Electronic Discovery: Preservation, Collection, Review, and Sanctions

Electronic discovery is the process of preserving, gathering, filtering, reviewing, and producing electronically stored information in litigation. In most commercial cases it is the largest single line in the budget and the most common source of procedural trouble. The trouble is rarely exotic: data was deleted before anyone thought to stop it, or the scope of collection was set without regard to what review would cost.

Two federal provisions govern the field. Rule 26(b)(1) sets the scope of what may be demanded. Rule 37(e), as amended in 2015, sets what happens when information that should have been kept is gone.

The lifecycle, stage by stage

The table has one lesson. Costs compound to the right, and the decisions that control them are made on the left. A collection scope set carelessly in week two is paid for in review fees in month eight.

Preservation: the duty and its edges

The duty to preserve arises when litigation is reasonably anticipated — a common-law obligation, not a rule requirement, and one that predates any filing. The mechanics of issuing a defensible litigation hold, including custodian acknowledgment and reissuance, are covered in our brief on demand letters and litigation holds. The point to carry into e-discovery is narrower: preservation is judged by whether the party took reasonable steps, and reasonable steps have to be documented as they occur.

Three edges cause most difficulty. Short-retention messaging platforms destroy data on a schedule measured in days, so they need attention before email does. Personal devices used for work sit outside the organization's technical control, requiring instruction and negotiated collection rather than an administrative switch. And departing employees trigger standard wipe-and-reissue procedures that will delete a custodian's data unless the hold has already reached the people who run them.

Deadline discipline: the first preservation action should be technical, not textual. Suspend the deletion jobs that run fastest, then draft the hold. A memo issued a week later cannot recover what a seven-day retention setting removed in the interim.

Proportionality is the scope rule, not a suggestion

Rule 26(b)(1) permits discovery of matter relevant to any party's claim or defense and proportional to the needs of the case. The rule names the factors: the importance of the issues at stake, the amount in controversy, the parties' relative access to relevant information, the parties' resources, the importance of the discovery in resolving the issues, and whether the burden or expense outweighs the likely benefit. Information within that scope need not be admissible to be discoverable.

Proportionality arguments succeed on evidence and fail on adjectives. A party resisting a request should be able to state the number of custodians, the volume in gigabytes or documents, the vendor cost per gigabyte processed, and the estimated review hours. A declaration with those figures is a proportionality argument. An assertion that a request is burdensome is not.

The rules also recognize that some sources are not reasonably accessible because of undue burden or cost — legacy backup tapes, decommissioned systems, fragmented archives. A party may decline to produce from those sources by identifying them, though a court can still order production for good cause. Identifying them is not optional: silently omitting a source is a different problem entirely.

Two procedural moments set the tone for everything after. The parties' discovery-planning conference must address preservation and ESI issues, and the resulting scheduling order can lock in the form of production, search protocols, and privilege-protection terms. Parties that treat that conference as a formality spend the rest of the case litigating what they could have agreed in an hour.

Review, privilege, and clawback

Review is where the money goes, and privilege is where the risk goes. At volume, some privileged material will be produced by mistake; the question is what happens next. The federal rules provide a clawback procedure requiring a party notified of inadvertent production of privileged material to sequester or destroy it and refrain from using it pending resolution. Federal Rule of Evidence 502(d) goes further, allowing a court to order that disclosure in the case does not waive privilege in that proceeding or in any other. A 502(d) order is inexpensive to obtain and is one of the few genuinely asymmetric protections available in discovery.

Technology-assisted review and search-term negotiation reduce volume, but neither removes the obligation to make a reasonable inquiry. The defensible position is a documented methodology: how terms were selected, how they were tested and refined, what sampling validated the result, and what was agreed with the other side. Where an internal inquiry preceded the litigation, coordinate the review scope with the record generated there — our brief on workplace investigation records covers how that file is built, and our brief on data-breach response covers the parallel privilege problem when forensic work is involved.

Rule 37(e): what actually gets sanctioned

Rule 37(e) was rewritten in 2015 to replace a fragmented body of spoliation law with a single federal standard for lost ESI. It applies only when four threshold conditions are met: the information should have been preserved in the anticipation or conduct of litigation, it was lost, the loss occurred because the party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery.

Only after all four are established does the court consider consequences, and the rule draws a sharp line between two tiers.

That second tier is the doctrinal centerpiece. Under the amended rule, an adverse-inference instruction is unavailable on a finding of negligence alone; the moving party must establish intent to deprive. Intent can be inferred from circumstances — deletion after a hold issued, wiping a device on the eve of collection, disabling logging — but it must be found, not assumed.

Verify before relying: Rule 37(e) governs ESI in federal court. State courts apply their own spoliation doctrines, and several permit adverse inferences on a lesser showing or recognize independent tort claims for spoliation. Confirm the standard in the forum actually hearing the case, which may itself be contested — see our brief on personal jurisdiction and venue.

Questions the desk gets

If data is gone, is a sanction automatic?

No. The rule requires that the information should have been preserved, that it was lost through a failure to take reasonable steps, and that it cannot be restored or replaced. Data recoverable from a counterparty, a backup, or another custodian's mailbox generally takes the matter outside the rule. This is why the first response to a preservation motion is a restoration effort, not a legal brief.

Who pays for e-discovery?

The producing party ordinarily bears its own costs. Courts can shift costs, particularly where a request reaches sources that are not reasonably accessible or where proportionality is contested, but shifting is the exception. The realistic lever is scope: narrowing custodians, date ranges, and sources reduces cost far more reliably than a motion asking the other side to pay for a broad collection.

Can we produce PDFs instead of native files?

Only if that is what the requesting party asked for or the parties agreed. The rules let a requester specify the form of production, and if none is specified, production must be in the form in which the information is ordinarily maintained or a reasonably usable form. Converting spreadsheets or database exports to static images strips formulas and metadata and commonly draws a motion to compel re-production.

Does an internal investigation file have to be produced?

It depends on who directed it, for what purpose, and how it was documented. Work performed at counsel's direction for the purpose of legal advice may attract privilege or work-product protection; the same work performed for ordinary business reasons generally does not. Structuring the engagement and the reporting lines before the work starts matters far more than a privilege legend applied afterward.

How long does a hold stay in place?

Until the matter is genuinely resolved, including appeal periods and any related proceedings, and then only by a documented release decision. Holds that are never released accumulate until the organization is preserving everything for everyone, which is expensive and eventually ignored. A release log is as much a part of the program as the issuance log.

Sequencing the work

Front-load. Identification and preservation are cheap, fast, and decisive; review is expensive and irreversible. An organization that maps its data sources before a dispute exists — knowing where chat lives, what the retention settings are, who administers each system — can execute a hold in hours rather than weeks, and that gap is where most sanctions exposure is created.

Negotiate early on scope, search methodology, form of production, and privilege protection, and put the agreement in the scheduling order. Then keep the operational record: who was told what, on what date, what systems were changed, what was collected, and what could not be reached. That record is the evidence of reasonable steps, and it is the difference between a curative measure and a case-ending instruction.

Finally, remember what discovery is for. The record built here is the record that will support or defeat a dispositive motion, as discussed in our brief on summary judgment standards and evidence. General material on federal civil practice is published by the Administrative Office of the U.S. Courts, and the full Federal Rules of Civil Procedure are the controlling text. Related briefs sit in the Litigation & Dispute Resolution desk.

ATLAS Legal Briefing is an independent publisher, not a law firm. This brief describes the federal framework as amended in 2015 and current as of mid-2026; it is general information, not advice about any specific case.