Process is the key to effective e-discovery

Issue October 2003 By Toby Brown

The discovery of electronic information is likely the hottest topic in legal technology. Given that a significant share of personal and business information exists originally or exclusively in electronic form, litigators are faced with e-discovery on an expanding scale. This article will help you understand the basics of e-discovery and help prepare you for the inevitable.

Electronic discovery, or e-discovery, is the process of acquiring and presenting electronic information in the discovery phase of litigation. The emphasis here is on process. Effective e-discovery utilizes a process that ensures the integrity of the information and enables presentation of the same for depositions and court appearances. The process generally consists of retrieving electronic information, organizing and indexing it, presenting it in a searchable format, enabling "document" production with the information and finally packaging it for presentations.

Initially, e-discovery has focused mainly on discovering e-mail files. The pervasive use of e-mail in communications has made this a likely target for requests. But as lawyers have found valuable discovery information within the e-mail files, they have ventured further out into other file types and even into computer forensics.


Discovery requests for electronic information are much the same as regular discovery requests, except for spoliation issues. When you make a discovery request you should include a "preservation of evidence" statement within the request. This basically says the responding party needs to take steps to insure the integrity and availability of electronic information. Since information on hard drives can be more easily "damaged," this is a good idea.

E-mail files are the likeliest targets of e-discovery requests. These files usually come in the form of .pst files. This file format is the one produced by MS Outlook and includes all of the information from this program, including calendar items, journal entries and tasks. Acquiring and processing these file types is a job best left to experts. The average size of one of these files is typically 250 megabytes. Therefore you need the ability to handle files of this size and be able to dissect them into reviewable components.

The next likely targets are word-processing files. These are relatively easy to capture, transmit and review. Perhaps the most complex types of files to produce and review are databases. These don't print very well and you need expensive software just to access the information.

Beyond getting specific file types, requests now are being made for deleted information. These requests are where e-discovery takes a decided break from traditional requests. Discarded paper-based information is not really accessible. Accessing deleted electronic information is known as computer forensics. Again, there are experts in this field you will want to utilize if faced with any forensics issues. If deleted information is not properly acquired and reassembled, there are a host of evidence spoliation possibilities.

Organizing the results

Once electronic data is acquired, it needs to be put into a format and/or tool to allow review. Some electronic data, such as e-mail, already includes metadata such as addressees, cc'd recipients, dates, subject lines, etc. This information can be extracted separately from the full e-mail file and used to populate searchable databases. Commonly used database software for this purpose is Concordance and Summation.

Before we leave the world of acquiring electronic data, you should be aware of some issues that arise due to the nature of electronic information. If you are responding to a discovery request, you will want to be cautious about producing files in their native formats. Native file formats for Word, Excel and other programs usually include extra information buried within the files.

Ethics warning

This brings us to an ethics issue for lawyers. Word, Excel and other file formats include metadata hidden within each file. In Word, go to the "File" pull-down menu and select "Properties." This will show some of the metadata for a given file. The amount of data included can be more or less depending on the settings for a specific computer. As well, features such as Reviewing, Versioning and Fast Saves allow Word to retain deleted information within the file. So if you have pulled up a Word file from a previous deal or matter, made changes then saved it as a new file, it may well have information from the prior instance hidden within the new file.

This situation, which occurs often, could lead to exposure of confidential client information. If this electronic file were produced in a discovery request, a confidence may be breached.

Just as likely, and separate from e-discovery, is that lawyers e-mail these files as attachments to opposing and third parties. If these files are opened using a program such as NotePad, the hidden data will be viewable. This would be a bad thing.

The ethics debate on this issue continues to evolve. Exposing client data is obviously an ethical breach. However, what is or should be the ethical duties of the receiving lawyer? Should they even be required to check for metadata? There are arguments for and against such approaches. The point being that the ethical landscape is evolving and you really don't want to be the test case that finally defines this issue.

This means you should be very careful about allowing Word (and other) files to leave your office in their original electronic or native file format. There are tools available to cleanse the files before they go out, such as Metadata Assistant from Payne Consulting ( Or in the alternative you can save Word files into other formats, such as .pdf or .rtf to remove the metadata. Either way, a solid policy on sending out electronic files is a good idea.

Back to organizing

Once you have the data and files in a searchable tool, you will want to review them prior to producing them. This review will be for responsiveness and privilege. Much of this review can be done with the existing indexed information. However, deeper levels of review will require access to the full document.

One popular approach for formatting e-discovered information for full review is creating image-based file formats of the documents. The two most common image formats for this are .tiff and .pdf. Both of these file formats are the intellectual property of Adobe. For whatever reason, the .tiff format is widely used. However, the .pdf format is more flexible and may become the long-term standard.

Image-based formats are used for two primary reasons. First, the ability to view them is ubiquitous (for the most part). There is free software available for viewing these formats (vs. proprietary software for Word, WordPerfect, etc.). Second, image-based file formats greatly reduce the risk of file alteration. It is much harder to purposely or accidentally change the text within a .tiff file than for a Word file. So this gives some level of comfort that documents have information integrity. (It should be noted that courts are beginning to address the issue of electronic evidence integrity and will likely develop rules for maintaining integrity throughout the litigation process.)

For some file types, such as word-processing, creating image-based files is relatively easy. For e-mail and database files, this is a bit more challenging. The data files that comprise an e-mail need to be recombined in a fashion that best approximates the original view of the e-mail. This enables witnesses to more easily identify messages they may have sent or received. Producing databases is a newer phenomenon and no easy way to present them has yet emerged.

Again, when reviewing e-discovery results, make sure you are seeing all of the data, hidden or not, so that production results do not waive privilege or create ethics issues.


Once we have all of the electronic data collected, organized and reviewed, it's time to produce it. There are three general methods for accomplishing production. The first method - printing out the images - seems a bit odd when you think about it. For the producer, this approach minimizes the chance that unintended data passes to the opposing party. And it is possible that the recipient of the information is not prepared to receive the information in electronic formats.

The second approach is to burn CDs of the images. Even with this approach, most metadata is not transmitted with the image-based files. As a requestor, you may want to ask for both the images and the native file formats. I have not yet seen a consensus on how courts are handling request for native files formats. In certain cases, it may be critical to make such a request since valuable evidence may be acquired with this approach.

The third approach is to pass an importable file, sometimes via CD, sometimes via the Internet. This file is a set of data that can be imported into case-management software programs. This type of approach makes sense if both parties are utilizing litigation support technology and have agreed to share e-discovery information electronically. This approach can save both sides money. In fact some litigants agree to have one provider prepare e-discovery information then they split the costs.

Presenting the 'documents'

For the most sophisticated, the images and products of discovery are imported into presentation programs. This allows information to be presented to deponents and the court. You may not utilize this ability on your first e-discovery, but be aware that the process can extend to this level. (Sanction is likely the top-selling software for in court presentations. See


As noted in the beginning of this article, process is the key to effective e-discovery. There are many pitfalls you might face when requesting or producing electronic information in a case. By utilizing a sound process consistently, you will reduce the possibility of problems and increase the effectiveness of your own efforts.

Understanding the differences between paper-based and electronic-based information is another key. Electronic based information is harder to discard and replicates itself quite easily. As well, this information contains hidden secrets that can compromise your case and your clients' best interest.

Armed with a better understanding of electronic information and the process for e-discovery, you can more effectively face the challenges that lie ahead.