Guide
What Happens During EDiscovery Processing
17 pages · 20 min read
E-discovery processing is the critical, often overlooked, stage between data collection and document review.
- Processing and review
- Electronic disclosure practice
§ Guide
What Happens During EDiscovery Processing
This guide explains the e-discovery processing stage, detailing how collected data transforms into reviewable documents through recorded, defensible decisions.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 17 pages · 20 min read · Published 2026-08-30
Aimed at UK legal practitioners navigating digital disclosure, this manual addresses the unexamined stage between raw data collection and document review where unrecorded technical decisions can compromise legal defensibility. It unpicks the pipeline transforming raw electronic data into reviewable formats, detailing critical choices around de-NISTing, applying filters, and handling processing exceptions. Grounded in ISO 17025-aligned procedures, full chain-of-custody documentation, and CPR Part 35 expert reporting standards, the text explains how to achieve precise reconciliation so document numbers add up. It covers complex inputs including mobile data, chat records, cloud exports, and structured sources, while providing strategies to challenge or defend contested document counts in processing disputes. Through real-world worked examples, technical limitations, red flag checklists, and suggested wording for disclosure protocols, legal teams learn how to interrogate clients, opponents, and eDiscovery providers. By exposing potential mistakes such as unhandled exceptions or missing attachments, it equips solicitors to verify that processing audit trails remain robust and defensible throughout litigation.
Share
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. The authority behind this subject is NIST Computer Forensics Tool Testing programme, which you should read alongside this guide. See every guide's author and source.
§ Read What Happens During EDiscovery Processing
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
Page 1
EDISCOVERY PROCESSING · A GUIDE FOR UK LAWYERS What Happens During e Discovery Processing? The Black Box Between Collection and Review, Opened for Lawyers COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES EDRM PROCESSING PRACTICE EXCEPTION & RECONCILIATION REPORTING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the stage nobody watches 03 The pipeline: from collected data to reviewable documents 04 The decisions that matter: exceptions, de NISTing and filters 05 Reconciliation: making the numbers add up 06 Special formats: mobile data, chat, cloud exports and structured sources 07 Processing disputes: challenging and defending the counts 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PROCESSINGTURNSDATAINTODOCUMENTSTHROUGHRECORDED DECISIONS: THERECORDISWHATMAKESYOURDISCLOSUREDEFENSIBLE
§ 02 · FIRST PRINCIPLES The problem in plain English: the stage nobody watches
§ 03 · THEPIPELINE The pipeline: from collected data to reviewable documents
Page 2
§ 04 · THEDECISIONS The decisions that matter: exceptions, de NISTing and filters
§ 05 · THEARITHMETIC Reconciliation: making the numbers add up
§ 06 · THEAWKWARDINPUTS Special formats: mobile data, chat, cloud exports and structured sources
§ 07 · WHENCOUNTSARECONTESTED Processing disputes: challenging and defending the counts
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EXCEPTION SOURCE RE- COUNTERPART CREDENTIALS T YPE PULL COPIES & KEYS OTHER VERSIONS / BACKUPS NET RESULT RENDERS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEEXCEPTIONTHATWASTHECASE EXAMPLE2 · THE400GBTHATBECAME41, 000DOCUMENTS, DEFENSIBLY EXAMPLE3 · THEFAMILIESTHATCAMEAPART
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · PROCESSING PA R AG RAPHFORTHEDISCLOSUREPROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The processing checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why did 400 GB of data become only 40,000 documents? What actually happens to files that cannot be processed? Is it safe to remove "system files" from the review set? Our opponent's production has emails whose attachments are missing. Innocent? Can we change processing decisions after review has started? Does processing alter the underlying evidence?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
§ Related documents
Guide
Guide 5 Identifying The Right Custodians In Electronic Disclosure
32 pages · 53 min read
Identifying the right custodians is crucial for electronic disclosure.
- Custodians and data mapping
- Electronic disclosure practice
Guide
Apple Mail Archives And Email Threading On MacOS
17 pages · 25 min read
Apple Mail archives and email threading on macOS are crucial for reconstructing email conversations.
- Processing and review
- Email evidence
- Apple and macOS forensics
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.