Corporate ediscovery is the process a company follows to identify, preserve, collect, review, and produce electronically stored information when it faces litigation, a regulatory investigation, or an internal probe. The Federal Rules of Civil Procedure govern how it is done, and the margin for error is thin. Under Rule 37(e), if a company loses discoverable data because it failed to take reasonable preservation steps, a court can order measures to cure the prejudice; if it finds the loss was intentional, the court can instruct the jury to presume the lost data was unfavorable or dismiss the case outright. Everything described below exists to keep a company out of that second category.
What Data Is in Scope
Electronically stored information, or ESI, covers essentially anything digital the company creates or receives. Email is still the center of gravity in most cases, but it is no longer the whole picture. Messages on Slack, Microsoft Teams, and Zoom chat generate large volumes of informal but legally significant conversation, with timestamps and participant logs that can reconstruct who knew what and when.
Cloud documents in Google Workspace or SharePoint are discoverable whether or not they ever touched a company server. Company-issued phones add text messages, call logs, and app-based communications. Databases holding customer records, financial transactions, or HR files fall within scope. So does legacy data sitting on backup tapes or decommissioned servers. Voice recordings and surveillance video count too. If a digital record exists within the company’s infrastructure and relates to the dispute, assume it is discoverable.
Metadata matters as much as content. Creation dates, edit histories, and the identity of the last person who touched a file provide an objective timeline that the visible document may not reveal, and courts expect that metadata to be preserved and produced along with the files themselves.
Chat Apps and Disappearing Messages
Signal, WhatsApp, and Telegram, along with the disappearing-message features built into mainstream platforms, have become a serious preservation problem. An auto-delete setting does not excuse a company from its preservation duty. A litigation hold that mentions only “email” and “electronic documents” is not enough. The hold has to tell custodians, in plain terms, to disable auto-delete on every platform they use for business communication, and someone has to confirm it actually happened. Courts have imposed sanctions even when the hold was properly issued but the company never checked whether custodians followed through.
The exposure is not hypothetical. Between 2021 and 2024, the SEC and CFTC together imposed well over two billion dollars in fines against financial firms for failing to preserve business communications sent through personal messaging apps. In 2025, the Seventh Circuit affirmed the dismissal of a case where a party failed to preserve text messages. Any company that lets employees conduct work on personal messaging apps needs a written policy and the technical ability to enforce preservation the moment a hold is triggered.
Social Media
Corporate accounts on LinkedIn, X, Facebook, and Instagram are ESI, subject to the same preservation duties as email. The duty reaches any account the company controls or has the practical ability to access. Holds should name social media explicitly, and companies should capture posts, comments, direct messages, and associated metadata using the platform’s export tools or a third-party archiving product. Deleting posts, deactivating accounts, or “cleaning up” profiles after a dispute arises has drawn sanctions.
The Rule 26(f) Conference
Before discovery begins in earnest, the Federal Rules require the parties to meet and build a joint discovery plan. This conference must happen at least 21 days before the court’s scheduling conference, and for ediscovery it is where the most consequential decisions get locked in, often before either side has looked at a single document.
The plan has to address several ESI-specific questions: which data sources each side will search, the form of production (native files, images with extracted text, or both), how privilege will be handled after production, and the scope of preservation, including which custodians and date ranges are covered. Agreements reached here can be rolled into a court order, which gives them real force.
Treating the 26(f) conference as a formality is a common and expensive mistake. If a party does not raise format preferences, the producing side gets to choose, and Rule 34 only requires production in the form the data is “ordinarily maintained” or in a “reasonably usable” form. That default may not include the metadata fields the requesting side actually needs, and fixing it later means paying to reprocess the data.
