What eDiscovery actually is, stage by stage

Electronic discovery—commonly called eDiscovery—is the process of identifying, preserving, collecting, processing, reviewing, and producing electronically stored information, or ESI, in litigation or an investigation. It combines legal judgment about relevance, privilege, and proportionality with technical work involving data sources, metadata, search methods, and production formats.

The Electronic Discovery Reference Model, or EDRM, organizes that work into nine stages: information governance, identification, preservation, collection, processing, review, analysis, production, and presentation. EDRM is a reference model, not a mandatory sequence. Matters routinely loop between stages, especially when a processing decision changes what reviewers see or when analysis reveals another source that must be collected.

The EDRM stages in practice#

Each stage has a different operational purpose and a different primary owner. The descriptions below identify a typical allocation of responsibility; jurisdiction, case posture, and the parties’ agreements can change it.

1. Information governance. This stage establishes how ESI is managed across systems, applications, email accounts, collaboration platforms, and other repositories. Legal, records management, and IT personnel ordinarily work together to define ownership, retention practices, and defensible handling procedures before a matter begins.

   The characteristic failure is treating governance as a litigation-only project plan. Without durable source ownership and consistent handling rules, the project inherits unexplained gaps in collection and inconsistent responses to preservation requests.

2. Identification. Identification determines what ESI potentially bears on the claims and defenses, which custodians may possess it, and which systems and communication channels contain it. Attorneys and litigation-support personnel use pleadings, interviews, and source analysis to define the information universe; IT or records personnel confirm how the relevant data is organized.

   The characteristic failure is assuming that a chronology of relevant events maps neatly onto a set of custodians or applications. A source can contain responsive material without being central to the event being investigated, particularly when work occurs across personal devices, shared workspaces, and messaging platforms.

3. Preservation. At this stage, the duty to preserve identified ESI becomes an operational process. Legal personnel issue and document preservation instructions, while IT personnel suspend deletion mechanisms, protect relevant data, and address changes to retention settings or account access.

   The characteristic failure is treating notice delivery as the end of preservation. Instructions that do not translate into technical controls can leave data exposed to routine deletion, system changes, or loss before collection begins. For electronically stored information that should have been preserved and was lost, rewritten Rule 37(e) provides two tiers: a court may order measures no greater than necessary to cure prejudice, while the stronger remedies of an adverse inference, instruction to the jury, dismissal, or default require a finding that the party acted with intent to deprive another party of the information.

4. Collection. Collection acquires ESI from identified sources while maintaining the information needed to establish what was collected, when it was collected, and how it was handled. The work may include direct exports, imaging, or another defensible acquisition method, with IT personnel providing access and litigation support or a service provider performing the technical steps.

   The characteristic failure is an incomplete custodian or source list. The omission may appear harmless at the outset, but a later dispute can expose a repository that was never collected, processed, or searched. Collection records and manifests are therefore as important as the data transfer itself.

5. Processing. Processing makes collected information usable for review and analysis. Depending on the source, this can involve file conversion, text extraction, de-duplication, email threading, near-duplicate detection, metadata normalization, and the creation of load files that connect documents to their system-level information.

   The characteristic failure is a broken representation of the source data. File formats, encodings, attachments, threaded conversations, or metadata relationships may not survive conversion, leaving reviewers with a set that does not accurately reflect what was collected. Processing defects can also cause later production files to differ materially from the reviewed set.

6. Review. Review determines which documents are responsive, which contain privileged information, and which relate to particular issues. Attorneys and trained review personnel examine the population using defined criteria, supported by Boolean or keyword search, technology-assisted review, predictive coding, or continuous active learning as appropriate to the matter. A privilege log may document claims asserted over withheld material.

   The characteristic failure is treating classification as a mechanical output rather than a documented decision process. If the relevance standard, issue coding, treatment of families, privilege decisions, and quality-control samples are not defined, inconsistency becomes difficult to identify and explain. Review is also where cost commonly concentrates because it combines human judgment with the expense of searching, classifying, and checking a large document population.

7. Analysis. Analysis turns the reviewed record into a working understanding of the facts. Litigation support may organize material into issue matrices, chronologies, entity or custodian indexes, and communication maps; attorneys test those structures against the legal theory and identify gaps requiring another collection or review pass.

   The characteristic failure is confusing volume for insight. Document counts, custodian activity totals, and search-term results can look persuasive while failing to answer the legal question. Analysis is only useful when each point remains traceable to the underlying record and the known limits of the dataset.

8. Production. Production delivers the selected ESI in an agreed format with appropriate redactions and privilege treatment. The options include native production, TIFF, or PDF, with or without load files. Counsel ordinarily determines what will be produced and how claims of privilege or confidentiality will be handled, while litigation support performs the technical production and records the resulting set.

   The characteristic failure is a break in the chain from review to production. A document may be responsive in the review system but absent from the production, or a redaction may change the context in which the information appears. Production logs, file inventories, hash records, and linkage back to the reviewed population help expose those discrepancies.

9. Presentation. Presentation prepares the produced record for use in a hearing, trial, or proceeding. Attorneys select and explain evidence, while litigation support may prepare demonstratives, excerpts, chronologies, and searchable sets that preserve the structure and context of the original records.

