Electronic discovery

The Electronic Discovery Reference Model (EDRM) is an ubiquitous diagram that represents a conceptual view of these stages involved in the ediscovery process. Identification The identification phase is when potentially responsive documents are identified for further analysis and review. In the United States, in Zubulake v. UBS Warburg, Shira Scheindlin ruled that failure to issue a written legal hold notice whenever litigation is reasonably anticipated will be deemed grossly negligent. This holding brought additional focus to the concepts of legal holds, eDiscovery, and electronic preservation. Custodians who are in possession of potentially relevant information or documents are identified. Data mapping techniques are often employed to ensure a complete identification of data sources. Since the scope of data can be overwhelming or uncertain in this phase, attempts are made to reasonably reduce the overall scope during this phase—such as limiting the identification of documents to a certain date range or custodians. Preservation A duty to preserve begins upon the reasonable anticipation of litigation. Data identified as potentially relevant during preservation is placed in a legal hold. This ensures that data cannot be destroyed. Care is taken to ensure this process is defensible, while the end goal is to reduce the possibility of data spoliation or destruction. Failure to preserve can lead to sanctions. Even if a court does not rule that the failure to preserve is negligence, they can force the accused to pay fines if the lost data puts the defense "at an undue disadvantage in establishing their defense." Collection Once documents have been preserved, collection can begin. The collection is the transfer of data from a company to its legal counsel, who will determine the relevance and disposition of data. Some companies that deal with frequent litigation have software in place to quickly place legal holds on certain custodians when an event (such as legal notice) is triggered and begin the collection process immediately. Other companies may need to call in a digital forensics expert to prevent the spoliation of data. The size and scale of this collection are determined by the identification phase. Processing During the processing phase, native files are prepared to be loaded into a document review platform. Often, this phase also involves the extraction of text and metadata from the native files. Various data culling techniques are employed during this phase, such as deduplication and de-NISTing. Sometimes native files will be converted to a petrified, paper-like format (such as PDF or TIFF) at this stage to allow for easier redaction and Bates-labeling. Modern processing tools can also employ advanced analytic tools to help document review attorneys more accurately identify potentially relevant documents. Review During the review phase, documents are reviewed for responsiveness to discovery requests and for privilege. Different document review platforms and services can assist in many tasks related to this process, including rapidly identifying potentially relevant documents and culling documents according to various criteria (such as keyword, date range, etc.). Most review tools also make it easy for large groups of document review attorneys to work on cases, featuring collaborative tools and batches to speed up the review process and eliminate work duplication. Analysis Qualitative analysis of the content discovered in the collection phase and after being reduced by the preprocessing phase. The evidence is looked at in context. Correlation analysis or contextual analysis to extract structured information relevant to the case. Structuring the data along a timeline or clustered by topic is common. For example, one can arrange evidence by how it relates members of a group as a form of social network analysis. Production Documents are turned over to opposing counsel based on agreed-upon specifications. Often this production is accompanied by a load file, which is used to load documents into a document review platform. Documents can be produced either as native files or in a petrified format (such as PDF or TIFF) alongside metadata. Presentation Displaying and explaining evidence before audiences (at depositions, hearings, trials, etc.). The idea is that the audience understands the presentation, and non-professionals can follow the interpretation. Clarity and ease of understanding are the focus here. The native form of data needs to be abstracted, visualized, and brought into context for the presentation. The results of the analysis should be the subject of the presentation. Clear documentation should provide reproducibility. ==Types of electronically stored information==