Proportionality Under Rule 26(b)(1)
Discovery is not unlimited. Rule 26(b)(1) limits the scope of discovery to nonprivileged material that is both relevant and proportional to the needs of the case. Courts weigh six factors:
- The importance of the issues at stake
- The amount in controversy
- The parties’ relative access to the information
- The parties’ resources
- The importance of the discovery to resolving the issues
- Whether the burden or expense outweighs the likely benefit
A $50,000 contract dispute will not support a $2 million collection effort. A mid-size company facing demands from a much larger adversary can sometimes get relief on resources grounds. Peripheral topics draw harder scrutiny than central ones. The practical lesson is to quantify the burden specifically: a party that can show precise, documented cost and effort tends to succeed in narrowing overbroad requests, while a party that simply refuses to produce without articulating a proportionality argument invites sanctions.
Issuing and Managing a Legal Hold
Once litigation is reasonably anticipated, the company must issue a litigation hold directing employees to stop deleting anything that could be relevant. The hold goes to “custodians,” the specific people whose files, email, and messages might contain responsive material. Picking those custodians is one of the hardest judgment calls in the process. Too narrow and the company risks spoliation; too wide and costs balloon.
A real hold notice does more than say “preserve everything.” It identifies the specific types of data to preserve, names the relevant date range, and gives concrete, non-technical instructions for disabling auto-delete on email, messaging apps, and cloud storage. It has to be in writing so there is a record, and it has to be clear enough that someone outside the legal or IT departments can actually follow it.
Issuing is only the start. Legal has to track acknowledgments from each custodian, follow up with anyone who does not respond, and reissue or update the hold as the case develops and new custodians surface. Under Rule 37(e), the remedies for lost ESI turn on whether the loss resulted from mere negligence or from intent to deprive the other side of the evidence. Negligent loss, where the other side was prejudiced, can produce curative measures. Intentional loss can produce an adverse inference instruction or dismissal. That line is why documentation matters so much. A company that can show exactly when the hold went out, who got it, who acknowledged it, and what was done to enforce compliance has a defensible record even if some data is ultimately lost.
Mapping and Collecting the Data
Technical work begins with a data map: an inventory of every server, application, cloud platform, and storage device where company data lives. Without it, collection teams miss silos, and the other side eventually finds the gaps. The map should cover current production systems plus backup tapes, archived mailboxes, and decommissioned servers that may still hold relevant files.
Once the map identifies where the relevant data sits, the collection team chooses between forensic imaging and targeted collection. Forensic imaging makes a bit-for-bit copy of a drive, capturing deleted files and unallocated space that a simple file copy would miss. Industry pricing surveys put most forensic mobile-device collections in the $250 to $350 range per device, with server imaging running higher. Targeted collection pulls only specific file types or date ranges, costs less, and is fine when there is no concern about deleted content, but it risks altering metadata during transfer, which can undermine defensibility if challenged.
After collection, the data runs through processing: deduplication to remove exact copies, text extraction from images and PDFs, and indexing to make everything searchable. Processing typically costs $25 to $100 per gigabyte, depending on the platform and pricing model. Processed data then lands in a review platform where attorneys can search, filter, and evaluate each document for relevance and privilege.
Reviewing the Documents
Manually reading every document in a large case is often impossible. A single custodian’s mailbox can hold hundreds of thousands of messages, and a case with dozens of custodians can produce millions of documents. Technology-Assisted Review (TAR), also called predictive coding, uses machine learning to rank documents by likely relevance based on how attorneys code a sample.
The dominant approach today is Continuous Active Learning, where the algorithm reranks the remaining documents after each batch of coding decisions. Reviewers see the most likely relevant material first and spend their time on high-value documents instead of irrelevant files. The process runs until the system can no longer surface new relevant material in the unreviewed population.
Federal courts have accepted TAR as a defensible review method since 2012. Defensibility rests on transparency: documenting the seed set, the training rounds, the recall measurement, and the quality-control sampling. TAR does not remove human review; it concentrates human attention on the documents that matter and tends to produce more consistent coding than large teams of contract attorneys working in parallel. Volume reductions of 60 to 80 percent for human review are common on large matters, and that reduction is usually the single largest line-item savings in the ediscovery budget.
Privacy and Redaction
Producing documents in litigation does not suspend privacy obligations. Rule 5.2 requires filings with the court to redact certain personal identifiers: only the last four digits of Social Security, taxpayer identification, and financial account numbers; only the birth year rather than the full date; and only a minor’s initials rather than full name.
