01Scope
- Legal hold: notice, scope, custodians, acknowledgement and release
- Collection from mailboxes, file shares, cloud drives, chat platforms and devices with metadata preserved
- Processing: extraction, hashing, de-duplication, de-NISTing, text extraction, exceptions log
- Culling: date ranges, custodians, keyword and concept searches with hit reports
- Review workflows, privilege, redaction, and production formats with load files
02Questions it answers
- Which custodians and sources are in scope, and who decided?
- How many items were collected, how many removed by each step, and why?
- Can the keyword list and its hit counts be reproduced?
- Were metadata and family relationships (email and attachments) preserved?
- What was produced, in which format, and what was withheld on which basis?
03Evidence used
| Source | What it yields | Note |
|---|---|---|
| Collection exports with container hashes and collection logs | The original population with dates, authors, paths and family links | Forensic (metadata-preserving) collection; drag-and-drop copying changes dates and loses deleted items. |
| Processing reports | Counts per step, de-duplication keys, exception and error lists | Exceptions (encrypted, corrupt, unsupported) must be listed and decided, not silently dropped. |
| Search term reports and sampling results | Hits per term and per custodian; precision and recall estimates | Terms are negotiated and versioned; keep every version with its date. |
| Production sets and load files | Bates ranges, metadata fields produced, redaction logs, privilege logs | Hash the production volume; record what each party received and when. |
04How it is approached
Issue and track the hold
Written notice naming the matter, the scope, the sources and the obligation; acknowledgements recorded; automatic deletion suspended at the source systems.
Collect forensically, from the system of record
Mailbox and drive exports by an administrator or tool that keeps metadata, from the server rather than a user's local copy; hash the containers; log the query and date range.
Process with a count at every gate
Items in, duplicates removed, known system files removed, date filter applied, keyword hits: each step produces a number that reconciles with the previous one.
Validate the search
Sample the non-hits to estimate what the terms miss; refine and re-run; keep the term history.
Produce with a record
Agreed format and fields, redactions logged, privilege log maintained, production hashed and delivered with a transmittal record.
05Artifacts
The library records behind this area:
06Pitfalls
- Copying files with the operating system changes creation dates and drops alternate data streams.
- De-duplication across custodians hides who else held a document; keep the duplicate custodian list.
- Keyword hits are not relevance; a term that hits everything or nothing needs revision.
- Chat platforms export conversations in fragments; reconstruct threads before review.
- Date filters on 'last modified' miss documents created in range and edited later.
07What the report states
- Hold notice history: issued, acknowledged, modified, released, with dates.
- Sources and custodians collected, method, operator, date range, container hashes.
- A reconciliation table of item counts through every processing step.
- Search term versions with hit counts and sampling results.
- Production log with formats, ranges, redaction and privilege logs.
08Questions to ask a report
- Was the collection metadata-preserving and made from the system of record?
- Do the item counts reconcile from collection to production?
- What was excluded by processing exceptions, and who decided?
- Which search term version was used, and how was it validated?