eDiscovery early case assessment is the front-end investigation phase where a legal team sizes up the volume, nature, and relevance of electronically stored information before committing to full-scale review. The work covers preservation, custodian mapping, search design, culling, and a realistic read on cost and exposure. Done well, it shapes every downstream decision: who to collect from, how much review will cost, whether settlement beats trial, and how to frame proportionality under the Federal Rules. Skipped or rushed, it turns discovery into guesswork backed by six-figure invoices.
Start With Preservation, Not Collection
The duty to preserve begins the moment your organization reasonably anticipates litigation, which is often well before a complaint is filed. At that point, you must suspend routine deletion policies and issue a litigation hold directing custodians to retain relevant data. Waiting for a formal lawsuit is one of the most common and most expensive mistakes in eDiscovery, because data lost during that gap can trigger sanctions.
A hold notice should identify the subject matter of the anticipated dispute, the types of data to preserve, and the specific systems where that data lives. It needs to reach every person who might have relevant information, and it needs follow-up. Courts have repeatedly criticized organizations that send a single email and assume compliance. The hold stays in place until counsel lifts it, which usually doesn’t happen until the case resolves.
Map Custodians and Data Sources
The first operational step is identifying who holds relevant data and where it lives. Custodians are the people whose files, emails, and messages may contain evidence. They typically include employees, executives, and sometimes third parties who interacted with the subject matter of the dispute. For each custodian, document the specific repositories they use: enterprise email, cloud storage, company-issued mobile devices, shared network drives, and collaboration tools.
This custodian-source map drives everything that follows. It sets the scope of the hold, informs the collection strategy, and feeds the initial disclosures required by Federal Rule 26(a)(1), which must identify individuals likely to have relevant information and describe the categories of documents and electronically stored information a party may use to support its claims or defenses.1Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery Those disclosures are due within 14 days of the Rule 26(f) conference unless the court sets a different deadline.
One area where ECA often goes sideways is custodian self-collection, where employees gather their own relevant files. Without oversight, custodians may miss data, accidentally alter metadata, or selectively collect. Courts have criticized this approach for breaking the chain of custody. If your budget doesn’t allow forensic collection for every custodian, supervised self-collection using validated tools with scripted filters for dates, file types, and locations is a defensible middle ground.
Use ECA Data at the Rule 26(f) Conference
Before formal discovery begins, the parties must meet at a Rule 26(f) conference to discuss preservation of electronically stored information, negotiate the scope of discovery, and develop a proposed discovery plan for the court within 14 days.1Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery The plan must address the form of production, phasing, privilege claims, and the overall timeline.
ECA results give you real leverage here. Instead of negotiating blind, you walk in knowing how many gigabytes of data you’re dealing with, which custodians have the densest collections, and roughly how many documents your search terms return. That matters because Rule 26(b)(1) limits discovery to what is proportional to the needs of the case, measured against six factors: the importance of the issues, the amount in controversy, each side’s relative access to information, the parties’ resources, the importance of the discovery in resolving the dispute, and whether the burden outweighs the likely benefit.1Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery
Without ECA data, proportionality arguments are just rhetoric. With it, you can show the court exactly how many documents a request would sweep in, what review would cost, and why a narrower scope serves the same purpose. This is also the stage to negotiate an ESI protocol: a written agreement covering how data will be preserved, collected, processed, reviewed, and produced. Locking the ESI protocol down early prevents fights later over issues like whether hyperlinked cloud documents count as attachments or what production format applies.
Design Search Terms and Metadata Filters
Narrowing millions of files down to a reviewable set requires both keyword searching and metadata filtering. Date ranges are the first cut. If the dispute involves events from 2022 to 2024, exclude everything outside that window. File type filters come next, targeting the formats most likely to contain evidence: email message files, word processing documents, spreadsheets, and PDFs.