HIPAA, GDPR, and state privacy laws add further requirements. Protected health information, biometric data, and certain sensitive personal data categories may need to be redacted even from otherwise responsive documents. Common triggers include medical records, credit card numbers, driver’s license numbers, IP addresses, and photographs where individuals are identifiable. Modern review platforms handle much of this through pattern-based batch redaction that flags strings matching known formats, but context-dependent information still needs human eyes. Under-redacting creates privacy liability; over-redacting looks like obstruction.
Privilege Review and Rule 502(d)
Protecting attorney-client privilege during a large production is one of the highest-stakes tasks in the process. A single privileged email that slips through can waive privilege not just for that document but potentially for the entire subject matter. Federal Rule of Evidence 502(d) exists to neutralize that risk. A court order under 502(d) declares that producing a privileged document during the litigation does not waive the privilege, in this case or in any other federal or state proceeding.
With a 502(d) order in place, a company can claw back an inadvertently produced privileged document without having to prove its review process was reasonable. Without the order, the company falls back on Rule 502(b), which requires showing it took reasonable precautions, caught the error promptly, and produced few privileged documents overall. That is a harder standard, especially in high-volume cases where even a disciplined review will have some error rate. Asking for a 502(d) order at the Rule 26(f) conference should be routine.
For documents intentionally withheld as privileged, the company has to provide a privilege log describing each withheld document in enough detail for the other side to assess the claim. In cases with thousands of privileged documents, a document-by-document log can be enormously expensive. Some courts permit categorical logs, which group similar documents rather than itemizing each one. The argument for a categorical log is strongest when the volume genuinely makes itemization burdensome, and the parties should raise the option during the initial meet-and-confer.
Producing the Data
At production, the reviewed documents get packaged and transferred to the other side. Most productions move through a Secure File Transfer Protocol site with password protection and access logging. When volumes exceed several terabytes, parties sometimes ship encrypted external drives by trackable courier, relying on encryption to keep the contents unreadable if the device is lost.
Every production includes a load file, the technical glue that ties images, extracted text, and metadata together so the receiving party’s software can display, search, and filter the documents properly. The specific fields in a load file (Bates ranges, custodian names, date fields, parent-attachment relationships) should be agreed on during the Rule 26(f) conference or in a separate ESI protocol. Without a correctly formatted load file, the recipient gets a pile of disconnected images and text.
Each page carries a Bates number, a unique alphanumeric identifier that makes every document trackable through the rest of the litigation. Bates numbers run sequentially and usually include a prefix identifying the producing party, so both sides can reference specific documents unambiguously in depositions, motions, and at trial. A production log listing every document by Bates range accompanies the delivery and lets the receiving party verify completeness.
What Corporate Ediscovery Costs
Ediscovery is often the single largest expense in commercial litigation, and the cost accumulates across phases. Processing raw data into a reviewable format typically runs $25 to $100 per gigabyte. Hosting on a review platform runs roughly $25 per 100 gigabytes per month, with pricing models that vary widely between vendors. These numbers sound manageable until a mid-size case turns out to involve several hundred gigabytes across a handful of custodians.
Document review is the real cost driver. Contract attorneys doing first-pass review average around $50 per hour, and a large case with 20 reviewers working full-time for three months can produce review costs in the millions. TAR can reduce that figure substantially, but it demands upfront investment in training the algorithm and validating results. Companies that skip TAR on large matters because the setup looks expensive usually spend far more on linear review.
Rule 26(b)(1) proportionality includes weighing whether the burden and expense of discovery outweighs its likely benefit. A company facing disproportionate costs can ask the court to narrow the scope or, in some circumstances, shift part of the expense to the requesting party. Cost-shifting is most likely when the request targets hard-to-access sources like legacy backup tapes, and the court considers factors including the amount in controversy and each party’s resources. The time to raise cost concerns is early, at the Rule 26(f) conference, before the money has already been spent.