§ PDF library

Authors and sources

Who wrote and published every guide in our UK eDiscovery library, with a link to the official source behind each one, so you can check the original before you cite it.

Ref · E-D · 2026 · §CREDITClass · ConfidentialJuris · England & WalesStatus · Active

Every guide below is published by Computer Forensics Lab through e-discovery.uk unless a different publisher is credited. Where a guide restates or summarises another organisation's material, the official source is linked so you can read the primary document before you rely on it.

Authors, publishers and official sources for each guide
Guide	Author	Publisher	Official source
A Privileged Document Has Been Disclosed What Happens NextGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Practice Direction 57AD, paragraph 14, privileged documents
AI Generated Documents Provenance And DetectionGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Android Acquisition Logical File System And PhysicalGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Android App Data And Third Party Application ForensicsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
Android Backups Local Google And Manufacturer CloudGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
Android Deleted Data SQLite And Unallocated SpaceGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Android Encryption Secure Boot And Lock Screen ProtectionsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
Android Forensics The Fragmented LandscapeGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Android Location Fused Location WiFi And Cell DataGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
Android Malware Stalkerware And CompromiseGuide · 2026-09-02	Editorial team	Computer Forensics Lab	NCSC incident management guidance
Android Messaging SMS RCS And Messaging AppsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Forensic Science Regulator Code of Practice, digital forensics
Android Photos Media And MetadataGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
Android Secure Folders Knox And Manufacturer Security ContainersGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
Android Usage Activity And System ArtefactsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
APFS And The Apple File SystemGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Apple Mail Archives And Email Threading On MacOSGuide · 2026-09-02	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
Apple Watch And Paired Device ForensicsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
BitLocker FileVault And Full Disk EncryptionGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Browser History And Internet ArtefactsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Building A Digital Timeline For LitigationGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
BYOD And DisclosureGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Can File Timestamps Be TrustedGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Can We Collect Only Relevant Data Instead Of Imaging EverythingGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Can You Prove A USB Drive Was ConnectedGuide · 2026-08-30	Editorial team	Computer Forensics Lab	NCSC incident management guidance
Can You Prove Who Deleted A FileGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
CCTV EvidenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
CFL Benefits Of Early Case Assessment In EDiscoveryGuide · 2026-09-01	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
CFL Digital Forensics Services BrochureGuide · 2026-08-29	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Citrix VDI And Remote Desktop Where The Evidence Actually ResidesGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Citrix VDI And Remote Desktop Where The Evidence Actually Resides (1)Guide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Citrix VDI And Remote Desktop Where The Evidence Actually Resides (2)Guide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Cloud Evidence Is Not Just FilesGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Collecting Evidence From Google WorkspaceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Collecting Evidence From Microsoft Teams Private And Shared ChannelsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Collecting Without The PasswordGuide · 2026-08-31	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Completing The Disclosure Review Document A Technical And Legal GuideGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Disclosure in the Business and Property Courts
Control Of Electronic Documents What Lawyers Need To InvestigateGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Original material
Cooperating On Electronic Disclosure Without Giving Away Your CaseGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Coordinating Forensic Collection Across Multiple Offices And CountriesGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ICO guide to the UK GDPR
CRM Evidence Salesforce HubSpotGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Cryptocurrency And Blockchain TracingGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Custodian Abroad Cross Border CollectionGuide · 2026-08-31	Editorial team	Computer Forensics Lab	ICO guide to the UK GDPR
Damaged Computers And Data RecoveryGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Data Exfiltration To Cloud StorageGuide · 2026-08-31	Editorial team	Computer Forensics Lab	NCSC incident management guidance
Deduplication ExplainedGuide · 2026-08-30	Editorial team	Computer Forensics Lab	NIST Computer Forensics Tool Testing programme
Deepfakes And Synthetic MediaGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Detecting Backdated Or Manipulated DocumentsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Forensic Science Regulator Code of Practice, digital forensics
Digital Chain Of Custody A Practical Guide For LawyersGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Digital Forensic Evidence What Every Defence Lawyer Needs To Know Computer Forensics LabGuide · 2026-08-29	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Digital Forensics In Corporate Fraud InvestigationsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Digital Redaction That Cannot Be ReversedGuide · 2026-08-30	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
