eDiscovery: From Preservation to Verified Production

What eDiscovery Means and What It Produces

Electronic discovery turns potentially relevant electronic records into a controlled set of documents for legal review and exchange. Email, financial statements, spreadsheets, messages and recordings each carry information that can disappear when copied into a simpler format.

Keep the source data separate from the review copies and the production package. Source data is the material collected from its original system. Review copies support searching and coding. The production package contains the approved disclosure copies and their agreed index or supporting files.

The Electronic Discovery Reference Model gives these activities a common vocabulary. Its current model includes disposition after use and analysis throughout the lifecycle. Teams revisit earlier stages when review exposes missing sources.

Consider a fictional dispute about payments made by a company director. The supervising lawyer needs to connect bank transfers with payment approvals and conversations about the invoices.

Stage	Responsible person	Observable output in the fictional dispute
Identify and preserve	Lawyer and records administrator	Approved scope and preserved director records
Collect	Authorised administrator or collection specialist	Source exports, inventory and collection receipts
Process	Processing specialist	Searchable records, linked attachments and exception report
Review and analyse	Supervised reviewers and lawyer	Relevance decisions, privilege decisions and payment chronology
Produce	Production specialist and supervising lawyer	Approved documents, identifiers and reconciled delivery manifest
Retain or transfer	Records owner under legal direction	Accessible archive and documented continuing holds

Learn the skills needed for the stage you perform or supervise. Collection requires source mapping and integrity checks. Search requires query design and sampling. Privilege decisions require legal supervision. Production requires format mapping and receiver-side reconciliation.

Use the Federal Court’s practice materials for procedure and Microsoft Learn’s eDiscovery learning path for case, hold and search exercises. The self-paced learning material is a useful free training route. Practise with synthetic records before handling a matter’s evidence. Platform training does not establish competence to decide Australian privilege questions.

Set the Court Protocol, Scope and Preservation Duties

Start with the court, applicable rules and orders governing the matter. In the Federal Court, the electronic discovery checklist addresses scope, proportionality and exchange arrangements. The Court must approve the discovery plan and exchange protocol. Other Australian courts have their own requirements.

US federal discovery rules and competition-law “second request” procedures belong to different legal processes. A template using those terms does not establish an Australian party’s duties.

1. Record the pleaded issues or investigation questions. In the fictional dispute, distinguish authority to approve an invoice from whether the payment reached its stated recipient.
2. Identify custodians, meaning the people responsible for relevant records. List their accounts, devices, shared locations and source periods.
3. Establish authority to obtain each source. Record client instructions, ownership, consent or the relevant legal process before collection.
4. Issue preservation instructions through the responsible lawyer. Connect each instruction to the source inventory and confirm how routine deletion will be suspended.
5. Approve the initial scope and its cost assumptions. Record each later expansion, its reason and the lawyer authorising it.

Early case assessment tests which sources can answer the disputed questions. Bank statements establish recorded movements. Emails and approvals can help explain their purpose. A repeated payment pattern is a lead to examine alongside that evidence.

Instruct a collection specialist where deleted records, disputed authenticity or device acquisition makes source integrity uncertain. Keep detailed notice administration in the litigation hold process and targeted bank-record requests in financial discovery for civil litigation.

Collect Microsoft 365, Mobile, Social and Audio Records

Collect each authorised source with its context and a receipt record before processing it. Record the custodian, source system, collector, collection method, scope, timestamp and time zone. Preserve originals with restricted access and record available file hashes as integrity checks.

Access Microsoft Purview Through the Authorised Administrator

Microsoft Purview eDiscovery supports investigations involving Microsoft 365 and Office 365 content. Start through the organisation’s administrator, using Microsoft’s permissions guidance. The administrator assigns the required role and case access. Available functions depend on the tenant’s licences and configuration.

Follow Microsoft’s documented setup sequence within that authorised environment.

1. Confirm the administrator has enabled the required applications and assigned access for the intended tasks.
2. Create or open the authorised case and record its members.
3. Map custodians and content locations before configuring the search.
4. Save the query and location scope, then inspect statistics and sample results.
5. Refine the search and export the authorised results, retaining reports and export settings.

For Teams, messages and shared files can occupy different compliance locations. Microsoft’s Teams content map distinguishes mailbox records from SharePoint and OneDrive files. Identify channel type and linked-file locations so a message search does not omit its supporting documents.

A saved search does not itself preserve content. Apply the authorised hold to the relevant locations and inspect its status. Microsoft documents that holds can take up to 24 hours to take effect. Confirm preservation before permitting account or retention changes.

Preserve Mobile, Social and Audio Context

For mobile messages, retain participants, message order, timestamps and attachments through an authorised source-specific export or specialist acquisition. A screenshot can omit preceding messages, edits or the identity behind an account. Preserve the underlying conversation where available.

