§ 0 2 · First principles

ECA and EDA: two related disciplines, one central proposition

The central proposition of this guide is simple. The principal benefit of Early Case Assessment is not merely reducing the number of documents lawyers must review. Its greater value is allowing legal teams to understand the evidence, risks, relationships, likely disclosure burden and potential strengths and weaknesses of a matter sufficiently early to make better strategic decisions.

The problem explained in plain English

Most disputes now begin with a paradox. The client holds more potentially relevant information than at any time in history, spread across mailboxes, Teams channels, OneDrive, SharePoint, phones, messaging apps, cloud applications and backups, yet the legal team knows less about that information at the moment it must make its most consequential decisions. Which custodians? Which systems? Which dates? What will it cost? Decisions taken at that point tend to be over-inclusive because over-inclusion feels safe. It rarely is. It multiplies processing, hosting, privilege review and personal-data exposure, and it delays the moment at which the lawyer actually understands the case.

Conventional or poorly implemented ECA has frequently followed a "collect first, understand later" model: identify a large number of custodians; collect extensive datasets; process everything; apply broad keyword searches; send large populations for linear human review; and discover duplication, irrelevance and incorrect assumptions only after substantial expenditure has occurred. The alternative is a data-informed methodology in which the team progressively understands the information before committing to collection and review at scale.

Important terminology

How modern eDiscovery combines the two

ECA asks the legal questions: what must be proved, what could defeat us, who knew what and when. EDA answers them empirically from the data and, in doing so, generates new legal questions. The disciplines are iterative. A lawyer who reads a suspicious Teams thread revises the issues; a revised issue prompts a new search; the search reveals a custodian who was never interviewed. Section 7 sets out the feedback loop in detail. The EDRM Identification Standards make the same point in their own terms: documenting the findings during identification is as important as discovering the information.¹⁰

§ 0 4 · Why it matters legally

ECA and the disclosure framework in England and Wales

ECA is not a procedural stage. No rule or practice direction mandates it by name. What the rules do mandate is proportionality, cooperation, preservation, informed identification of custodians and sources, and a considered approach to technology. ECA is the practical work that makes those obligations achievable and the party's positions credible.

The Business and Property Courts: PD 57AD

Practice Direction 57AD governs disclosure in most Business and Property Courts proceedings (with the exceptions listed at para 1.4).³ Its architecture maps closely onto what ECA delivers:

• Preservation (paras 3.1 and 4). A person who knows it is or may become a party is under a duty to take reasonable steps to preserve documents in its control that may be relevant, including suspending deletion routines and notifying former employees and third parties where appropriate.³ ECA's preservation-risk review is how that duty is discharged intelligently.
• Issues for Disclosure (para 7). The parties must identify the key issues that will need to be determined by reference to contemporaneous documents. Early understanding of the factual story determines whether those issues are drawn well.
• Disclosure Models (para 8). Models A to E range from known adverse documents to wide search-based disclosure. Choosing and arguing for a Model requires knowledge of what a search of each source would actually involve.
• Reasonable and proportionate search (paras 6.4 and 9.6). Where a Model requires searches, the parties must discuss and seek to agree limits by date range, custodian, class of document, repository, system or device, and automated searches, "with a view to reducing the burden and cost of the disclosure exercise".³ Every one of those parameters is an EDA output.
• Technology (paras 9.6 and the DRD explanatory notes). The parties must consider software and analytical tools, including technology-assisted review, deduplication and sampling, where proportionate.^3,4
• The Disclosure Review Document (para 10). Section 2 of the DRD asks each party to identify data sources and locations, custodians and date ranges, unavailable or inaccessible sources, initial search proposals and proposals to use technology, together with cost estimates.⁴ A DRD completed without ECA is a DRD completed on hope.
• Cooperation and Disclosure Guidance (paras 2.3, 11). Parties are expected to cooperate and may seek Disclosure Guidance. Measured data supports more constructive discussions with the opponent and the court.
• Staged disclosure and production planning. The court may order disclosure in stages or by reference to particular issues; understanding where evidence sits allows a party to propose a sensible sequence.

