Describe the data, custodians and deadline in your matter and get the UK eDiscovery guides, EDRM stage and next steps that fit, in seconds and with no sign up.
New guides, sector briefings and disclosure checklists are added to this library as they are published. For written practice notes, see the Knowledge Centre. New here? Read the library FAQ on searching, reading and citing guides, browse guides by topic, or follow library updates for new guides and revisions. To match your own facts to answers and guides, open the case builder.
§ Worked cases
Each worked case sets out the week by week timeline, what each stage covers and the questions counsel ask before instructing.
Secure the wallets, seed phrases, devices and exchange accounts before anything moves, then start the on-chain trace and the attribution work in parallel.
Read how we run preservationNo rule compels it in terms, but the regime's logic does: the DRD asks for search proposals the court can assess, PD 31B directs discussion of keyword strategy, and a term proposal without numbers is an assertion the court will discount against a counter-proposal with them. Practically, the party with hit reports wins term disputes; exchanging them is both the cooperative act and the winning move, which is why they are prepared exchange- clean from the start.
A shared mailbox is not a custodian, but rather a non-custodial source that must be collected as a repository in its own right.
In electronic disclosure, a custodian
If your IT team has already looked at the laptop, the evidence is not necessarily ruined, but it has been changed.
Much artefact evidence will survive this casual access
When an employee returns a locked company laptop, the first step is to check for the recovery key before attempting any other action.
In most corporate cases, the device is not
A locked device with unbreakable encryption rarely means the case is lost, because the lock guards the physical device rather than the underlying data.
When a device cannot be
Cryptocurrency tracing involves following transactions on public ledgers and attributing addresses to individuals. This guide covers the process from tracing funds across the ledger to identifying owners, addressing obfu
This guide addresses the forensic collection of Exchange Online mailboxes, detailing how to access all layers of mail, including deleted and archived items, while preserving critical metadata. It covers mailbox anatomy,
Guide 7 in the CFL Electronic Evidence Series, a legal and technical reference for practitioners in England and Wales who meet crypto assets in litigation, fraud investigations, insolvency, divorce and regulatory work. I
Shared mailboxes and delegated access complicate email attribution, as the 'From' line is a label, not a signature. This guide details access models, collection strategies, and attribution methods using logs, permissions
Full disk encryption, such as BitLocker and FileVault, is often recoverable, particularly in managed environments where recovery keys are typically escrowed. This guide details how these systems work, where keys reside,
Forensic collection from corporate file servers presents unique challenges compared to device imaging. This guide explores how servers record permissions, audit trails, and metadata, and discusses the attribution problem
Free for legal practitioners
Subscribe with your work email and we will send the weekly guide. If you have filled in the matter details above, a summary comes with it so a forensic lead can pick it up and reply.
Firm or company email addresses only, personal mailboxes such as Gmail, Outlook and Yahoo are not accepted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