For social media, record the account, post identifier, URL and surrounding thread. Capture available media and replies within the authorised scope. Escalate disappearing content and disputed account ownership to the collection specialist.

Keep an audio recording in its collected format alongside any transcript. Link speaker labels and transcript passages to recording timestamps. Listen to disputed words in context, including pauses and overlapping speech, before relying on a transcript.

Restrict Sensitive Health Records

Establish the authority and permitted purpose before obtaining health records. The Office of the Australian Information Commissioner’s health guidance distinguishes consent and other lawful disclosure grounds. Additional state or territory requirements can apply.

Limit access to the authorised review group and use the agreed confidentiality or redaction safeguards. Where records or reviewers are overseas, coordinate Australian privacy obligations with the relevant foreign procedure before transfer. An overseas recipient’s access is part of that assessment.

Process Records Without Losing Context

Processing creates usable review records while retaining the connection to what was received. Extract searchable text, map source fields and record transformations such as optical character recognition (OCR) of scanned pages.

Give every record a stable source identifier. Preserve the parent-child relationship between an email and its attachments. Record deduplication rules and every custodian associated with a retained copy. Distinguish an exact duplicate from a revised spreadsheet or a similar email.

Before promoting the processed collection into review, reconcile the counts. In the fictional dispute, assume the receipt contains 1,000 files. Processing identifies 100 exact duplicates and 20 files requiring password assistance. The proposed review set has 880 files, with all 1,000 accounted for in the processing report.

Resolve the 20 exceptions or record their separate treatment before treating the collection as fully reviewed. Inspect blank extracted text, corrupt files, unsupported formats and OCR failures. Compare a sample against the received collection, including attachments and unusually large files.

Approve promotion only when counts reconcile, transformations are recorded and unresolved exceptions have an assigned owner. Keep document metadata attached to the record’s provenance without treating every metadata field as conclusive proof of authorship or timing.

Use Analytics and Validate Search Results

eDiscovery analytics prioritises material for review through techniques such as grouping related documents, email threading and concept analysis. Its usefulness depends on what was collected and processed. A search cannot find a missing attachment or text that extraction failed to capture.

Build a reproducible search around the dispute’s people, payment references and events. For the fictional company dispute, use this sequence.

1. Save a baseline search for the two relevant custodians and the approved source period.
2. Add the invoice number and recipient’s recorded names as separate searches. Include known abbreviations supported by the source records.
3. Compare each result set with known relevant examples, including an approval email already identified by the client.
4. Read samples of hits for false positives. Sample excluded material for missed relevant records, or false negatives.
5. Adjust one query element at a time and save the version, filters, hit count and reason for the change.

If the known approval email is missing, check its source location and extracted text before adding more keywords. If a common surname produces mostly unrelated hits, test a recipient address or invoice reference instead.

Lucene and dtSearch are different search technologies with their own syntax. Boolean operators, proximity expressions and searchable fields require the platform’s documented grammar. Record the exact query the platform accepts so another reviewer can reproduce it.

Advanced or AI-assisted review can group documents, suggest tags or summarise passages. Validate those functions against the source and the review protocol. Keep a suggested relevance tag separate from the lawyer’s decision. A cluster of transfers supports a data observation. Their legal meaning depends on the surrounding evidence.

For Federal Court work, apply the Generative AI practice note. It addresses responsible use and verification of material supplied to the Court. Record what AI performed and preserve the source references behind any resulting chronology or document list.

Review Relevance, Privilege and Redactions

Review applies the agreed relevance criteria and separates material requiring a privilege or confidentiality decision. The supervising lawyer decides legal questions and approves the production set.

Give reviewers a shared coding guide with examples and escalation rules. Assign first review, quality checks and disputed decisions to named people. Keep annotations and markups in the controlled review environment, with access separated from the material approved for exchange.

A privilege log, where required by the governing procedure, identifies withheld records without revealing the protected advice. Record the document identifier, relevant participants, general description and claimed basis at the permitted level of detail. Reconcile every withheld item to its decision, including attachments considered separately.

The High Court’s Expense Reduction Analysts decision concerns privileged documents inadvertently disclosed during discovery. Include a prompt escalation and correction process in the exchange arrangements. If suspected privileged material is released, refer it immediately to the supervising lawyer for action under the applicable rules and orders.

Apply redactions to disclosure copies while retaining the original and the recorded reason. Test the exported file by searching and copying text from the redacted area. Inspect hidden text, comments, attachments and other recoverable content. A black rectangle drawn over live text leaves that text exposed if it can still be copied.

