In many cases, forensics starts when *litigation is pending or is anticipated*. Legal counsel can send a legal hold or **litigation hold**, a *notice that informs an organization that they must preserve data and records that might be destroyed or modified in the course of their normal operations*. Backups, paper documents, and electronic files of all sorts must be preserved. >[!warning] Spoliation of Evidence >A key concept for legal holds and preservation is “spoliation of evidence,” which means *intentionally, recklessly, or negligently altering, destroying, fabricating, hiding, or withholding evidence* relevant to legal matters. A legal hold gives an organization notice that they must preserve that data. Ignoring the notice or mishandling data after the notice has been received can be a negative blow against an organization in court. Thus, having a strong legal hold process is important for organizations before a hold shows up. Legal holds are often one of the first parts of an **electronic discovery** or e-discovery process. Discovery processes allow each side of a legal case to *obtain evidence from each other and other parties involved in the case*, and e-discovery is simply an electronic discovery process. In addition to legal cases, discovery processes are *also often used for public records*, Freedom of Information Act requests, and investigations. It helps to view e-discovery using a framework, and the Electronic Discovery Reference Model (**EDRM**) is a useful model for this. The EDRM model uses nine stages to describe the discovery process: 1. **Information governance** before the fact to assess what data exists and to allow scoping and control of what data needs to be provided 2. **Identification** of electronically stored information so that you know what you have and where it is 3. **Preservation** of the information to ensure that it isn't changed or destroyed 4. **Collection** of the information so that it can be processed and managed as part of the collection process 5. **Processing** of the data to remove unneeded or irrelevant information, as well as preparing it for review and analysis by formatting or collating it 6. **Review** of the data to ensure that it only contains what it is supposed to, and that information that should not be shared is not included 7. **Analysis** of the information to identify key elements like topics, terms, and individuals or organisations 8. **Production** of the data to provide the information to third parties or those involved in legal proceedings 9. **Presentation** of the data, both for testimony in court and for further analysis with experts or involved parties One of the *most important and simultaneously most challenging* requirements in this process can be **preservation of electronic information**, particularly when data covered by a legal hold or discovery process is frequently used or modified by users in your organisation. Electronic discovery and legal hold support tools exist that can help with abilities to capture data for users or groups under litigation hold. They often come with desktop, mobile device, and server agents that can gather data, track changes, and document appropriate data handling throughout the legal hold time frame. In organisations that are frequently operating under legal holds, it is not uncommon for frequent litigation targets like CEOs, presidents, and others to be in a near-constant state of legal hold and discovery. Cloud operations have made e-discovery even more complex. Cloud vendors provide services to many customers and will not permit you to place an intrusive legal hold and discovery agent in their cloud service. That means that as you adopt cloud services, you must address how you would deal with legal holds for those services. Tools like Google's Vault provide both email archiving and discovery support, helping organisations meet their discovery requirements.