CPR Part 31 and PD 31B

Outside PD 57AD (for example in the County Court, in the King's Bench Division outside the Business and Property Courts, and in the excluded categories at PD 57AD para 1.4), CPR Part 31 continues to apply, with PD 31B governing electronic documents in multi-track cases.² The "reasonable search" factors in CPR 31.7(2) (number of documents, nature and complexity, ease and expense of retrieval, significance of documents likely to be located) and PD 31B paras 20 to 27 on keyword and automated searching were the framework applied in both Pyrrho and Triumph Controls.^5,6 PD 31B's emphasis on early discussion of the scope of searches, and its warning that a party disclosing without prior discussion may be required to repeat searches (para 19, quoted in Triumph Controls at [15]), is a direct procedural argument for doing ECA early and sharing its results.⁶

ECA findings and their possible disclosure consequences

§ 0 6 · Technology

What modern eDiscovery technology adds to Early Case Assessment

Each technique below is introduced by answering three questions: what is it, why should a lawyer care, and what can go wrong. Human validation remains necessary in every case, because each tool answers a narrow question well and a broad question badly.

Generative AI in ECA: emerging uses and necessary safeguards

Generative AI is being used, cautiously, for summarisation of large sets, preliminary issue identification, chronology assistance, relevance assistance, query generation, privilege flagging and interactive interrogation of documents. The Law Society's practical guide on generative AI in legal disclosure (November 2025) and ILTA's Generative AI Best Practice Guide (September 2025) both promote clarity, accuracy checks and human-led review, and treat generative AI as an aid to, not a replacement for, legal judgment and defensible review methodology.^12,13 The Divisional Court in Ayinde v London Borough of Haringey confirmed that lawyers remain fully accountable for AI-generated content and may face regulatory consequences if they fail to verify it.¹⁴

§ 0 8 · Evidence-source map

The evidence universe

ECA should identify not merely "documents" but the systems and relationships capable of producing evidence. The evidence universe of a commercial dispute has eight regions, and the same fact usually leaves traces in several of them.

§ 0 9 · Evidence gaps

ECA can reveal what is missing

Absence is evidence of something. An abrupt silence, a referenced attachment that is not there, a name that appears in every thread but on no custodian list: each is a trigger for further investigation, and each has a primary source and one or more alternative evidence paths.

This is why ECA is as valuable to digital forensic investigators as to disclosure lawyers. The investigator asks the same question in a different register: not "what is disclosable?" but "what happened, and where is the corroboration?" A well-built evidence-source map tells both where to look next when the first source fails.

Source architecture: where else the evidence lives

Do not examine a device or platform in isolation. For an ECA exercise the associated evidence locations are: the physical device; local storage and caches; connected computers that synchronised the same accounts; mobile applications; synchronised accounts; cloud platforms and their version histories; backups; administrative consoles (compliance centre, admin audit); identity providers (sign-in and token logs); network infrastructure (VPN, proxy, firewall); third-party service providers (SaaS vendors, telecoms, cloud hosts); and counterpart devices held by the other participants in a communication.

Fallback strategy: when the primary source is unavailable, damaged, encrypted, deleted or inaccessible, pursue in order the cloud copy and its version history, the counterpart or recipient copy, the backup within retention, then the logs that prove the document or event existed even if its content cannot be recovered; instruct a forensic examiner before the remaining source is touched.

§ 1 1 · Case study

Case study: Triumph Controls UK Ltd v Primus International Holding Co [2018] EWHC 176 (TCC)

Decided by Coulson J on 7 February 2018 in the Technology and Construction Court, under CPR Part 31, PD 31B and the TeCSA/TECBAR eDisclosure Protocol. The judgment demonstrates that technology does not make an eDiscovery methodology automatically defensible.⁶

What happened

The claimants claimed some US$65 million for breach of warranty following the purchase of an aerospace business (at [1]). Their Electronic Documents Questionnaire stated that, following a keyword search, all responsive documents would be "manually reviewed"; it made no reference to computer-assisted review (at [6]). The agreed keywords, reduced by agreement because of volume, produced 450,000 responsive documents (at [7]). The first list, based on a review of over 200,000 documents, disclosed 12,476 documents; a supplemental list added 4,163 (at [8] to [9]).

It later became apparent that, having reviewed around 230,000 of the 450,000 documents using manual searches aided by CAR, the claimants decided not to search the balance of 220,000 documents that CAR had de-prioritised. They said they had sampled 1 per cent of those documents using a CAR technique, which predicted that only 0.38 per cent would be relevant, and concluded that further searching was disproportionate. This was never discussed with, let alone agreed by, the defendants (at [10]). Ten supplemental lists followed, adding almost 3,000 documents, around 2,000 of which were responsive to the original keywords and so, on the face of it, should have been disclosed originally (at [11]).