Coordinate the Evidence Handover

Assign an owner to each handover so the receiving team can account for the evidence before review. The collection specialist owns source-integrity questions. The processing lead resolves transformation failures. The lawyer owns review decisions, while the production lead reconciles exports.

The handover manifest records custody transfers, source and output formats, identifiers, access permissions and unresolved exceptions. The receiver confirms counts and opens sample files before acknowledging receipt. Record any changed filenames or identifiers in a mapping that survives the transfer.

For a financial-record workstream, FinTrace saves lawyers and forensic accountants hours of statement conversion and analysis. It processes large PDF collections into a searchable Excel ledger and a clear findings report. Every finding includes its source PDF filename and page, keeping the supporting evidence at hand.

In a fictional handover, a lawyer supplies preserved statement copies with their source inventory. The resulting ledger’s file references connect the financial analysis to that collection. Suspicious transfers flagged in the report help the lawyer or accountant focus their investigation, while the eDiscovery team retains the source records and production decisions.

Keep provider procurement and managed-service scope in the legal process outsourcing guide. Use the litigation support software comparison when choosing the systems supporting collection, review or production.

Estimate Costs and Control Scope Changes

Estimate eDiscovery costs from the work and storage required at each stage. Separate collection, processing, hosting, reviewer effort, specialist exceptions and production. Ask each provider to identify its billing unit and what counts towards it.

Use a hypothetical estimate to expose the assumptions before requesting rates. Suppose a matter has 20 GB to process, a 10 GB hosted review set and 1,200 documents requiring review. Assume three months of hosting, 30 documents reviewed per hour and eight hours of supervisory checking.

The initial review allowance is 40 hours: 1,200 divided by 30. Adding eight supervisory hours gives 48 hours. If the representative review sample takes twice as long, revise the allowance before approving the full review.

Estimate component	Hypothetical quantity	Rate or quote input
Collection	Two custodians	Authorised source-specific quote
Processing	20 GB	Provider’s processing rate and minimum charge
Hosting	30 GB-months	10 GB multiplied by three months at the hosting rate
Review	40 hours	Agreed reviewer rate
Supervision	Eight hours	Agreed supervisory rate
Exceptions and production	Separately scoped	Specialist work, export format and delivery quote

Add the quoted components using the same tax basis and record any excluded charges. Reconcile duplicates before estimating review volume. State whether hosting is charged on ingested, expanded or retained data so the estimate uses the correct quantity.

The responsible lawyer approves the budget and any material change. A new custodian or longer source period triggers a revised volume estimate, timetable and written scope decision. Track actual usage against those assumptions instead of treating the first estimate as a universal discovery rate.

Prepare and Validate the Production Package

Build the production package to the court-approved exchange protocol and verify it from the receiving side. Stable document identifiers connect the disclosed records with the index and their source references. Bates numbering is one identification method. Use the identifier convention required for the matter.

An agreed image production can contain TIFF page images, searchable text and metadata. Native files retain the original application format where the protocol requires them. A load file tells the receiving system how to associate identifiers, text, images and document relationships. Its paths must match the delivered folders.

Run a small test tranche before the main exchange. Import it into a clean receiving workspace or validate it using the recipient’s agreed process.

1. Match the manifest’s document and page counts to the received files. Confirm how attachments and native records are counted.
2. Check identifier uniqueness and continuity, documenting intentional gaps for withheld material.
3. Reconcile index entries, metadata and every referenced image, text or native-file path.
4. Check parent-child relationships and sample source links across each tranche.
5. Inspect the final redactions and confirm privileged material is excluded from all delivered components.

In the fictional dispute, an email’s load-file record names an attachment that fails to open. Trace the child identifier to the export manifest. If the file is absent, correct the export. If it exists under another path, repair the reference and repeat the receiving-side check.

A mismatched export count requires the same reconciliation against approved review decisions. Record the corrected package version and replacement instructions. Delivery is complete when the receiver can open the approved records and every difference from the manifest is explained.

Preserve Hosted Evidence and Close the Handover

Retain hosted evidence under a documented access and continuity arrangement after production. Record hosting location, authorised roles, backup responsibilities and how the collection can be exported if the provider changes or closes the workspace.

Preserve the source records alongside identifiers, retained metadata, search versions and review decisions. Export the manifest and privilege records through a supervised process. Test that an authorised recipient can open sample records and follow their source relationships outside the current workspace.

Before closing access, the supervising lawyer confirms continuing holds, retention requirements and any required transfer or return. Assign responsibility for later review of those instructions. Completion of a production does not authorise source deletion.

Close the handover when the archive opens, counts reconcile and the responsible person has accepted custody under the continuing preservation instructions. Keep access available until that acceptance and the lawyer’s documented closure direction are in place.