The Aftermath of a Breach: Evidentiary Protections Related to Forensic Investigations in Limbo

Courts have sometimes ruled that forensic investigations of a breach are protected by the rules of attorney-client privilege or work-product protection, and therefore, are shielded from the discovery process.