Metadata filtering goes deeper by targeting fields like sender, recipient, creation date, and last-modified date. These fields exist as structured data attached to every file, separate from the document’s visible content.2Microsoft Purview. Document Metadata Fields in eDiscovery Filtering on metadata lets you isolate, for example, every email sent by a specific executive during a specific quarter without relying solely on keyword matches in the body text.
Keyword lists should reflect how the custodians actually communicate, not how lawyers describe the issues. Technical jargon, project code names, and abbreviations are often more useful than formal legal terms. Boolean operators (AND, OR, NOT) structure these terms into precise queries: “project alpha AND budget NOT draft” returns documents mentioning both the project and its budget while excluding early drafts. Test keywords against the dataset before finalizing them. A term that returns 500,000 hits isn’t filtering anything; a term that returns 12 hits may be too narrow. Iterating on hit counts lets you calibrate before committing to full collection.
Account for Ephemeral and Collaboration Data
Traditional ECA assumes data sits still. Ephemeral messaging and cloud collaboration tools break that assumption in ways that can torpedo a case.
Apps like Signal, Snapchat, and WhatsApp are built to delete messages automatically, sometimes removing content from the sender’s device, the receiver’s device, and the platform’s servers at once. Vanish-mode features destroy messages after viewing, leaving no recoverable copy. When litigation is reasonably anticipated, you have a legal duty to suspend these auto-deletion settings. Failing to do so is the kind of conduct that triggers spoliation sanctions. Some platforms also block screenshots, encrypt content in ways that resist collection, or allow untraceable messaging.
Cloud collaboration tools like Microsoft Teams, Slack, and Google Workspace present a different problem: modern attachments. When someone shares a file in an email or chat, many platforms send a hyperlink to a cloud-hosted document rather than attaching a static copy. That linked document can be edited, moved, or deleted after being shared, and multiple users may have access to modify it. Your ECA plan needs to address which version of a linked file gets collected (the version at the time of the communication, the most recent, or both), who the custodian of a shared file is, and whether linked files travel with the email family or stand alone. If the ESI protocol is silent on hyperlinked files, courts tend to resolve disputes by weighing proportionality, cost, and delay, and the outcome is less predictable than if you’d negotiated it upfront.
Cull, Deduplicate, and Consider TAR
After collection, the raw dataset almost always contains enormous amounts of irrelevant or redundant material. Culling strips it down to what actually needs human eyes, and the tools stack on top of each other.
Deduplication removes identical copies. In any corporate dataset, the same document gets saved in multiple locations, forwarded to multiple people, and backed up across multiple systems. Exact deduplication compares file hash values and eliminates perfect copies. Near-deduplication uses content-similarity algorithms to group files that are substantively the same but differ in trivial ways, like a file saved under two names or an email forwarded with a one-line addition. Reviewers code the primary document and apply the decision across the group.
Email threading provides another significant reduction. Instead of reviewing every message in a 40-reply chain independently, threading identifies the most complete message and suppresses the earlier versions. In practice, this can eliminate anywhere from 18 to 45 percent of the email volume depending on the dataset.
Technology-assisted review (TAR) uses machine learning to rank documents by likely relevance. The older approach, sometimes called TAR 1.0, requires a subject matter expert to review a training set until the algorithm builds a stable model of what “relevant” looks like. Only then does the broader review begin. The newer approach, continuous active learning (TAR 2.0), skips the separate training phase. Reviewers start working through documents from the beginning, and the algorithm learns from every coding decision in real time, continuously re-ranking the remaining documents so the most likely relevant ones surface first.
Courts have recognized TAR as a legitimate tool. In Da Silva Moore v. Publicis Groupe, the court held that computer-assisted review is an acceptable method for searching relevant electronically stored information and should be seriously considered in large-data-volume cases where it can save significant legal fees.3Justia Law. Da Silva Moore v Publicis Groupe et al Courts generally won’t force a party to use TAR. It’s a choice, and the producing party typically controls the methodology as long as the results are defensible.
