Show me that email and make it fast – a quick guide to e-discovery

Danny Bradbury

Anyone who has watched legal drama on the TV knows that at some point, someone is going to ask for some corporate records. This is a process known as legal e-discovery. It is why IT departments archive emails: so that when the lawyers ask for the relevant information, it can be quickly, easily, and accurately provided. How does email e-discovery work under the covers, and what challenges does it present IT managers with?


There are several steps in the e-discovery process, and each one of them requires the IT team’s direct or indirect input:

  • Archiving. This is the first step, which involves retaining the email in the first place. This is where an appropriate archiving tool is installed and retention policy applied.
  • Discovery request. This is the first step in retrieving the information. At this point, the organization sees a legal need to recover emails and other documents. Businesspeople will identify what information is needed, where it is stored, and who controls it.
  • Preservation. The IT department must ‘freeze’ the information, ensuring that it has not been altered (in legal e-discovery parlance, this would be the subject of a legal hold).
  • Collation. The information is gathered into one place during this step in its native format, with all associated metadata intact, so that lawyers can look at it.
  • Analysis. This is where the lawyers get more heavily involved. They scour the information retrieved during email e-discovery, seeing what should be left out either for reasons of relevance, or because it contains privileged information.
  • Legal presentation. These final steps are handled by the lawyers, and involve sending the information that has been carefully retrieved by the IT department over to the opposing legal team.


Technical challenges

IT teams face several challenges during an email e-discovery process. Each of them must be met successfully, otherwise the business and legal stakeholders risk embarrassment, or worse.

Unpredictability is an issue. These requests can come at any time, and involve any information. This means two things for the IT department: They must have archived versions of employee emails that are both up to date, and fully comprehensive.

Lawyers and business stakeholders are constrained by their own deadlines for court filings and hearings. This places time pressure on them for email legal e-discovery, which in turn affects the IT department. If IT’s e-discovery service takes too long to retrieve the necessary information, it will cause problems for the legal department, and therefore for the business. Speed is essential.

Cost is another factor. Lawyers are expensive, especially if they’re part of an external team. The IT department will be under pressure to produce information that is as accurate as possible during the preservation and collation phases. Reducing the amount of sifting that lawyers must do during the analysis phase will help keep business costs down. This requires a great degree of accuracy.

The chain of custody

custodyPerhaps the biggest challenge for IT teams during the e-discovery process is the need for a chain of custody. IT departments must prove that emails have not been altered after their production. This proof includes preserving not only the content of the mail, but also other metadata such as the date that it was sent, and who the sender and receivers were. In some cases, IT managers may be required to testify in court, explaining how they can prove these things.

Archiving and e-discovery solutions are an important part of this process. IT departments should not rely on production inboxes alone, but should have both the policies and the supporting technology infrastructure in place to guarantee a responsive, accurate and reliable e-discovery process. When that email arrives from the legal department, you’ll be glad you did.