An ediscovery workflow is the sequence legal teams follow to identify, preserve, collect, process, review, produce, and present electronically stored information in litigation. Each stage carries its own obligations under the Federal Rules of Civil Procedure and the Federal Rules of Evidence, and the choices made early in the process determine how much a case will cost and whether its evidence will survive challenge. Electronically stored information became a formally recognized category of discoverable material under the 2006 amendments to the federal rules, and those rules still define the boundaries of every step below.1Legal Information Institute. Federal Rules of Civil Procedure Rule 34 – Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes – Section: Notes
Identifying Data and Custodians
The first job is mapping what data exists, where it lives, and who controls it. Legal teams catalog the sources of electronically stored information across an organization: email servers, instant messaging platforms, databases, shared drives, cloud storage, and anything else that might hold relevant material. The goal is to define the universe of potentially responsive data before anyone starts pulling files.
Picking the right custodians drives everything downstream. Custodians are the people who created, received, or maintained relevant data during the timeframe of the dispute. Miss a key custodian here and critical evidence never enters the workflow; discovering the gap later can derail the case. The same custodian may also have files on a laptop, a personal phone, a cloud backup, and a corporate collaboration platform, and each location has to be identified separately.
Federal Rule of Civil Procedure 26(f) requires the parties to confer early in the litigation about the scope and form of electronic discovery.2Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery That conference is where the sides agree on which custodians and data sources fall within collection scope, what file formats will be exchanged, and whether any data is inaccessible or unreasonably burdensome. Settling those details up front prevents expensive re-collection later.
Ephemeral and off-channel communications deserve attention at this stage. Slack, Microsoft Teams, Signal, and similar tools with auto-delete or end-to-end encryption now carry the same preservation obligations as traditional email. In January 2024, the FTC and DOJ stated that failing to preserve data from these platforms can constitute spoliation or even criminal obstruction of justice, with regulators describing some applications as tools “designed to hide evidence.” Bring-your-own-device policies compound the problem by leaving a company unable to access messages stored on hardware it does not own.
Preservation and the Legal Hold
Once litigation is reasonably foreseeable, the organization must act immediately to prevent relevant data from being deleted. This obligation attaches before a lawsuit is filed. A legal hold notice goes out to employees and IT directing them to suspend routine deletion policies, including automated systems that purge old emails or overwrite backup tapes.
The notice has to be specific. It should identify a date range, the relevant topics or keywords, and the custodians who must acknowledge their obligation to preserve. Vague instructions produce vague compliance, which is how evidence disappears even when everyone technically followed the hold.
Issuing the hold is only the first step; proving it worked is what matters when a judge later asks tough questions. Maintain an audit trail covering every hold activity: when the notice went out, who received it, who acknowledged it, and when follow-ups occurred with non-responsive custodians. IT needs its own documented confirmation that auto-delete functions were suspended and backup procedures adjusted. If an opponent later alleges spoliation, this record is what shows reasonable steps were taken.
What Rule 37(e) Does When Data Is Lost
Federal Rule of Civil Procedure 37(e) governs what happens when electronically stored information that should have been preserved is lost because a party failed to take reasonable steps to protect it.3Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions The rule draws a sharp line based on intent.
If the loss was negligent or accidental, and the lost data cannot be restored through other discovery, and the opposing party is prejudiced, the court may order measures “no greater than necessary” to cure that prejudice: additional discovery, cost-shifting, or monetary sanctions. The harshest sanctions are different. An adverse inference instruction telling the jury to presume the lost information was unfavorable, dismissal, or default judgment are available only when the court finds that a party acted with the specific intent to deprive the other side of evidence.3Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions
That intent requirement matters. Sloppy processes still carry consequences, but the case-ending sanctions are reserved for deliberate destruction. A clean audit trail is the difference between a manageable sanction and one that ends the case.
Keeping Discovery Proportional
Ediscovery requests can spiral fast. A single custodian’s email account might hold hundreds of thousands of messages, and a broad keyword search across ten custodians can produce terabytes. Rule 26(b)(1) addresses this by requiring that all discovery be proportional to the needs of the case.2Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery
Courts weigh six factors when deciding whether a request crosses the line: the importance of the issues at stake, the amount in controversy, the parties’ relative access to the information, the parties’ resources, the importance of the discovery to the issues, and whether the burden outweighs the likely benefit. Spending $500,000 on ediscovery in a $200,000 dispute raises obvious red flags. A multinational and a small business are not held to the same standard. And if one party holds all the relevant data, courts are less sympathetic to its complaints about burden.
Raising proportionality early, at the Rule 26(f) conference, works better than fighting about it after collection has already begun.
Collection, Processing, and Chain of Custody
Once the scope is set, data has to be gathered using methods that hold up in court. Forensic collection creates exact bit-stream copies of hard drives or cloud environments without changing the underlying files. This preserves metadata like creation dates and modification timestamps, which can be as important as the content itself.
