Guide
How To Design Defensible Keyword Searches
17 pages · 21 min read
Learn to design effective and defensible keyword searches for e-discovery.
- Search terms and technology assisted review
- Chain of custody and defensibility
§ Guide
How To Design Defensible Keyword Searches
This guide explains how to design defensible keyword searches, covering terms, syntax, and methods that withstand scrutiny from the opposing side.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 17 pages · 21 min read · Published 2026-08-30
Drafting search terms from memory often leads to indefensible disclosure protocols, budget-eating wildcards, and undetected evidence failures. Prepared by the Computer Forensics Lab e-Discovery team, this publication equips UK lawyers to construct robust search protocols that survive opposing party scrutiny during disclosure. The text explains how to extract terms directly from case theory and custodian vocabulary rather than guesswork, alongside engineering platform-specific syntax using operators, wildcards, and proximity rules. It addresses technical failure modes, including OCR postures, unsearchable WhatsApp and Teams channels, and the role of technology assisted review and analytics queries within wider source architecture. Beyond search design, the material details the negotiation of Disclosure Review Document tables, hit count refinement, and testing procedures required to ensure complete defensibility. Practical sections provide worked examples, suggested wording for search protocols, interrogatories for clients, opponents, and e-discovery providers, alongside control checklists for identifying red flags and knowing when to instruct an ISO 17025 aligned digital forensic expert.
Share
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. The authority behind this subject is Practice Direction 57AD, Appendix 2, use of technology in disclosure, which you should read alongside this guide. See every guide's author and source.
§ Read How To Design Defensible Keyword Searches
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
Page 1
KEYWORDSEARCHDESIGN · A GUIDE FOR UK LAWYERS How to Design Defensible Keyword Searches Terms, Syntax and the Method That Survives the Other Side's Scrutiny COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES SEARCH PROTOCOL DESIGN
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the list drafted from memory 03 Where terms come from: case theory and custodian vocabulary 04 Syntax that works: operators, wildcards and proximity 05 What keywords miss: the known failure modes 06 The negotiation: DRD tables, hit counts and refinement 07 Documentation: making the list defensible 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: TERMSCOMEFROMTHEDATA ' SOWNVOCABULARY, SYNTAXIS ENGINEEREDPERPLATFORM, ANDEVERYCHOICEISTESTEDANDDOCUMENTEDBEFORE IT IS AGREED
§ 02 · FIRST PRINCIPLES The problem in plain English: the list drafted from memory
§ 03 · THERAWMATERIAL Where terms come from: case theory and custodian vocabulary
Page 2
§ 04 · THEENGINEERING Syntax that works: operators, wildcards and proximity
§ 05 · THEBLINDSPOTS What keywords miss: the known failure modes
§ 06 · THETABLESTAKES The negotiation: DRD tables, hit counts and refinement
§ 07 · THEPAPERTRAIL Documentation: making the list defensible
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives WHEN WIDER OCR & KEYWORDS TERMS / TEXT RETURN VARIANTS REPAIR PARTICIPANT STRUCTURED- ANALY TICS ADJACENT & DATE PULLS DATA QUERIES & TAR CHANNELS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECODENAMETHEPLEADINGSNEVERKNEW EXAMPLE2 · THEWILDCARDTHATATETHEBUDGET EXAMPLE3 · THENULLRETURNTHATWASANOCRPOSTURE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · SEARCH METHODOLOGY PA R AG RAPHFORTHEDRD / PROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The search-design checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions How many search terms should a list have? The other side proposes terms hitting hundreds of thousands of documents. Must we accept? Our searches returned nothing on a central issue. Can we certify that? Do keyword searches work on Whats App and Teams data? Are keyword searches still acceptable now TAR exists? Who should draft the list: lawyers or the provider?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
§ Related documents
Brochure
Digital Forensics Services
10 pages · 14 min read
A complete guide to how Computer Forensics Lab handles electronic evidence for UK litigation, internal investigations and regulatory work.
- Forensic collection and imaging
- Expert evidence and reports
- Chain of custody and defensibility
Guide
Crypto Assets: Investigation, Tracing, Attribution and Disclosure
72 pages · 156 min read
Guide 7 in the CFL Electronic Evidence Series, a legal and technical reference for practitioners in England and Wales who meet crypto assets in litigation, fraud investigations, insolvency, divorce and regulatory work.
- Crypto asset investigations
- Expert evidence and reports
- Chain of custody and defensibility
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.