Lock Down Production Format Early
Once culling is complete and the review set is defined, the data needs to be exported into a review platform and eventually produced to the opposing party. During export, the system generates load files that tell the review software how to organize and display each document alongside its metadata. The export process for a culled dataset typically takes one to three days depending on volume.
Three production formats dominate:
- Native files keep documents in their original format. This preserves full functionality, including embedded formulas in spreadsheets and hyperlinks in emails, and avoids conversion costs. Native files are harder to Bates-number and redact.
- TIFF images convert documents to static images, making Bates numbering and redaction straightforward. Conversion strips out metadata (which must be preserved separately in a load file) and eliminates searchability within the image itself. TIFF production has historically been the default but carries higher processing costs.
- PDF files sit in the middle, preserving searchability and allowing redaction through standard tools. Some metadata can be retained depending on conversion settings, though retention is not automatic.
Negotiate the format at the Rule 26(f) conference and lock it into the ESI protocol. Discovering halfway through review that the other side expects native production when you’ve been preparing TIFFs is the kind of avoidable problem ECA planning is designed to prevent.
Translate ECA Into Strategy and Budget
The strategic value of ECA comes from seeing the evidence landscape before you’ve spent the bulk of the budget. When your team identifies a high concentration of damaging documents early, the calculus shifts toward settlement. When you find gaps in the opposing party’s narrative, your negotiating position strengthens.
The cost impact is just as concrete. Attorney review is the most expensive phase of eDiscovery, with managed review attorneys typically billing between $25 and $40 or more per hour and per-document review rates commonly falling between $0.50 and $1.00. On a dataset of 500,000 documents, even small reductions in review volume translate to tens of thousands of dollars saved. Processing the data itself typically costs $25 to $100 per gigabyte depending on the vendor and pricing model, and hosting fees for active review databases add ongoing monthly costs on top of that.
ECA also exposes the privilege review burden. In any dataset with attorney-client communications, you’ll need a privilege log identifying every document withheld on privilege grounds. A traditional log requires a line-by-line entry for each withheld document listing the date, author, recipients, document type, and a description of the subject matter. In large cases, this alone can cost more than the substantive review. Categorical privilege logs, which group similar documents under a common privilege description, offer a less expensive alternative that many courts now accept for large-scale litigation. Knowing the volume of potentially privileged material during ECA lets you plan for the cost and negotiate the log format in the ESI protocol.
The practical result is that ECA prevents the scenario every litigator dreads: spending $300,000 on review and production for a case that could have settled for $50,000 if someone had looked at the data first.
What Happens If Preservation Fails
Poor ECA doesn’t just waste money. If electronically stored information that should have been preserved is lost because a party failed to take reasonable steps to keep it, and the lost data can’t be recovered from another source, Federal Rule 37(e) gives the court two tiers of response.4Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
For negligent loss that causes prejudice, the court can order measures necessary to cure that prejudice but nothing more. This might mean allowing additional discovery, reopening depositions, or giving a curative instruction. The response must be proportional to the harm.
For intentional destruction, consequences escalate. If the court finds that a party acted with the intent to deprive the other side of the evidence, it can presume the lost information was unfavorable to the destroying party, instruct the jury to draw that same presumption, or dismiss the case entirely or enter default judgment.4Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery These severe sanctions are reserved for intentional conduct. Negligence alone, even gross negligence, does not justify an adverse inference instruction under the current rule.
Three conditions must be met before any sanction applies: the data should have been preserved, a party failed to take reasonable steps to preserve it, and the data cannot be restored or replaced through additional discovery. That last element matters more than people realize. If the same emails exist on a backup server or in the opposing party’s own files, the information isn’t legally “lost” and Rule 37(e) doesn’t apply. ECA is the phase where you identify these backup sources and redundancies, which is your best insurance against a spoliation motion.