A separate complaint about the 860,000 folders on a three-terabyte shared drive failed: the claimants had explained in their list how custodians identified likely folders, only two further folders had since emerged, and the defendants could point to no missing folder (at [19] to [24]).

Why the sampling and review approach was found inadequate

Coulson J's concerns about the 220,000 documents were specific (at [27] to [31]): the claimants did not do what the EDQ said they would do; the disclosure list did not make the method clear; at no time were details provided of how the CAR was set up or operated, which was unsatisfactory where the decision was unilateral; no information was given about how the sampling was conducted, with no stated tolerances and no explanation of the number of rounds; perhaps ten paralegals and four associates were involved with no overseeing senior lawyer performing the role advocated in Pyrrho, so the system may not have been "educated" as well as it might have been; and, in all, neither the CAR nor the sampling could be described as transparent or independently verifiable.

That would not have mattered had the results been reliable. But (at [33] to [36]) the total disclosed (about 19,500, some 4.3 per cent of 450,000 responsive documents) appeared very modest for a document-heavy warranty claim; around 2,000 later-disclosed documents had been keyword-responsive all along; some further documents surfaced only because the claimants' own witnesses wanted to rely on them; and the 0.38 per cent prediction was therefore likely to be an underestimate. The judge concluded that the steps taken were not adequate (at [37]). Because the CAR process had never been explained, "only a manual review will do" (at [38]). Balancing the £180,000 and two-month estimate against a US$65 million claim and a trial less than six months away, he ordered the parties to agree a methodology by which a sample of 25 per cent of the 220,000 documents would be manually searched within three weeks, with results reported in an agreed letter (at [39] to [42]).⁶

ECA lessons

• Documenting methodology: what was done, by whom, with what settings, must be recorded as it happens; reconstructing it later, as at [29], rarely convinces.
• Appropriate sampling: sample size, confidence level, tolerances and rounds are stated in advance; the non-reviewed population is sampled by humans, not only scored by the model.
• Validating assumptions: the 0.38 per cent figure was an assumption dressed as a measurement; the later disclosures tested it and it failed.
• Transparency: tell the opponent what you propose before you do it (PD 31B para 19; TeCSA protocol paras 4.2 and 5.2; PD 57AD para 9.6).
• Proportionality: is measured against the value and nature of the claim, not against the review budget alone.
• Changing strategy when evidence undermines assumptions: when witnesses started producing undisclosed documents, the methodology needed revisiting; the court did it instead.

§ 1 3 · Cost illustration

Cost illustration and the eDiscovery cost funnel

The figures below are hypothetical and formula-based. They are not market prices, averages or benchmarks. Their purpose is to show how apparently modest decisions taken early propagate through the funnel and multiply at the review stage.

The 50 documents per hour rate, the 35 per cent duplication, the expansion ratios and the £40 are placeholders chosen for arithmetic clarity. Real rates vary with document type, issue complexity, reviewer seniority, platform and jurisdiction. Reduction percentages are case-specific; some matters have 10 per cent duplication and a relevant period that really is five years.

§ 1 5 · Outputs

ECA deliverables and sample templates

A professional ECA exercise produces documents, not impressions. The templates below are skeletons; each is populated with measured figures and the date on which they were measured.

§ 1 6 · Dashboard concept

ECA dashboard concept

A mock dashboard showing the kind of intelligence a good ECA platform surfaces. Every value is fictional and illustrative; none is drawn from a real matter or from any benchmark.

Everything on this dashboard is invented to illustrate the categories of intelligence ECA can provide: matter overview, data, communications, issues and costs. "£A" and "£B" stand for estimates the provider would populate from measured volumes and quoted rates.

§ 1 7 · Privilege and confidentiality

ECA and privilege

Early assessment identifies where privileged material concentrates before a wide review team sees it. Domain analysis lists the law firms, in-house legal addresses and legal department groups in the data; name lists identify lawyers and paralegals; family analysis shows the email chains and attachments that travelled with legal advice; date analysis shows the period after litigation was contemplated, when litigation privilege may attach.

