eDiscovery, short for electronic discovery, is the legal and compliance process for preserving, searching, reviewing, and producing digital records such as email, chats, documents, logs, and cloud content. It is important in cyber security because incident response, litigation, and regulatory investigations often depend on proving what happened, when it happened, and who had access. Good eDiscovery workflows help keep evidence intact and reduce the risk of accidental deletion or tampering.
In real environments, eDiscovery is often used after phishing, insider theft, ransomware, or policy violations to place legal holds on mailboxes, Teams messages, files, and other records, then search them by keyword, date, user, or custodian. Security teams and counsel may use tools like Microsoft Purview to collect relevant data and export it for review. Attackers may try to erase chats, rely on temporary messaging, or move data into systems with weak retention, which makes retention policies, audit logs, and centralized governance essential defenses.