodians), systems and date ranges hold relevant data.
- Preservation: issue a legal hold and stop routine deletion.
- Collection: gather data forensically, often by forensic imaging or targeted exports, with hash values recorded.
- Processing: extract text and metadata, remove duplicates, and filter by date, file type and search terms.
- Review: lawyers or reviewers code documents for relevance, privilege and key issues, often supported by technology-assisted review.
- Analysis: identify patterns, timelines, communication networks and key documents.
- Production: deliver relevant, non-privileged documents in an agreed format with a log.
- Presentation: use the evidence in hearings, depositions or reports.
When is eDiscovery used in India?
India does not have US-style discovery, but the need to review electronic data at scale arises often:
- Commercial litigation: for commercial suits, the Commercial Courts Act 2015 amended Order XI of the Code of Civil Procedure to require detailed disclosure of documents, including electronic records, at an early stage.
- Arbitration: tribunals frequently order document production on contested issues.
- Internal investigations: whistleblower, fraud and misconduct inquiries involving thousands of emails and chats.
- Regulatory and enforcement inquiries: responding to requests from regulators or investigating agencies.
- Cross-border matters: Indian subsidiaries asked to produce data for US or UK proceedings.
Our practical guide to eDiscovery for Indian litigation and arbitration covers these settings in more detail.
How does Indian evidence law affect eDiscovery?
Electronic records produced in Indian courts are governed by the Bharatiya Sakshya Adhiniyam 2023. Section 63, which replaced s. 65B of the Indian Evidence Act 1872, requires a certificate signed by the person in charge of the device and an expert, recording hash values, each time computer output is submitted. A well-run eDiscovery process therefore keeps hash records, metadata and a clear chain of custody from collection onwards, so a Section 63 certificate can be supported. Privacy obligations under the DPDP Act 2023 are being phased in from 2025 to 2027 and should be factored into collection and cross-border transfer plans.
What are common eDiscovery pitfalls?
- Legal holds issued late or not followed up, allowing deletion.
- Collecting by forwarding emails, which strips metadata.
- Narrow keyword lists that miss code words, local languages or abbreviations.
- Overlooking chat apps, shared drives and collaboration tools.
- Inconsistent privilege review, leading to accidental disclosure.
- No audit trail explaining how the reviewed set was chosen.
How is eDiscovery different from digital forensics?
Digital forensics goes deep into a small number of devices to reconstruct events, recover deleted data and attribute actions to users. eDiscovery goes broad across many custodians to find and produce relevant documents. A single matter often needs both: forensic collection and analysis feed the eDiscovery review. Our eDiscovery for legal professionals service supports law firms through collection, processing, review and production.
Frequently asked questions
Does India have US-style eDiscovery?
Not in the same form. Indian civil procedure does not impose the broad pre-trial discovery obligations seen in US federal litigation. However, commercial suits require early disclosure of documents, including electronic records, and arbitral tribunals often order document production. Large internal investigations and regulatory inquiries also generate review exercises that use the same eDiscovery methods and tools.
What is a legal hold?
A legal hold is an instruction to custodians and IT teams to suspend routine deletion and preserve information that may be relevant to an anticipated or ongoing dispute or investigation. It covers emails, chats, files, backups and devices. Issuing it early, documenting who received it and checking compliance are among the most important steps in any eDiscovery exercise.
What is technology-assisted review?
Technology-assisted review uses machine learning to prioritise or classify documents after reviewers code a sample as relevant or not relevant. The system then ranks the remaining documents, so reviewers see the likeliest relevant material first. Used with sound validation and sampling, it can reduce review volumes significantly, but the method and its results should be documented in case they are challenged.
Sources
Go deeper
Related insights
Digital forensics20 Sept 2026
Preserving Digital Evidence in Internal Investigations: Imaging, Hashing and Chain of Custody
A practical guide to preserving laptops, phones, email and cloud data in an internal investigation so the evidence stays reliable, lawful and usable in court.
Digital forensics14 Sept 2026
Electronic Evidence under the Bharatiya Sakshya Adhiniyam 2023: Section 63 Certificates Explained
How s. 63 of the Bharatiya Sakshya Adhiniyam governs electronic evidence, what the two-part certificate must contain and the mistakes that get records excluded.