Computer Forensics vs. Electronic Discovery
The process of digital discovery is a crucial part of any successful litigation which includes the preservation, identification, extraction, review and production of electronically stored information (ESI). One such form of ESI is computer forensics. With a few exceptions, every court in the United States recognizes that computer forensics are a useful tool in the process. Though they both reside on the same spectrum as far as jurisprudence goes, at least one is more hands-on and proactive than another.
Computer forensics typically begins once an investigator has been hired to perform discovery on behalf of counsel for litigation purposes. This can help forensic investigators with other electronic data or other relevant information that may help answer questions about someone's whereabouts or specific events. Forensic examinations are often used in investigations into the theft of information and the handling of sensitive, confidential or otherwise important data. Computer forensics can also be used for data monitoring purposes, as well as for national security investigations or to find a missing persons file.
The term computer forensics refers to a particular type of digital investigation that involves collecting and analyzing electronic data that typically resides on computers as well as phones, tablets, digital cameras and similar devices (e.g., smartwatches). This work includes examining OSI layers and identifying who may have been in control of the device while it was connected to a network.