eDiscovery glossary
Plain definitions of the eDiscovery terms that appear in protocols, vendor quotes and court orders, written without the marketing gloss.
The working vocabulary of eDiscovery, defined plainly. These terms appear in production protocols, vendor statements of work and court orders, and several of them are used loosely enough by vendors to be worth pinning down.
The data#
ESI — electronically stored information. The category the Federal Rules use for discoverable electronic material: email, documents, chat, database records, and anything else that exists because a system wrote it down. Full guide →
Custodian — a person whose data is collected. Custodian lists are how most collections are scoped, which is also why non-custodial sources, such as shared drives and system logs, are the ones most often missed. Full guide →
Metadata — the data a system records about a file: dates, authors, paths, recipients, and so on. In discovery it matters because it is often the only evidence of when something happened and who saw it.
Family — a parent document and its attachments, treated as a unit. Whether a family is produced whole is one of the things a production protocol has to settle.
Reducing the volume#
De-duplication — removing identical copies of the same document so it is reviewed once. Whether this is done within a custodian or across all of them changes both the volume and what the production looks like. Full guide →
Email threading — grouping messages into conversations so that only the inclusive message, the one containing all prior text, needs review. One of the few genuinely large cost levers. Full guide →
Near-duplicate detection — grouping documents that are substantially but not exactly the same, such as successive drafts.
Culling — reducing the collection before review using date ranges, custodians, file types, domains and search terms. Review is the expensive stage, so culling is where cost is actually controlled. Full guide →
Finding the relevant material#
Boolean or keyword search — matching strings, with operators. It matches text, not meaning, so it both over-fires on ambiguous terms and misses conversations that never use the word. Full guide →
Concept search — retrieval based on statistical relationships between terms rather than exact matches. Reaches related language a term list misses; harder to explain to an opponent. Full guide →
TAR — technology-assisted review. A supervised classifier trained on reviewer decisions, used to rank or cut off review. Predictive coding is the older name, usually for train-once workflows. CAL, continuous active learning, keeps retraining as reviewers work and keeps surfacing the highest-ranked unreviewed documents. Full guide →
Null set — the documents a search or classifier excluded. Sampling it is how a party shows what its method missed, which is what makes the method defensible. Full guide →
Obligations and protections#
Legal hold — the instruction suspending normal deletion once litigation is reasonably anticipated. The duty attaches before a complaint is filed. Full guide →
Spoliation — loss or destruction of material that should have been preserved. Federal Rule of Civil Procedure 37(e) governs what a court may do about lost ESI, and distinguishes sharply between prejudice and an intent to deprive. Full guide →
Proportionality — the limit in Rule 26(b)(1) under which discovery must be proportional to the needs of the case. It constrains requests and responses alike. Full guide →
Privilege log — the schedule describing what has been withheld and why, in enough detail to let the claim be assessed without disclosing the content. Full guide →
Clawback — an agreement or order allowing privileged material disclosed by mistake to be recovered. An order under Federal Rule of Evidence 502(d) is the stronger form. Full guide →
Getting it out of the door#
Processing — converting collected data into a reviewable form: extracting text and metadata, expanding containers, handling encodings. Where volume expands and where formats break. Full guide →
Native production — producing the original file. Imaged production — producing TIFF or PDF renderings plus extracted text, which permits Bates numbering and redaction but loses functionality. Full guide →
Load file — the index telling the receiving system what the produced files are, how they relate as families, and what metadata travels with them. A mismatch between the load file and the delivered files is the most common production failure. Full guide →
Bates number — the unique sequential identifier stamped on produced pages so they can be cited unambiguously. Full guide →
EDRM — the Electronic Discovery Reference Model, a nine-stage map of the process from information governance through presentation. A reference model, not a mandatory sequence. Full guide →