One missed email thread. That is usually all it takes. Not a smoking gun, not a star witness, just a single string of messages that nobody had eyes on until three weeks before a deposition.
I have watched this movie more than once. It always starts the same way: a paralegal pings you at 9 p.m. asking whether the client’s old Slack workspace was ever collected, and you feel your stomach drop because you know the answer. The honest answer is no. It gets worse from there, because the other side already knows the answer too.
The fix is not more lawyers. It is a saner way of handling data, which is what good ediscovery services actually sell underneath the jargon. Think of it as organizing the evidence before anyone is deposed, not after.
The real cost is not the review bill
Every attorney I have talked to can quote their own hourly rate. Almost none of them can tell you what a missed custodian costs them a year later. That is the part nobody puts on a spreadsheet.
Here is what a rescoped collection actually looks like. You find out at the eleventh hour that the client’s IT team rotated a mailbox six months ago and the backup tape was recycled. You file a motion to compel anyway. The judge is patient but unimpressed. Your client hears the delay estimate and starts asking whether the case is worth defending.
None of that shows up as a line item. It shows up as a settlement number that is higher than it should be, and as a relationship with a client that is now a little colder than it was in January.
How do you know if your data is actually under control?
Ask yourself three questions before your next status conference call:
- Can you name every custodian who touched the disputed project without opening a spreadsheet?
- Can you produce a provable chain of custody for a single document in under ten minutes?
- Do you know where the team’s chat tool keeps its history, and who administers it?
If you stumbled on any of them, your data is not under control. It is under hope.
Dead ends hide in the boring places
Everyone goes hunting for the glamorous stuff: the executive’s personal folder, the sales voice memos, the CFO’s text messages. The case-turning evidence usually lives somewhere else entirely. Shared drives with default naming conventions. Help desk tickets. A vendor portal login somebody set up in 2019 and never cleaned up.
According to the National Institute of Standards and Technology, the discipline of digital forensics depends on documented, repeatable procedures because the artifacts themselves are fragile and easy to alter. That is not a lawyer talking. That is a standards body telling you that if your process is improvised, your evidence is a moving target.
What that means in practice: the metadata matters as much as the message. Who sent it, when they opened it, whether it was forwarded, whether the version you reviewed last week is the version you will see in court. If any of those answers surprise you, you have a problem worth solving now, not in three months.
A walkthrough you can run this quarter
This is the sequence I use when a case lands with a data mess and nobody knows where to start. It is not fancy. It is thorough.
- Map the custodians first.Names, roles, and every tool they touched during the relevant period. If the list is longer than you expected, that is the point.
- Inventory the sources.Mail, chat, shared drives, phone backups, project management tools. Mark each one as collected, in progress, or at risk.
- Lock down the fragile ones early.Retention policies, auto-purge settings, and departing employee accounts are the three biggest silent killers of a case.
- Document the handoffs.Every time data moves between people or systems, write it down. Your opposing counsel will ask, and “I think Sarah handled that” is not an answer.
- Review for the question, not the volume.The database can hold a million documents. You only care about the ones that answer the disputed fact.
Notice that none of this is about software. Software is the vehicle. The roadmap is the actual work.
The courts already told us what good looks like
Judges handle discovery disputes constantly, and most of them are not subtle about the pattern. Cases fall apart when a party cannot explain how its own data was handled, and they move smoothly when a party can walk through the process step by step. That is a fact of litigation, not a marketing line.
The Administrative Office of the U.S. Courts publishes rules and guidance around civil procedure that has accrued over decades, and the theme running through nearly all of it is documentation: who did what, when, and why. If you can answer those questions cold, you are almost always in a stronger place than the other side, regardless of what the underlying facts actually say.
Preservation is the other half of the coin. Anyone who has ever had to reconstruct an email trail from a database that was never designed for that purpose knows the pain well.
Two things I would stop doing tomorrow
I would stop treating collection as a one-time event. Data keeps moving, people keep leaving, tools keep getting replaced. If your collection plan was signed off in March and it is now October, it is probably stale.
I would also stop letting the billable hour decide scope. The temptation to do just enough work to get to the next deadline is real, and it always costs more in the end. Better to over-collect early and winnow later than to explain a gap to a judge.
For firms that do this repeatedly, the smarter move is to standardize the playbook. The National Archives has spent decades defining how records are preserved, retained, and eventually destroyed with a clear audit trail, and its frameworks are a useful mirror for anyone building a repeatable litigation workflow. You do not need to copy their playbook line for line, but you do need a playbook.
What actually changes when you get this right
Nothing dramatic happens on the surface. The case keeps moving, deadlines get met, and nobody has a crisis call at 9 p.m. That is the whole point. Calm beats heroic every time.
Your clients feel it too. They notice when you can answer questions without promising to circle back, and when a deposition goes smoothly because the exhibits are ready before anyone asks. The relationship gets a little sturdier each time.
The other side, meanwhile, is usually still trying to figure out whether the client’s Google Workspace was ever collected. That is your advantage. Not brilliance, not theatrics. Just a working system that does not leave threads dangling.
So ask the uncomfortable question this week: if a new custodian appeared in your case tomorrow, would you know where their data lives, or would you be guessing again? Answer that honestly and you will know exactly what to fix.
