One of the best articles I have read on the subject, as it was very thorough and does draw the line between forensics and e-discovery. I do wish there was more insight in the post collection phase of pre-process/ culling, and what various practices are being used. I can imagine that to be a whole other topic, but a great follow up to this article.

Mary: After capturing a digital file, one way to preserve it for legal purposes is to sign it with a voice signature. The voice signature preserves a personal link to the investigator (and to his/her intentions) that survive even if the investigator is no longer available by the time trial arrives. What do you think? --Ben http://hack-igations.blogspot.com/2008/04/text-message-investigations.html

I know this is an article in your "Toolbox" series, but completely ignoring the staff costs for doing e-discovery and forensic processing presents an extremely skewed picture of costs. Who cares about $25K for enCase when staff salaries to support e-discovery or digital forensics can easily dwarf this cost? This stuff is labor-intensive no matter what tool you use and the demand for it is growing - expect software and hardware costs to be the least of your worries if you're making the decision to do this in-house vs. outsource it.