Any data that is stored in an electronic form may be subject to production under common eDiscovery rules. This type of data has historically included email and office documents (spreadsheets, presentations, documents, PDFs, etc.) but can also include photos, video, instant messaging, collaboration tools, text (SMS), messaging apps, social media, ephemeral messaging, Internet of things (smart devices like smart watches, virtual assistants, and smart home hubs), databases, and other file types. Also included in ediscovery is "raw data", which forensic investigators can review for hidden evidence. The original file format is known as the "native" format. Litigators may review material from ediscovery in one of several formats: printed paper, "native file", or a petrified, paper-like format, such as PDF files or TIFF images. Modern document review platforms accommodate the use of native files and allow for them to be converted to TIFF and Bates-stamped for use in court. Electronic messages In 2006, the U.S. Supreme Court's amendments to the Federal Rules of Civil Procedure created a category for electronic records that, for the first time, explicitly named emails and instant message chats as likely records to be archived and produced when relevant. One type of preservation problem arose during the Zubulake v. UBS Warburg lawsuit. Throughout the case, the plaintiff claimed that the evidence needed to prove the case existed in emails stored on UBS' own computer systems. Because the emails requested were either never found or destroyed, the court found that they were more likely to exist than not. The court found that while the corporation's counsel directed that all potential discovery evidence, including emails, be preserved, the staff that the directive applied to did not follow through. This resulted in significant sanctions against UBS. To establish authenticity, some archiving systems apply a unique code to each archived message or chat. The systems prevent alterations to original messages, messages cannot be deleted, and unauthorized persons cannot access the messages. The formalized changes to the Federal Rules of Civil Procedure in December 2006 and 2007 effectively forced civil litigants into a compliance mode with respect to their proper retention and management of electronically stored information (ESI). Improper management of ESI can result in a finding of spoliation of evidence and the imposition of one or more sanctions, including adverse inference jury instructions, summary judgment, monetary fines, and other sanctions. In some cases, such as Qualcomm v. Broadcom, attorneys can be brought before the bar. In United States v. Heppner (2026), a federal court held that chats with a public generative AI tool, Claude, were not privileged under the circumstances presented, highlighting AI chatbot conversations as a potential category of discoverable electronically stored information. Databases and other structured data Structured data typically resides in databases or datasets. It is organized in tables with columns, rows, and defined data types. The most common are Relational Database Management Systems (RDBMS) that are capable of handling large volumes of data such as Oracle, IBM Db2, Microsoft SQL Server, Sybase, and Teradata. The structured data domain also includes spreadsheets (not all spreadsheets contain structured data, but those that have data organized in database-like tables), desktop databases like FileMaker Pro and Microsoft Access, structured flat files, XML files, data marts, data warehouses, etc. Audio Voicemail is often discoverable under electronic discovery rules. Employers may have a duty to retain voicemail if there is an anticipation of litigation involving that employee. Data from voice assistants like Amazon Alexa and Siri have been used in criminal cases. ==Reporting formats==

Although petrifying documents to static image formats (TIFF & JPEG) had become the standard document review method for almost two decades, native format review has increased in popularity as a method for document review since around 2004. Because it requires the review of documents in their original file formats, applications and toolkits capable of opening multiple file formats have also become popular. This is also true in the ECM (Enterprise Content Management) storage markets, which converge quickly with ESI technologies. Petrification involves the conversion of native files into an image format that does not require the use of native applications. This is useful in the redaction of privileged or sensitive information since redaction tools for images are traditionally more mature and easier to apply on uniform image types by non-technical people. Efforts to redact similarly petrified PDF files by incompetent personnel have removed redacted layers and exposed redacted information, such as social security numbers and other private information. Traditionally, electronic discovery vendors had been contracted to convert native files into TIFF images (for example, 10 images for a 10-page Microsoft Word document) with a load file for use in image-based discovery review database applications. Increasingly, database review applications have embedded native file viewers with TIFF capabilities. With both native and image file capabilities, it could either increase or decrease the total necessary storage since there may be multiple formats and files associated with each individual native file. Deployment, storage, and best practices are becoming especially critical and necessary to maintain cost-effective strategies. Structured data are most often produced in delimited text format. When the number of tables subject to discovery is large or relationships between the tables are of essence, the data are produced in native database format or as a database backup file. ==Common issues==

A number of different people may be involved in an electronic discovery project: lawyers for both parties, forensic specialists, IT managers, and records managers, amongst others. Forensic examination often uses specialized terminology (for example, "image" refers to the acquisition of digital media), which can lead to confusion. While attorneys involved in case litigation try their best to understand the companies and organizations they represent, they may fail to understand the policies and practices that are in place in the company's IT department. As a result, some data may be destroyed after a legal hold has been issued by unknowing technicians performing their regular duties. Many companies are deploying software that properly preserves data across the network to combat this trend, preventing inadvertent data spoliation. Given the complexities of modern litigation and the wide variety of information systems on the market, electronic discovery often requires IT professionals from both the attorney's office (or vendor) and the parties to the litigation to communicate directly to address technology incompatibilities and agree on production formats. Failure to get expert advice from knowledgeable personnel often leads to additional time and unforeseen costs in acquiring new technology or adapting existing technologies to accommodate the collected data. ==Emerging trends==

