Examples of electronic discovery include email, instant messages (chat), databases, accounting records, surfing history and any other electronically-stored information which could be relevant evidence.

Electronic discovery is a basic part of forensic analysis but commonly used to determine the scope for the forensics investigator and customer.

Electronic Mail can be maintained on a remote server, known as IMAP or Webmail, or on the local machine, known as POP3.

Instant Messenger conversations from MSN, AOL, Gtalk, Skype and Yahoo! are logged to local cache files and can usually be retrieved using forensics software. Internet Relay Chat (IRC) is not generally logged locally, but can be extracted from memory captures and over network surveillance.

Databases and accounting records are easily parsed using a variety of forensic accounting tools.

Web surfing history can generally be retrieved using internet cookies, timestamps, temporary files and browser history. Users generally clean this type of cache, but the data can still be retrieved using forensics tools.