Electronic discovery, or eDiscovery, is how parties in a lawsuit or government investigation locate, preserve, collect, review, and hand over evidence that exists in digital form. Because almost every document today is created and stored electronically, the Federal Rules of Civil Procedure include specific provisions for how this data gets handled. The work moves through a roughly sequential set of stages, starting the moment litigation becomes foreseeable and ending when polished document sets go to the other side. Mistakes at any stage can bring sanctions, blown budgets, or a lost case.
What Counts as Electronically Stored Information
The federal rules use “electronically stored information” (ESI) as a catch-all for anything created, sent, received, or stored in digital form. Emails, spreadsheets, Word documents, and PDFs are the obvious examples. ESI also covers text messages, voicemails, social media posts, mobile app data, calendar entries, and the metadata embedded in every file describing when it was created, who touched it, and how it changed.
Collaboration platforms like Slack and Microsoft Teams complicate the picture. A single Slack workspace can contain public and private channels, threaded replies, emoji reactions, edited or deleted messages, and files stored through linked services like SharePoint or Google Drive. Users can modify or remove messages after the fact, so manual preservation tends to be unreliable, and automated preservation tools are increasingly necessary to capture the data defensibly.
When the Duty to Preserve Kicks In
The moment you reasonably anticipate litigation, you have an obligation to preserve potentially relevant information. This duty attaches before anyone files a complaint. It can arise from a demand letter, a government subpoena, a regulatory investigation, or even internal awareness that a dispute is brewing. It comes from common law and can also be triggered by contracts, statutes, or regulations.
The standard tool for meeting the obligation is a legal hold, sometimes called a preservation notice. It is a formal directive telling everyone in the organization who might possess relevant data to stop deleting, overwriting, or altering anything connected to the dispute. An effective hold identifies specific custodians by name, maps the data sources involved (email servers, cloud storage, backup tapes, personal devices), and suspends any automated deletion policies that would otherwise destroy relevant files on schedule. Periodic reminders and compliance checks keep the hold alive.
What Happens if ESI Is Lost
Rule 37(e) governs sanctions when a party loses ESI it should have preserved and the information cannot be recovered elsewhere. If the loss prejudiced the other side, the court can order measures no more severe than necessary to cure that prejudice. The heavier sanctions, including an adverse inference instruction, dismissal, or default judgment, apply only when the court finds the party destroyed data on purpose to keep the other side from using it.1Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions Negligent or even reckless loss caps the response at curative measures; intentional destruction opens the door to case-ending consequences. Rule 37(e) reaches ESI only. Spoliation of physical evidence still falls under the court’s inherent authority.
Planning the Discovery With the Other Side
Before formal discovery begins, the parties negotiate the ground rules. Rule 26(f) requires a planning conference as soon as practicable, and no later than 21 days before the court’s scheduling conference or the deadline for a scheduling order.2Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery Within 14 days of the meeting, the parties submit a written discovery plan to the court.
Three topics matter most for eDiscovery. The parties must discuss preservation issues, given how easily ESI can be lost or altered. They need to agree on the forms of production, whether native files, images like TIFF or PDF, or a combination, because reaching agreement here avoids expensive reformatting fights later.2Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery And they should address privilege protection, including whether to ask for an order under Federal Rule of Evidence 502(d).
A 502(d) order provides that any inadvertent disclosure of privileged material during the litigation does not waive the privilege, and that non-waiver extends to any other federal or state proceeding.3Legal Information Institute. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product; Limitations on Waiver A private clawback agreement between the parties only binds the signatories. Getting a 502(d) order entered early is one of the most cost-effective steps in eDiscovery because it lets review teams work faster without fearing that one missed privileged document will blow the privilege on the whole subject matter.
Finding and Collecting the Data
Once preservation is in place and the discovery plan is taking shape, the next job is figuring out where the relevant data actually lives. That means interviewing custodians (the people who created or received potentially relevant information), mapping data sources across the organization, and cataloging everything from active email servers and cloud platforms to legacy systems and personal devices. The goal is to define the universe of data to be searched without missing important sources or pulling in so much noise that the project becomes unmanageable.
Collection takes more care than dragging files into a folder. Defensible collection uses forensic tools that preserve metadata: when a document was created, last modified, emailed, and by whom. Simply copying a file through normal methods can alter that metadata and undermine the evidence’s authenticity in court. The collection process produces a secure, verifiable copy of the ESI with an audit trail showing exactly how and when the data was extracted.
Teams choose between targeted collection, which pulls specific files or date ranges, and a full forensic image, which copies an entire hard drive bit for bit. Targeted collection is usually more proportionate and cost-effective. A forensic image makes sense when there are concerns about deleted files, data tampering, or hidden information that a targeted pull would miss.
Cutting the Data Down Before Review
Raw collected data is rarely ready for human review. Processing sits between collection and review, and its job is to shrink the data set to a manageable size while converting files into formats a review platform can handle.