Document Management Systems In DisclosureGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Domain DNS And Hosting RecordsGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Door Access Swipe Cards And Building LogsGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Early Data Assessment Before Disclosure Costs EscalateGuide · 2026-08-29	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
EDisclosure Or Digital Forensics Choosing The Correct ApproachGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Original material
Electronic Disclosure Explained A Practical Guide For UK LawyersGuide · 2026-08-29	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
Email ThreadingGuide · 2026-08-30	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
ERP Evidence SAP OracleGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
External Storage Devices As EvidenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
File Wiping Anti Forensics And The Evidence They Leave BehindGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
FileVault The Secure Enclave And Apple EncryptionGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Finding The Evidence A Lawyers Map Of Modern Electronic Data SourcesGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Original material
Forensic Collection From Corporate File ServersGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Forensic Collection Of Exchange Online MailboxesGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Forensic Data Collection Explained For LawyersGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Forensic Evidence From Cloud Infrastructure AWS Azure Google CloudGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Forensic Science Regulator Code of Practice, digital forensics
Forensic Evidence From Dropbox Box And ShareFileGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Forensic Image Logical Extraction Or Targeted CollectionGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Gatekeeper XProtect And MacOS Malware ArtefactsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	NCSC incident management guidance
Geolocation EvidenceGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
GitHub GitLab And Source Code As EvidenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Google Vault In LitigationGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Guide 5 Identifying The Right Custodians In Electronic DisclosureGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
How Lawyers Should Instruct A Digital Forensic ExpertGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Civil Procedure Rules Part 35, experts and assessors
How To Build A Defensible EDisclosure Strategy At The Start Of A CaseGuide · 2026-08-29	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
How To Design Defensible Keyword SearchesGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Appendix 2, use of technology in disclosure
How To Draft An Electronic Disclosure Production ProtocolGuide · 2026-08-30	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
ICloud The Account As The Real Evidence StoreGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ICO guide to the UK GDPR
Identifying The Right Custodians In Electronic DisclosureGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Original material
IMessage SMS And Messaging Apps On IOSGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Forensic Science Regulator Code of Practice, digital forensics
Initial Disclosure What Should Be Provided And What Should Be PreservedGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Disclosure in the Business and Property Courts
Investigating Suspected Employee Data TheftGuide · 2026-08-30	Editorial team	Computer Forensics Lab	NCSC incident management guidance
IOS App Data And Third Party Application ForensicsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
IOS Backups ITunes Finder And ICloudGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
IOS Encrypted Apps And Secure MessengersGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
IOS Full File System Vs Logical AcquisitionGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
IOS Health Fitness And Motion DataGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ICO guide to the UK GDPR
IOS Knowledge And Biome The Device Activity RecordGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Civil Procedure Rules Part 35, experts and assessors
IOS Location Services Significant And Frequent LocationsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Civil Procedure Rules Part 35, experts and assessors
IOS Photos Media And Location MetadataGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
IOS Spyware Stalkerware And Mobile CompromiseGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
IPhone And IPad Forensics The Acquisition ChallengeGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
IPhone Forensics The Defensible Mobile Evidence BundleGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Known Adverse Documents In The Digital AgeGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Disclosure in the Business and Property Courts
Legal Professional Privilege In Large Electronic DatasetsGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Practice Direction 57AD, paragraph 14, privileged documents
Locked Mobile DevicesGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Mac Evidence In LitigationGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
MacOS And Apple Silicon ForensicsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
MacOS Enterprise Management And MDM ArtefactsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
MacOS Mail Messages And Notes ForensicsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
MacOS Spotlight And Metadata Deep DiveGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
MacOS System ArtefactsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Metadata For Lawyers What It Can And Cannot ProveGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Microsoft Purview Or Independent Forensic CollectionGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Mobile Phone ForensicsGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Forensic Science Regulator Code of Practice, digital forensics
NAS Evidence RAID Snapshots Shared Access Logs And Deleted DataGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Native Documents PDFs Or Images Which Production FormatGuide · 2026-08-30	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