Why privilege searching is not infallible

Privilege is a legal characteristic of a communication, not a property of a domain. Lawyers send non-privileged emails (diary invitations, invoices, commercial negotiation as agent); non-lawyers forward privileged advice in ways that retain privilege, and sometimes in ways that lose it; in-house lawyers wear commercial hats; legal advice is summarised in board minutes; and litigation privilege turns on dominant purpose, which no search term measures. Automated privilege flagging, including generative AI flagging, is a triage tool that must be followed by lawyer review of every document to be withheld or produced.¹²

Safeguards before substantive material is exposed too widely

• Run domain, name and family analysis on the ECA dataset before any reviewer outside the core team sees content; isolate hits into a privilege workflow.
• Restrict access to the ECA platform by role; log who has viewed what.
• Treat ECA work product (hot-document lists, chronologies, assessments) as privileged: create it for the purpose of obtaining legal advice or for the litigation, label it, and store it outside the disclosure database.
• Agree a clawback or inadvertent-disclosure protocol with the opponent early; note CPR 31.20 on inadvertently disclosed privileged documents.²
• Where a provider or expert hosts the data, ensure the engagement terms address confidentiality, privilege and no secondary use of the data (including for model training).

§ 1 8 · Data protection

ECA and UK data protection

Almost every ECA dataset is personal data. The UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, govern its collection, hosting, analysis, transfer and retention. The framework does not prevent disclosure; it disciplines how disclosure is prepared.^15,16,17

§ 2 0 · When to involve a digital forensic expert

When digital forensics should enter the ECA process

Ordinary eDiscovery collection copies what exists, in a defensible way, for review. Forensic investigation asks what happened: what existed and no longer does, who did what on which device and when, and whether artefacts are what they appear to be. The two disciplines overlap at collection and diverge at analysis; the point of ECA is to notice, early, which one the facts require.

Where the matter may reach a criminal court, or where an expert report may be relied on in criminal proceedings, the Forensic Science Regulator's statutory Code applies and compliance declarations are required; in civil proceedings the expert's overriding duty to the court under CPR Part 35 applies.^22,23 Instruct with a clear question, a chain-of-custody expectation and a prohibition on anyone else powering on or examining the source before the examiner does.

§ 2 1 · Implementation plan

Practical implementation plan

§ 2 2 · Question banks

Question banks

Questions to ask the client

1. Who worked on this matter day to day, and who did they talk to? Who has left, and when?
2. Which systems were in use during the relevant period, and have any been migrated, retired or replaced?
3. What retention, auto-delete and leaver policies apply to mailboxes, chat, files and backups? Have they been suspended?
4. Do people use WhatsApp, Signal, personal email or personal devices for work? Who, and for what?
5. Which business applications (CRM, ERP, finance, ticketing) hold records of the events?
6. What has already been deleted, wiped, reissued or reformatted since the dispute arose?
7. Are there backups or archives that reach back to the relevant period? Who can restore them?
8. Who are your lawyers and advisers, internal and external, and which addresses did they use?
9. Is there any document you are worried about? Who else has seen it?
10. What have you already told the other side, and what have you promised to do?

Questions to ask the opponent

1. Which custodians, date ranges and sources do you propose, and on what evidence?
2. What preservation steps have you taken, when, and for which systems, including chat and mobile?
3. Which sources are unavailable or inaccessible, and why?
4. Have you tested your proposed keywords? Please provide hit and family counts and sampling results.
5. Do you intend to use deduplication, threading, analytics, TAR or generative AI? Please describe the method, oversight and validation.
6. Will you share your processing settings (deduplication scope, time zone, exception handling)?
7. Which former employees' data have you preserved, and how?
8. What is your estimate of documents by source, and of disclosure cost?
9. Are any relevant communications held on personal devices or accounts of your witnesses?
10. Will you agree a clawback protocol and a production format now?

Questions to ask a forensic or eDisclosure provider

1. How will you preserve and collect each source, and how is chain of custody documented?
2. What can you assess in place before full collection, and what does that cost?
3. What is your deduplication scope by default, and how are suppressed items retained and reported?
4. How do you handle time zones, exceptions, encrypted items and non-text files?
5. What analytics are available for ECA, and what reports will we receive (volume, date, domain, communication, concept, keyword-test)?
6. If TAR or CAL is proposed, how is recall measured and reported, and who trains the model?
7. If generative AI is offered, where is data processed, is it used for training, and how are outputs verified and logged?
8. Where is data hosted, who has access, and what security certifications apply?
9. Can you give evidence about your method, and have you done so before?
10. What are your unit rates, and what volume assumptions drive the estimate?

§ 2 3 · Suggested wording

Model instruction wording

Adapt to the matter; these are starting points, not precedents.

§ 2 4 · Red flags

Red flags

Signals that the ECA exercise, or the disclosure that depends on it, is heading towards a dispute or a further-search order.