De-duplication removes identical copies of the same file across custodians. In a corporate collection, the same email attachment might appear dozens of times. Each file is assigned a unique digital fingerprint called a hash value, and duplicates are eliminated. De-NISTing strips out system files that computers need to operate but that have zero relevance to any lawsuit, such as executable files, operating system components, and software libraries. Email threading groups an entire conversation chain so reviewers can see the full exchange in context rather than evaluating replies in isolation. Near-duplicate detection identifies files that are substantively identical but differ in format, like a Word document and the PDF it was printed to, so the team can handle them as a unit. Together, these steps routinely cut a data set by 30 to 60 percent before an attorney looks at a document.
Reviewing for Relevance and Privilege
Review is where the real expense accumulates. Legal teams examine every document in the processed data set for two things: whether it is relevant to any claim or defense in the case, and whether it is protected by a privilege that prevents disclosure, most commonly attorney-client privilege or work product protection.
Many teams now use Technology Assisted Review (TAR), also called predictive coding, to manage volume. TAR uses machine learning to learn from a senior attorney’s coding decisions on a sample set of documents, then scores the remaining documents by their likelihood of being relevant or privileged. Federal courts have accepted TAR as a legitimate review method since at least 2012, with one court noting that computer-assisted review should not be held to a higher standard than keyword searches or manual review.4Justia Law. Rio Tinto PLC v Vale SA et al TAR can reduce review costs by 60 to 80 percent compared with eyes-on-every-page review, though it requires quality control, typically through sampling the documents TAR classified as non-relevant to confirm that responsive material is not being missed.
The Privilege Log
When you withhold a document on privilege grounds, you cannot just refuse to hand it over and say nothing. Rule 26(b)(5) requires you to identify each withheld document and describe its nature in enough detail that the other side can evaluate your privilege claim, without revealing the privileged content itself.2Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery In practice, that means a privilege log listing each document with its date, author, recipients, subject, and the basis for the privilege assertion. In a large case, the log alone can run to thousands of entries. Negotiating categorical logging protocols at the Rule 26(f) conference, where similar documents are logged as a group rather than individually, can cut this burden considerably.
Handing Documents Over
Production is the formal handover of all responsive, non-privileged ESI. The parties either agree on a format during the Rule 26(f) conference or the court orders one. Rule 34 sets the default: if the requesting party does not specify a format, ESI must be produced either in the form in which it is ordinarily maintained or in a reasonably usable form, and a party does not have to produce the same information in more than one format.5Legal Information Institute. Federal Rules of Civil Procedure Rule 34 – Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes
Most productions use one of two approaches. Native production delivers files in their original format (the actual Excel file, the actual email), preserving full functionality and embedded metadata. Image production converts documents to static TIFF or PDF images that can be stamped with Bates numbers for easy reference but lose interactive features like spreadsheet formulas. Many cases use a hybrid, producing most documents as images while delivering spreadsheets, databases, and similar file types in native form where a flat image would strip the content of meaning.
Every production also includes a load file containing metadata fields for each document: sender, recipients, dates, file paths, hash values, and confidentiality designations, among others. The load file is what allows the receiving party to import the documents into its own review platform, search them, and organize them by custodian, date range, or any other criterion. Without a proper load file, a production of even a few thousand documents is essentially an unsearchable pile.
Keeping Costs Proportional
EDiscovery is expensive. Collection, processing, hosting, and review can easily run into six or seven figures in a complex case, with review alone often accounting for most of the bill. The federal rules address this through proportionality requirements designed to prevent discovery from becoming a weapon of attrition.
Rule 26(b)(1) defines the scope of allowable discovery as information that is both relevant and proportional to the needs of the case. Courts weigh six factors when deciding whether a request crosses the line: the importance of the issues at stake, the amount in controversy, the parties’ relative access to the relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense outweighs the likely benefit.2Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery A request to image every laptop in a company over a $50,000 contract dispute is unlikely to survive a proportionality challenge. The same request in a billion-dollar antitrust case might be entirely reasonable.
When production costs become genuinely disproportionate, courts have authority to shift some or all of those expenses to the requesting party. Rule 26(b)(2)(B) provides that a party does not have to produce ESI from sources that are not reasonably accessible due to undue burden or cost, though a court can still order production if the requesting party shows good cause. Rule 26(c)(1)(B) separately allows protective orders that allocate discovery expenses between the parties.2Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery Cost-shifting is not the norm. Courts generally expect the producing party to bear its own costs, and shifting them usually requires showing that the data is stored on difficult-to-access media like legacy backup tapes, or that the volume of the request is grossly disproportionate to the stakes.
The most effective way to control eDiscovery costs is to make smart decisions early. A focused ESI protocol at the Rule 26(f) conference, agreed search terms and custodian lists before collection begins, and aggressive processing all cost a fraction of what a bloated review costs later. Organizations with sound data governance policies already in place, controlling how ESI is created, retained, and disposed of, consistently spend less when a case does land.