For in-house counsel at a large company, the hardest part of electronic disclosure is no longer review. It is knowing where the material lives, proving you collected all of it that matters, and doing so without halting the business for a fortnight. This guide sets out how experienced teams approach that problem.
Map the data before you touch it
Start with a data map rather than a custodian list. For each custodian, record the mailbox, the personal and shared cloud storage, the collaboration channels they use, the ticketing or CRM systems that hold relevant records, and the devices issued to them. A map built with IT before any preservation notice goes out will save weeks later, because it turns disclosure into a defined scope rather than an open question.
Preserve early and in writing
Legal hold obligations bite as soon as litigation is reasonably in contemplation. In practice that means suspending automatic deletion in the mail tenancy, on collaboration channels and in any system with a short retention window. Chat platforms are the usual casualty, because retention there is often set for storage cost rather than for evidence.
Understand what cloud export actually gives you
Cloud platforms provide search and export tools, and they are useful, but they are not the same as forensic collection. Native export can silently drop attachments and versions, flatten thread structure, alter timestamps to the export time zone and omit deleted but recoverable items. Where completeness or authenticity may be challenged, collection should be performed and documented so that the method and its limits can be explained to the court.
Corporate mobile devices are the sharpest problem
Managed handsets sit behind full disk encryption, device management policies and application level containers. Extraction is possible in most cases, but the available method depends on the make, the operating system version and the management posture. Ephemeral and disappearing messages complicate this further. The practical answer is to test extraction on one representative device early, so that scope and cost are known before the whole fleet is committed.
Reduce before you review
Deduplication, threading, date and custodian filters and early case assessment routinely remove the majority of a collection before a lawyer opens a document. Technology assisted review then prioritises what remains. The saving is real, but it must be defensible, so record the filters applied and be prepared to justify them to the other side.
Keep the record of process
Chain of custody, hash values, collection logs and the identity of who did what and when are what turn a set of files into evidence. Under the Disclosure Practice Direction the parties are expected to cooperate on the approach to searches, so a clear written record of method is not administrative overhead, it is the basis of the conversation with the other side.
Where to start
If a matter is live, three steps pay for themselves immediately. Freeze retention across mail, storage and chat. Build the data map with IT. Test extraction on one managed handset. Everything else in the exercise becomes easier to scope once those three are done.