Scope of This Guide
This guide explains how to reduce eDiscovery collection volumes using context-aware identification, scoped preservation, and AI-assisted early case assessment while maintaining legal defensibility. It's designed for legal operations teams, eDiscovery specialists, and information governance professionals managing preservation obligations across enterprise systems.
You'll find detailed requirements for each phase of collection, steps for implementing behavioral custodian analysis, and a reference table mapping decisions to documentation needs. This isn't about cutting corners at review; it's about precision at identification.
Key Concepts and Definitions
Context-aware collection: A preservation method that maintains relationships between items, such as hyperlinked files and embedded attachments, and captures metadata showing custodian identity over time. It scopes based on demonstrated relevance rather than theoretical possibility.
Behavioral evidence: Audit logs and access records showing who interacted with systems, documents, or communications during the relevant period. This contrasts with potential access or assumed involvement.
Early case assessment (ECA): Content analysis performed during identification and preservation, before data moves to processing or review platforms. It enables scope decisions based on actual data content rather than potential custodian holdings.
Observed access: Documented evidence that a person accessed specific systems or files during the relevant timeframe. This produces more accurate custodian lists than interviews or role assumptions.
Reconstruction-grade preservation: A collection standard ensuring evidence can be authenticated and understood during review because context, such as relationships and metadata, was preserved at collection.
Requirements Breakdown
Phase 1: Custodian Identification
Consolidate Custodian Profiles
Integrate HR data, business application access, and IT infrastructure logs into unified profiles showing organizational roles, reporting relationships, system permissions, and communication patterns. This separates observed behavior from assumed involvement.
Apply Behavioral Filters
Use audit logs to identify custodians who accessed relevant systems, documents, or communications during the matter timeframe. Behavioral evidence produces more accurate lists than interviews or permissions alone.
Build Interactive Event Timelines
Map when each custodian was active and what systems they used. Timelines reveal gaps in activity and unexpected involvement.
Phase 2: Collection Scoping
Define Scope Parameters
Set date ranges, source types, and content filters for each custodian based on demonstrated relevance. Avoid broad exports when a narrower scope is supportable.
Preserve Relationships
Maintain hyperlinked files, embedded attachments, and version histories with their metadata. Treat interconnected items as units.
Capture Identity-Over-Time Metadata
Preserve audit trails showing how and when custodians interacted with information. This metadata supports authentication and reconstructability during review.
Phase 3: Early Case Assessment
Run Preliminary Content Analysis
Classify document types, communication patterns, and content characteristics before full collection. Identify high-value sources and deprioritize those unlikely to hold responsive material.
Apply Machine Learning to Source Prioritization
Use classification models to evaluate relevance at the source level. Pair content analysis with custodian and behavioral intelligence for a scope that reflects actual evidence.
Embed Workflow Controls
Automate evaluation criteria, sampling protocols, and approval steps within the platform. Standardize practices across matters and create auditable records of scoping decisions.
Phase 4: Defensibility Documentation
Centralize Hold Management
Execute all custodian notifications, preservation tracking, and collection coordination through a single legal hold platform. Fragmented processes create audit-trail gaps that undermine defensibility.
Document Reasoning at Every Decision Point
Record why each custodian was included or excluded, why each scope parameter was set, and what content analysis supported the collection plan.
Maintain Chain of Custody
Track preservation activity from identification through collection and production. Demonstrate an uninterrupted record of who handled data, when, and under what authority.
Implementation Guidance
Step 1: Audit Your Current Custodian Identification Process
Map how you currently build custodian lists. If you're relying on interviews and org charts without access logs, you're likely over-collecting or missing key players. Identify which systems generate behavioral evidence and confirm you can extract it during identification.
Step 2: Pilot Behavioral Analysis on a Single Matter
Choose a matter with known custodians and run behavioral filters to see who actually accessed relevant systems during the timeframe. Compare the behavioral list to your interview-based list to identify gaps.
Step 3: Define Collection Scope Standards
Establish criteria for when mailbox-wide collection is justified versus scoped collection by date, sender, or keyword. Document these standards in your legal hold procedures for consistency and defensibility.
Step 4: Integrate ECA into Your Workflow
Run content classification during preservation, not after export. If your current platform can't assess relevance before collection, you're incurring unnecessary processing costs. Evaluate whether your legal hold platform supports in-place analysis or if you need to add ECA capability.
Step 5: Build Documentation Templates
Create templates that capture custodian analysis, scope rationale, and content evaluation for each hold. Your documentation should answer: Why was this custodian included? Why this date range? What content analysis supported this scope?
Common Pitfalls
Confusing Potential Access with Observed Access
A custodian's permissions don't prove they accessed the data. Build lists from audit logs showing actual interaction, not from access control lists.
Treating AI as a Black Box
If you can't explain how your ECA model classified sources or why it deprioritized certain custodians, you can't defend the scope. Require transparency in classification models.
Fragmenting Hold Management Across Tools
Running notifications in one system, tracking preservation in another, and coordinating collection through email creates gaps in your audit trail. Centralize all hold activity in a single platform.
Scoping for Cost Alone
Reducing volume to save money is rational, but it's not defensible unless you can show the scope was reasonable and proportional based on relevance. Document the legal reasoning.
Collecting Items Without Their Context
Hyperlinked attachments, embedded files, and version histories lose evidentiary value when separated from their relationships. Preserve the web of connections.
Quick Reference Table
| Decision Point | Documentation Required | Defensibility Standard |
|---|---|---|
| Custodian inclusion | Behavioral evidence showing observed access during relevant period | Can demonstrate why custodian was likely to hold responsive ESI |
| Custodian exclusion | Analysis showing no system access or activity outside timeframe | Can demonstrate why custodian was unlikely to hold responsive ESI |
| Date range scope | Event timeline or communication pattern analysis | Can show range captures relevant activity without over-preserving |
| Source-type filter | Content classification or document-type analysis | Can explain why certain sources were prioritized or excluded |
| Collection method | Relationship preservation requirements (hyperlinks, versions, metadata) | Maintains reconstructability and authentication capability |
| ECA model application | Classification criteria, sampling protocol, approval record | Can explain how model evaluated relevance and what thresholds applied |
| Scope modification | Legal reasoning for change, approval authority, impact assessment | Can show modification was proportional response to new information |
| Chain of custody | Preservation activity log from identification through production | Demonstrates uninterrupted tracking of who handled data and when |
Volume reduction comes from precision at identification, not from cutting corners at review. When you build custodian lists from observed behavior, scope collections by demonstrated relevance, and document every decision inside a unified platform, you earn the right to collect less because you're collecting smarter.
