Email Discovery - How To Preserve, Collect, & Review

Posted by Jeremy Greer | Mon, Jun 08, 2020

Email is one of the most commonly collected forms of electronically stored information in legal matters. When a person or company is subpoenaed, the requesting party will most likely ask for all or a subset of the email box of each potentially relevant custodian. The search, interview, and legal hold process may be time-consuming, but just know that a good amount of the relevant data you are looking for more often than not is in email format. Both the producing party and the custodians themselves can use export functionality within their email application of choice to collect and deliver the email files in question. This pre-existing functionality should make it easier for lawyers to instruct custodians on proper preservation and collection practices.

To prepare email data to be ingested into an e-discovery tool, custodians or other 3rd parties will need to export to a file type called a PST. This is a container file that can easily be dropped onto an eDiscovery tool to process, review and produce documents. A tool like Digital WarRoom can use processing functionality to expand the container, index all keywords, and capture all metadata. This is extremely important and lends itself to a process that we call "forensically sound acquisition" of data. If you are a document reviewer, do not review documents in your native outlook. You will mix client data and evidence with your own personal emails. This could be extremely problematic in the case that you "step on" or overwrite important metadata such as "last opened date" etc. This data is the currency of litigation - not only can it help build your case, but the producing party is also required to abide by the agreed-upon production protocol in order to follow compliance and meet obligations as outlined in the Federal Rules of Civil Procedure.


Export to PST From Outlook

How To Export Data From Outlook - For Custodians and Legal Teams Advising Custodians on Document Collection

Outlook is among the most common email applications used in businesses. Outlook capabilities include an export wizard that you can use to export all email and attachments to PST. You will also have the option of selecting a subset of your email box - whether that be one or many relevant folders.

In Outlook, custodians can create their own organizational structure using folders. As a reviewer, pay attention to this as it may assist your e-discovery needs by helping you find the relevant information sooner.


Microsoft 365 For Enterprise - Now Includes Preservation and ECA Options

Microsoft now offers an enterprise version of Mircosoft 365 which can be used for portions of e-Discovery. For custodians which are members of large companies, if your firm is using the enterprise version of Microsoft 365 (often for network security reasons), administrators will have the added capability of accessing data across the entire company such as email, sharepoint files, and onedrive docs. This can make it much easier for the attorney or even a custodian to validate a legal hold and perform preliminary early case assessment. However, keep in mind that the deeper features such as data visualization, guard rails and productions need to be left to a full eDiscovery tool. We would not advise uploading client data to Microsoft 365 environments.


Export Gmail Inbox To Mbox Format

How To Export Gmail Data

There are many apps out there that store your personally identifiable information. Google is one of few that allows you to export data across all apps in their system. Google takeout stores information like content in your Gmail account(s), documents on your google drive or even viewing data in Youtube. See also: What is Google Takeout?

All of this data included in the Google archive constitutes esi and is reasonably discoverable. The attorney will need to make a judgement call on what to collect. In many cases email will be all that is required from the google suite. Google will allow you to export to mbox format which is a text file that will allow you to organize and store email messages. Ask the custodians to help you identify all these accounts and determine the extent of available information and what could be considered relevant. As a best practice for electronic discovery, over-preserve to prevent spoliation, and create a strategy for collection that is proportional to the needs of the case. Then use an e-discovery tool like Digital WarRoom to cull down the data later on.


Use An eDiscovery Tool For Email Discovery - Consider These Important Features

1) Preservation – Ensure that all files are given a unique MD5 fingerprint ensuring that they are preserved within your ediscovery tool. This means that all content and metadata is maintained.

2) Culling - eDiscovery tools are designed to help you sort & sift large data corpuses. There are several options available to cull out the junk and get to the heart of your matter quickly – de-deplication, de-nisting, filtering, keyword lists, relevant date range, etc.

3) Analysis Tools – An e-discovery solution like Digital WarRoom provides not only the ability to review and cull documents, but also dozens of data visualizations and reports to help you find patterns and trends in your data for early case assessment.


See also Video: Analysis Tools For Reviewing Email in Digital WarRoom



Email is one of the most commonly collected forms of ESI. As a legal professional, consider cementing a workflow for preserving and collecting data across common email applications. From there, your eDiscovery tool can take over the heavy lifting on the data processing side and present the information in a digestible way for your reviewers to manage.


If you found this article interesting, be sure to subscribe you and your team to our monthly blog distribution email. This email list is solely for blog distribution purposes and we promise to only send one email per month. To subscribe, simply scroll down and fill out the "Subscribe" form below the comment box.

Topics: Best Practices