OCR When Searchable Does Not Mean AccurateGuide · 2026-08-30	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
OneDrive EvidenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	NCSC incident management guidance
OSINT Open Source Intelligence In LitigationGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
PD57AD Explained For Litigation LawyersGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Disclosure in the Business and Property Courts
Personal Email Accounts In DisclosureGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Planning An On Site Digital Evidence CollectionGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Preparing A Forensic Collection ProtocolGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Preserving Evidence After A Cyber Attack Or Ransomware IncidentGuide · 2026-08-31	Editorial team	Computer Forensics Lab	NCSC incident management guidance
Preserving Social Media EvidenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Proportionality In EDisclosure When Is Enough EnoughGuide · 2026-08-30	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
Proving Who Created Or Edited A DocumentGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
RAID NAS And Server RecoveryGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Recovering Deleted CCTV And DVR FootageGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Recovering Evidence From Deleted Microsoft 365 User AccountsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Recovering Historical Documents From Snapshots And Volume Shadow CopiesGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Recovering Previous Versions Of Cloud DocumentsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Remote Employee CollectionGuide · 2026-08-31	Editorial team	Computer Forensics Lab	ICO guide to the UK GDPR
Remote Forensic Collection When Can It Be DefensibleGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
SaaS Platforms As Undiscovered RepositoriesGuide · 2026-08-31	Editorial team	Computer Forensics Lab	ICO guide to the UK GDPR
Safari And Browser Artefacts On MacOSGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
Shared Mailboxes Delegated Access And Who Really Sent The EmailGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
SharePoint As A Disclosure SourceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Should A Computer Be Imaged While Running Or Switched OffGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Should Backup Systems Be Searched For DisclosureGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Signal And Ephemeral MessagingGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Slack EDiscoveryGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ICO guide to the UK GDPR
SMS And IMessage EvidenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Forensic Science Regulator Code of Practice, digital forensics
Technical Preparation For A Disclosure Case Management ConferenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Disclosure in the Business and Property Courts
Technology Assisted Review For UK LawyersGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Appendix 2, use of technology in disclosure
The Defensible Multi Source Evidence BundleGuide · 2026-08-31	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
The Electronic Discovery Reference Model For UK Litigation TeamsGuide · 2026-08-29	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
The First EDisclosure Meeting 50 Questions Lawyers Should AskGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Original material
The Google Account Androids Cloud EstateGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
The Missing Evidence ProblemGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
Time Machine And MacOS Backup AnalysisGuide · 2026-09-02	Editorial team	Computer Forensics Lab	Original material
UK Digital Forensics Support For US Litigation TeamsGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Original material
Understanding And Controlling EDisclosure CostsGuide · 2026-08-30	Editorial team	Computer Forensics Lab	EDRM, the Electronic Discovery Reference Model
Using Generative AI Responsibly In Electronic DisclosureGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Practice Direction 57AD, paragraph 14, privileged documents
Vehicle Infotainment And Telematics ForensicsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Virtual Machines As EvidenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Wear OS And Android Paired Device ForensicsGuide · 2026-09-02	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
Wearables And Fitness Tracker ForensicsGuide · 2026-08-31	Editorial team	Computer Forensics Lab	Original material
Website Web Server And Application LogsGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
What Evidence Can Be Recovered From A Windows ComputerGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
What Evidence Can Be Recovered From A Windows Computer (1)Guide · 2026-08-30	Editorial team	Computer Forensics Lab	Original material
What Happens During EDiscovery ProcessingGuide · 2026-08-30	Editorial team	Computer Forensics Lab	NIST Computer Forensics Tool Testing programme
What Is A Forensic Hash And Why Does It MatterGuide · 2026-08-30	Editorial team	Computer Forensics Lab	ACPO/NPCC Good Practice Guide for Digital Evidence
What Is A Reasonable Electronic SearchGuide · 2026-08-29	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Disclosure in the Business and Property Courts
WhatsApp EvidenceGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Forensic Science Regulator Code of Practice, digital forensics
Who Accessed Or Downloaded A Confidential DocumentGuide · 2026-08-31	Editorial team	Computer Forensics Lab	ICO guide to the UK GDPR
Why Lawyers Should Test Search Terms Before Agreeing ThemGuide · 2026-08-30	Editorial team	Computer Forensics Lab	Practice Direction 57AD, Disclosure in the Business and Property Courts

Instruct the practice

Bring us in early.
Defensibility is built, not retrofitted.

Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.

Open a confidential matter→+44 (0)20 7164 6971Direct line info@e-discovery.ukEncrypted

Authors and sources

Bring us in early. Defensibility is built, not retrofitted.

Bring us in early.
Defensibility is built, not retrofitted.