## 3 Digital Investigations  
This section provides an overview of the electronic discovery (e-discovery) process that can be followed in a competition or regulatory environment. Figure 1 illustrates an indicative CoC, ensuring that data remain unaltered, secure, and properly documented during the Electronic Discovery Reference Model (EDRM) ([[https://edrm.net/edrm-model](https://edrm.net/edrm-model)]([https://edrm.net/edrm-model](https://edrm.net/edrm-model))) (accessed date 12 March 2025) process. More specifically, at the beginning of a dawn raid, the investigators work to identify the IT infrastructure of the company and focus on specific data types of interest. Then, depending on the case's needs, they may acquire physical (forensic) images, logical images, or collect hand-picked data utilizing specific keywords (targeted images), adhering to GDPR guidelines. The process of data collection and the generation of digital signatures via cryptographic hash functions (e.g., MD5, SHA-1) to ensure data consistency is meticulous and can take several days [24]. Once collected, the data are secured in encrypted external storage devices and transferred to facilities. After a Legal Professional Privilege (LPP) process to safeguard confidential communications, documents, or personal data from subsequent procedures, the data are stored in ISO 27001-certified infrastructure. Afterward, the Electronically Stored Information (ESI) must be processed and transformed into an appropriate format to serve as valid input for forensic tools. This stage involves several demanding tasks, including data extraction, cleaning, and indexing, which are both time- and resource-intensive. Following preparation, the digital evidence is shared with the case handlers, who can then assess it using the appropriate functionalities of forensic applications to support their investigation, ultimately guiding to the legal and economic review. From an economic perspective, cartel detection involves identifying and analyzing collusive behavior among firms against consumers, typically to increase profits at the expense of consumers and overall market efficiency [25]. Economists and competition authorities use various tools and methods to detect cartels, as they operate secretly and their activities are considered illegal in most jurisdictions. Additionally, cartel detection and digital forensics are increasingly intertwined, especially in the modern era where digital communication and Big Data play a crucial role in business operations [26]. Digital forensics provide tools and techniques to uncover evidence of collusion, which is critical for detecting and prosecuting cartels. Resulting from the EDRM framework, forensic tools operate in three key phases of the digital evidence, i.e., collection, preservation, and analysis, to support effective investigation of illegal activities and anti-competitive practices [27]. In the context of cartel detection, digital forensics can help in _(i)_ uncovering electronic communications (e.g., emails, chats, etc.) that reveal collusion, _(ii)_ analyzing metadata to  
Figure 1: The steps of a Chain of Custody for competition purposes that tracks the movement of electronic evidence throughout its lifecycle. establish timelines and connections between parties, (_iii_) recovering deleted or hidden data that may contain evidence of illegal agreements, and (_iv_) providing admissible evidence for legal proceedings. Depending on the nature of the investigation, the case handlers can use various forensics applications with different analytical capabilities. Forensic software usually focus on specific steps of the CoC and a single type of hardware device. Therefore, forensics applications can be categorized using four primary criteria: (_i_) function (purpose), (_ii_) device type, (_iii_) hosting Operating System (OS), and (_iv_) licensing. The function criterion considers the CoC step that the application provides its main functionalities, e.g., data acquisition, data processing, or forensic analysis.