After collection, the raw data enters processing, where specialized software prepares it for review. De-duplication collapses identical copies of the same email across multiple custodians into a single instance, often cutting volume by 30% or more. Filters narrow the dataset by date range, file type, and sender or recipient domain. Text extraction pulls searchable content out of every file so the review team can run keyword searches across the full collection.
Processing also assigns a hash value to every file. A hash is a digital fingerprint generated by an algorithm; if even a single character in the file changes, the hash changes too. That lets both sides verify no data has been altered from collection through trial, and it anchors the chain of custody the evidence will need to be admissible.
Review, Privilege Logs, and TAR
Review is where the legal judgment happens and where most of the money goes. Industry estimates attribute over 80% of total litigation spend to document review. Attorneys evaluate each document for relevance to the claims and defenses and flag anything protected by attorney-client privilege or the work product doctrine.
Reviewers work on digital platforms, applying coding tags that categorize documents by issue, importance, or privilege status. When a document is withheld as privileged, Rule 26(b)(5)(A) requires the withholding party to describe the nature of the material in enough detail that the opposing side can assess and, if necessary, challenge the privilege claim.2Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery Those descriptions become the privilege log that accompanies the production.
When collections run into the hundreds of thousands or millions of documents, page-by-page human review stops being practical. Technology Assisted Review uses machine learning to learn from human decisions on a sample set and then applies those classifications across the full collection.4EDRM. Technology Assisted Review Predictive coding is the most widely discussed form of TAR, though the terms are not identical: TAR is the broader category, and predictive coding is one method within it.
Protecting Privilege With a 502(d) Order
In any large review, privileged documents occasionally slip through and get produced. The consequences depend on what protective measures were in place beforehand.
Federal Rule of Evidence 502(d) allows a court to enter an order declaring that producing privileged material during the litigation does not waive the privilege, in the current case or in any other federal or state proceeding.5Legal Information Institute. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product; Limitations on Waiver Under a 502(d) order, the only question is whether the document is in fact privileged. If it is, the producing party gets it back without having to defend the quality of its review.
Without that order, inadvertent production falls under the more demanding standard of Rule 502(b). The producing party must show the disclosure was truly inadvertent, that it took reasonable steps to prevent production, and that it acted promptly to fix the error once discovered.5Legal Information Institute. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product; Limitations on Waiver If the court finds those steps lacking, the privilege can be waived permanently. Experienced practitioners negotiate a 502(d) order at the Rule 26(f) conference for this reason.
Redacting Personal and Regulated Information
Productions often contain personal information that has nothing to do with the dispute but could cause real harm if exposed. Federal Rule of Civil Procedure 5.2 requires court filings to redact certain personal identifiers to limited formats:6Legal Information Institute. Federal Rules of Civil Procedure Rule 5.2 – Privacy Protection for Filings Made with the Court only the last four digits of Social Security and taxpayer ID numbers, only the year of a date of birth, only the initials of a minor’s name, and only the last four digits of a financial account number.
Productions between parties frequently involve additional categories of sensitive data governed by other federal or state laws. Medical records with diagnoses, treatment histories, or insurance details implicate HIPAA. Educational records fall under FERPA. Biometric data such as fingerprint scans or facial recognition templates carries its own state-law obligations. The producing party has to identify and redact this material before it goes out, because once sensitive data reaches the other side there is no practical way to undo the exposure.
Producing the Documents Under Rule 34
After review and redaction, the surviving documents are packaged and delivered. Rule 34 governs the mechanics, including the format.7Legal Information Institute. Federal Rules of Civil Procedure Rule 34 – Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes When the requesting party does not specify a format, the default rule requires production either in the form the data is ordinarily maintained or in a “reasonably usable” form.
In practice, parties negotiate one of three formats. Native files preserve full functionality and metadata but can be harder to redact. TIFF images are easy to label and redact but strip out interactive elements. PDFs sit between the two. Most productions use a combination, with certain file types produced natively and others as images. A party also cannot be compelled to produce the same electronically stored information in more than one format.7Legal Information Institute. Federal Rules of Civil Procedure Rule 34 – Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes
Every page gets a unique alphanumeric identifier, commonly called a Bates number, so everyone can reference the same document during depositions, motions, and trial. Load files accompany the images and link each document to its metadata, extracted text, and coding. Without proper load files, the receiving party’s review platform cannot index the production. The final package travels through secure file transfer protocols or encrypted physical drives.
Presenting the Evidence
The last stage is putting the evidence in front of a judge or jury. Legal teams convert production files into trial exhibits formatted for display, and presentation software lets attorneys highlight specific text, zoom into metadata fields, or overlay annotations during witness examination.
Before digital evidence is admitted, the court requires authentication, which typically means demonstrating a clean chain of custody from collection through production. The hash values assigned during processing do the work here: if the hash of a trial exhibit matches the hash recorded at collection, the file has not been altered. That matching value is what connects the courtroom exhibit back to the first bit-stream copy taken months or years earlier, and it is what makes the rest of the workflow worth doing.