Describe the data, custodians and deadline in your matter and get the UK eDiscovery guides, EDRM stage and next steps that fit, in seconds and with no sign up.
New guides, sector briefings and disclosure checklists are added to this library as they are published. For written practice notes, see the Knowledge Centre. New here? Read the library FAQ on searching, reading and citing guides, browse guides by topic, or follow library updates for new guides and revisions. To match your own facts to answers and guides, open the case builder.
§ Worked cases
Each worked case sets out the week by week timeline, what each stage covers and the questions counsel ask before instructing.
Secure the wallets, seed phrases, devices and exchange accounts before anything moves, then start the on-chain trace and the attribution work in parallel.
Read how we run preservationNot use full y, on a striped or parity RAID: a single member holds only interleaved fragments, every file sliced through, and reads as gibberish (§2). The array must be reassembled from forensic images of every member, using the solved geometry (§4). The exception is a mirror (RAID 1), where one member is a readable whole, but even then the array metadata matters for currency.
If your IT team has already looked at the laptop, the evidence is not necessarily ruined, but it has been changed.
Much artefact evidence will survive this casual access
A shared mailbox is not a custodian, but rather a non-custodial source that must be collected as a repository in its own right.
In electronic disclosure, a custodian
When an employee returns a locked company laptop, the first step is to check for the recovery key before attempting any other action.
In most corporate cases, the device is not
A locked device with unbreakable encryption rarely means the case is lost, because the lock guards the physical device rather than the underlying data.
When a device cannot be
This guide, 'Cryptocurrency And Blockchain Tracing', is for UK lawyers, in-house counsel, and investigators. It covers how blockchains and wallets record value, tracing funds across the ledger, and attribution, linking a
This guide, 'Forensic Collection of Exchange Online Mailboxes', is prepared by Computer Forensics Lab's e-Discovery team for UK lawyers. It addresses the forensic collection of Exchange Online mailboxes, including active
Guide 7 in the CFL Electronic Evidence Series, a legal and technical reference for practitioners in England and Wales who meet crypto assets in litigation, fraud investigations, insolvency, divorce and regulatory work. I
This guide addresses the complexities of attributing actions within shared mailboxes and delegated access scenarios, where the 'From' line may name an inbox, not a person. It covers access models such as shared mailboxes
This guide, "Bit Locker, File Vault and Full-Disk Encryption", is prepared by Computer Forensics Lab's e-Discovery team for UK lawyers. It covers the problem of encryption built to be recovered, detail in g how Bit Locke
This guide, 'Forensic Collection from Corporate File Servers', is for UK lawyers, in-house counsel and investigators. It addresses the unique challenges of collecting digital evidence from shared drives, where files are
Free for legal practitioners
Subscribe with your work email and we will send the weekly guide. If you have filled in the matter details above, a summary comes with it so a forensic lead can pick it up and reply.
Firm or company email addresses only, personal mailboxes such as Gmail, Outlook and Yahoo are not accepted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