Alternative collection methods Currently the two main approaches for identifying responsive material on custodian machines are: (1) where physical access to the organisation’s network is possible — agents are installed on each custodian machine which push large amounts of data for indexing across the network to one or more servers that have to be attached to the network; or (2) where it is impossible or impractical to attend the physical location of the custodian system — storage devices are attached to custodian machines (or company servers) and then each collection instance is manually deployed. In relation to the first approach there are several issues: • In a typical collection process large volumes of data are transmitted across the network for indexing and this impacts normal business operations. • The indexing process is not 100% reliable in finding responsive material. • IT administrators are generally unhappy with the installation of agents on custodian machines. • The number of concurrent custodian machines that can be processed is severely limited due to the network bandwidth required. New technology is able to address problems created by the first approach by running an application entirely in memory on each custodian machine and only pushing responsive data across the network. This process has been patented and embodied in the ISEEK tool, which has been the subject of a conference paper by Adams, Mann and Hobbs. In relation to the second approach, despite self-collection being a hot topic in eDiscovery, concerns are being addressed by limiting the involvement of the custodian to simply plugging in a device and running an application to create an encrypted container of responsive documents. Regardless of the method adopted to collect and process data there are few resources available for practitioners to evaluate the different tools. This is an issue due to the significant cost of eDiscovery solutions. Notwithstanding the limited options for obtaining trial licences for the tools, a significant barrier to the evaluation process is creating a suitable environment in which to test such tools. Adams suggests the use of the Microsoft Deployment Lab which automatically creates a small virtual network running under Hyper-V. Technology-assisted review Technology-assisted review (TAR)—also known as computer-assisted review or predictive coding—involves the application of supervised machine learning or rule-based approaches to infer the relevance (or responsiveness, privilege, or other categories of interest) of ESI. Technology-assisted review has evolved rapidly since its inception circa 2005. Following research studies indicating its effectiveness, TAR was first recognized by a U.S. court in 2012, by an Irish court in 2015, and by the High Court in England in 2016. In 2015, the United States District Court for the Southern District of New York declared that it is "black letter law that where the producing party wants to utilize TAR for document review, courts will permit it." The following year, that court stated, Maura R. Grossman and Gordon Cormack have defined TAR as: A process for Prioritizing or Coding a Collection of Documents using a computerized system that harnesses human judgments of one or more Subject Matter Expert(s) on a smaller set of Documents and then extrapolates those judgments to the remaining Document Collection. Some TAR methods use Machine Learning Algorithms to distinguish Relevant from Non-Relevant Documents, based on Training Examples Coded as Relevant or Non-Relevant by the Subject Matter Experts(s), while other TAR methods derive systematic Rules that emulate the expert(s)’ decision-making process. TAR processes generally incorporate Statistical Models and/or Sampling techniques to guide the process and to measure overall system effectiveness. Convergence with information governance Anecdotal evidence for this emerging trend points to the business value of information governance (IG), defined by Gartner as "the specification of decision rights and an accountability framework to encourage desirable behavior in the valuation, creation, storage, use, archival, and deletion of information. It includes the processes, roles, standards, and metrics that ensure the effective and efficient use of information in enabling an organization to achieve its goals." As compared to eDiscovery, information governance as a discipline is relatively new. Yet, there is traction for convergence. eDiscovery—a multi-billion-dollar industry—is rapidly evolving, ready to embrace optimized solutions that strengthen cybersecurity (for cloud computing). Since the early 2000s, eDiscovery practitioners have developed skills and techniques that can be applied to information governance. Organizations can apply the lessons learned from eDiscovery to accelerate their path to a sophisticated information governance framework. The Information Governance Reference Model (IGRM) illustrates the relationship between key stakeholders and the Information Lifecycle and highlights the transparency required to enable effective governance. The updated IGRM v3.0 emphasizes that Privacy & Security Officers are essential stakeholders. This topic is addressed in an article entitled "Better Ediscovery: Unified Governance and the IGRM," published by the American Bar Association. ==See also==