An organization is sued, and its legal counsel asks IT to identify, preserve, collect, and produce all emails and documents relevant to a contract dispute for review by both parties. There is no indication of a security breach. Which process is this?

Electronic discovery, or e-discovery, is the legal process of identifying, preserving, collecting, reviewing, and producing electronically stored information that is relevant to litigation or a regulatory matter. Counsel defines the scope, legal holds stop routine deletion of relevant data, and IT helps collect messages, documents, and associated metadata in a defensible way so that they can be reviewed and produced to the opposing party. The scenario, a contract dispute with no breach, is a classic e-discovery request. Chain of custody is a documentation practice that shows who handled evidence and when; it supports e-discovery and investigations, but by itself it is not the process of finding and producing relevant records. Digital forensics is the scientific examination of systems and media to reconstruct events, recover deleted artifacts, and determine what happened, typically in the context of an incident or misconduct; reconstructing system activity is not what counsel asked for here. Threat hunting is the proactive search for undetected attackers in telemetry, which has no bearing on a contract dispute. Exam caveat: forensic techniques may be used within e-discovery when deleted data must be recovered, but the purpose remains legal production. Operational check: confirm legal holds are applied to the named custodians' mailboxes and that collected data is exported with metadata intact.