• The custodian list has not changed since the first client call.
• Keywords have been agreed with the opponent but never run against the data.
• Nobody can state the deduplication scope or the time zone applied.
• A single-digit percentage relevance figure is quoted for an unreviewed population with no sample size or method.
• The DRD says "manual review" or "TAR" and the team intends to do something else.
• Emails refer to a WhatsApp group, a Signal chat or "my personal Gmail" and no handset has been considered.
• The most relevant employee has left and nobody has checked the leaver process.
• The date distribution has a hole in the middle of the critical period and nobody has asked why.
• A witness produces a document during proofing that is not in the disclosure set (Triumph Controls at [35]).⁶
• Analytics screenshots or hot-document lists are circulating outside the privileged workspace.
• The provider cannot say where the data is hosted or whether it is used to train models.
• Preservation has been "scoped down" to match the collection plan.
• Tenant retention policies were reviewed after collection, not before.
• The cost budget was prepared from source gigabytes rather than from a measured document population.
• Decisions about excluded sources exist only in email chains.

§ 2 5 · Glossary

Glossary

Active learning / CAL

A TAR workflow in which the relevance model retrains continuously as reviewers code documents, presenting the likeliest-relevant documents next.

Adverse document

A document that is adverse to the disclosing party's case; under PD 57AD known adverse documents must be disclosed regardless of Model.

Chain of custody

The documented record of who held evidence, when, and what was done to it, from source to court.

Clustering

Statistical grouping of documents by textual similarity.

Concept search

Retrieval of documents by meaning or theme rather than by literal term.

Custodial deduplication

Removal of duplicates within each custodian's data only.

Custodian

A person (or account) who holds or controls potentially relevant documents.

Deduplication

Identification and suppression of exact duplicates by hash value.

Disclosure Model

One of Models A to E under PD 57AD para 8, from known adverse documents only (A) to wide search-based disclosure (E).

DRD

Disclosure Review Document under PD 57AD para 10.

ECA

Early Case Assessment: early analysis of the dispute informed by data.

EDA

Early Data Assessment: early analysis of the ESI itself.

EDQ

Electronic Documents Questionnaire under PD 31B.

EDRM

Electronic Discovery Reference Model, an industry framework; not English procedural law.

Email threading

Reconstruction of conversations and identification of inclusive messages.

ESI

Electronically stored information.

Expansion ratio

The multiplier from collected files to processed documents after containers and attachments are extracted.

Family

A parent document and its attachments, reviewed and produced together.

Forensic image

A bit-for-bit copy of a storage device, hash-verified against the original.

Generative AI

Large language models that produce text such as summaries, classifications and answers.

Hash value

A cryptographic fingerprint of a file; identical files produce identical hashes.

Hot document

A document of unusual strategic importance, helpful or adverse.

Inclusive message

The message in a thread that contains all earlier content.

Issues for Disclosure

The key issues in dispute to be determined by reference to contemporaneous documents (PD 57AD para 7).

Legal hold

An instruction to preserve documents and suspend deletion.

Metadata

Data about data: authorship, dates, recipients, file properties.

Near-duplicate

A document substantially similar but not identical to another.

Precision

The proportion of documents retrieved that are relevant.

Predictive coding

Earlier term for TAR; supervised relevance classification.

Proportionality

The overriding objective's requirement to deal with cases at proportionate cost (CPR 1.1).

Recall

The proportion of relevant documents actually retrieved.

Sampling

Review of a random or stratified subset to estimate properties of the whole.

Special-category data

Personal data listed in UK GDPR Article 9(1), such as health or ethnicity.

TAR

Technology-assisted review.

Unified audit log

Microsoft 365's consolidated record of user and admin operations.

§ 2 8 · Disclaimer

Disclaimer and jurisdictional notes

This guide is published by Computer Forensics Lab Ltd for general educational purposes. It provides general information about early case assessment, electronic disclosure and digital forensics in England and Wales as at 1 September 2026. It is not legal advice, does not create a solicitor-client or expert-client relationship, and should not be relied on as a substitute for advice from a qualified lawyer on the facts of a particular matter. Procedural rules, practice directions, guidance and case law change; readers should verify the current position before acting. The hypothetical matter, the parties, the individuals, the dashboard values and the cost figures in this guide are fictional and illustrative. Any resemblance to real persons, companies or matters is coincidental. Nothing in this guide should be read as a description of any actual client engagement.

© 2026 Computer Forensics Lab Ltd. All rights reserved. This guide may be shared in unaltered form for non-commercial educational purposes with attribution to Computer Forensics Lab (cflab.uk).