   The characteristic failure is losing evidentiary context during extraction from the production set. A screenshot may omit surrounding text, a converted file may obscure a redaction or metadata relationship, and a witness may be shown a version that differs from the document produced. Presentation should draw from the controlled production rather than an unreconciled working copy.

Why matters loop back#

The largest operational loop commonly runs between processing and review. Reviewers may find that a processing defect suppresses relevant text, that threading has combined records in a misleading way, or that a search requires a document family or attachment set that was not organized as expected. Processing is revisited, and the revised set returns to review.

Collection can also loop back into preservation or identification. Analysis may reveal an additional custodian, a transferred file, or a message platform that was absent from the initial source map. A new collection then creates a new processing population, potentially requiring targeted supplemental review. EDRM is useful precisely because it distinguishes these functions without insisting that one pass through them will suffice.

Where the obligation comes from#

The Federal Rules of Civil Procedure establish both the scope of discovery and the mechanics for raising and resolving disputes about it. The e-discovery amendments took effect on 1 December 2015 and govern cases pending on, and commenced after, that date.

Rule 26(b)(1) places proportionality within the definition of discovery scope. The factors include the importance of the information, the amount in dispute, the burden of discovery relative to the likely benefit, the parties’ relative access to relevant information, and the likely value of the information in resolving the dispute. Proportionality does not operate as a one-way shield for the party resisting discovery. A requester cannot demand material that is disproportionate to the need, while technical burden does not automatically excuse a responsive and proportionate production.

Rule 26(f) requires the parties to confer before the scheduling conference, and Rule 16(b) governs the scheduling order. That conference is where the parties can address source scope, preservation, search methodology, processing, review, production formats, privilege handling, and anticipated burden. The objective is not procedural ritual; it is to identify disputes while they can still be resolved through focused technical and legal decisions.

Rule 34 governs what a response to a request must contain. Under Rule 34(b)(2)(B), a responding party must state the grounds for an objection with specificity. Under Rule 34(b)(2)(C), an objection must state whether responsive materials are being withheld on the basis of that objection. A generic reference to burden, privilege, or proportionality gives the requesting party little basis for narrowing the request or proposing a workable alternative.

Privilege and work-product disputes also require careful handling across production and presentation. Federal Rule of Evidence 502(d) provides that a federal court may order that privilege or work-product protection is not waived by disclosure in the proceeding before it. Whether a non-waiver order is available or appropriate is matter-specific, but the rule underscores the importance of resolving waiver risk rather than assuming that every production or use in a proceeding is inconsequential.

TAR, keyword search, and the court’s role#

Technology-assisted review, or TAR, uses computational assistance to help identify relevant ESI. Predictive coding applies machine-learning models to document content and feedback, while continuous active learning, or CAL, incorporates review judgments iteratively. Boolean or keyword search identifies documents through terms and combinations of terms. Each method can produce different candidate sets, so the selected method should be connected to the document population, the review objective, and the quality controls used to evaluate results.

Southern District of New York decisions show a generally receptive judicial attitude toward TAR when its use is appropriate. In Da Silva Moore v. Publicis Groupe, decided in 2012, Magistrate Judge Andrew Peck held that computer-assisted review is an acceptable way to search for relevant ESI in appropriate cases; the parties’ agreement to use it mattered, and District Judge Andrew Carter affirmed in April 2012. The opinion is widely described as the first judicial opinion approving predictive coding.

In Rio Tinto PLC v. Vale S.A., decided in 2015, Judge Peck described permission for technology-assisted review as black-letter law and later appointed Maura Grossman as special master to resolve TAR disputes. In Hyles v. City of New York, decided on 1 August 2016, Judge Peck held that a court will not force a producing party to use TAR when it prefers keyword searching, consistent with Sedona Principle 6, under which the responding party is best situated to decide how to search for and produce its own ESI.

Some language in Rio Tinto and Hyles is dicta rather than holding, so those decisions signal judicial attitude rather than create a binding rule. The practical lesson is narrower: when a producing party proposes a search method, the dispute should focus on the method’s suitability, transparency, validation, and consistency with the governing proportionality analysis.

Who does what in a typical matter#

Outside counsel ordinarily defines the claims, defenses, factual theories, and discovery objectives. Counsel evaluates relevance and privilege, negotiates the scope of preservation and production, frames objections, and determines how the record will support the legal case.

In-house legal connects the matter to organizational knowledge, internal policies, and preservation obligations. This role is especially important when data ownership, retention, investigations, and litigation obligations intersect, and when technical decisions carry business consequences beyond the dispute.

Litigation support manages the discovery workflow: source inventories, collection records, processing, load files, review configuration, production control, and quality checks. It also reconciles the working set with the production and supplies defensible records of what happened at each step.

IT controls access to systems and custodians, assists with preservation and collection, and explains how data is created, stored, transferred, and deleted. IT’s practical knowledge determines whether a source list is complete and whether a collection method preserves the information needed for review.

A service provider performs assigned collection, processing, hosting, analytics, or production functions under the matter team’s direction. The service provider may supply technical capability, but legal judgments about scope, responsiveness, privilege, and production remain distinct from the mechanical handling of data.

Handoffs fail most often when context travels separately from the data. A custodian list reaches collection without source details; processing changes reach only one side of the review team; review criteria change without reaching the party producing the results; or a production set cannot be reconciled to the population that was reviewed. Reliable eDiscovery depends on shared definitions, documented transfers, version control, and clear ownership at each boundary.