e-Discovery Glossary

Understanding e-discovery definitions and concepts is critical to working with vendors, opposing counsel, litigation support teams and others involved in requesting and producing documents and electronically stored information (ESI) for litigation. Across the EDRM there are terms unique to the discovery process. Here you will find some of the most important.


Under the “two-tier rule” established under FRCP 26(b)(2)(B), a party need not provide discovery of ESI from sources that the party identifies as not reasonably accessible because of undue burden or cost; on motion to compel discovery or for a protective order, the party from whom discovery is sought must show that the information is not reasonably accessible because of undue burden or cost.

Active Data

Data that is directly available to operating system and/or application software.

Active Records

Records residing in storage that is currently being used in day-to-day processes.


The admissibility of electronic records is still evolving as most organizations strive to move from paper to paperless records. However, the admissibility of electronic information is somewhat more complex, raising issues as to the methodology used in data collection and the chain of custody of the electronic data once it has been collected.

Amended Federal Rules of Civil Procedure

See “Federal Rules of Civil Procedure.”


The process of determining relevancy of electronic discovery materials through evaluation based on the variables of the case.

Application or Application Software

See “Software Application.”

Archival Data

Digital information that is retained for long-term storage, not immediately available and often stored on removable media.


A copy of data on a computer drive or on a portion of a drive, maintained for historical reference.


A memorandum, letter, spreadsheet or any other electronic document appended to another document or email.


A data characteristic that identifies it, such as type, length or location.

Audit Log or Audit Trail

A chronological record of users’ behavior: when they logged in, time engaged in specific activities, attempted security breaches.


A person or position who originated a document. Sometimes software can automatically capture the author.


A copy of active data, intended for use in restoration of data.

Backup Tape

Magnetic tape used to store copies of ESI for restoration or recovery purposes.

Batch File

Instructions defined within a file used to instruct a computer program to perform a function or series of functions.

Bates Number

Sequential numbering used to track documents and images in data sets. Each page has a unique number.

Bit/Bit Map

The smallest unit of computer data. There are 8 bits in a byte.

Boolean Search

Boolean refers to a system of logic developed by an early computer pioneer, George Boole. In Boolean searching, an “and” operator between two words results in a search for documents containing both of the words. An “or” operator between two words creates a search for documents containing either of the target words. A “not” operator between two words creates a search result containing the first word but excluding the second.

Business Risk Management

A structured approach to managing uncertainty related to a threat, through a sequence of human activities including risk assessment, strategies development to manage it and mitigation of risk using managerial resources.


The basic measurement of computer data; consists of 8 bits.


A form of high-speed memory used to temporarily store frequently accessed information. Once the information is stored, it can be retrieved quickly from memory rather than from the hard drive.

Case Deduplication

Retains only single copies of documents per case. For example, if an identical document resides with Mr. A, Mr. B and Mr. C, only the first occurrence of the file will be saved (Mr. A’s). Contrast with custodian deduplication and production deduplication.

Chain of Custody

Failure to maintain a complete chain of custody may result in the inadmissibility of electronic information.

Chain of Custody

Documentation regarding possession, movement and location of evidence from the time it was obtained to the time it is presented in court. Failure to maintain a complete chain of custody may result in the inadmissibility of electronic information.

Chain of Custody Procedure

Procedure that specifies how evidence is to be moved from location to location to preserve its integrity and prove to the court that the evidence has not been altered.

Clawback Agreement

An agreement that sets forth procedures to protect against waiver of privilege due to inadvertent production of documents or data.


Computer system that requests services from another computer system.


In operating systems that use a file allocation table (FAT) architecture, the smallest unit of storage space required for data written to a drive. Also called an allocation unit.


The process of gathering electronically stored information.

Compound Document

A file that combines more than one document into one by embedding objects or linked data. Data may be from different applications.


A technology for storing data in fewer bits, it makes data smaller so less disk space is needed to represent the same information. Compression programs like WinZip and UNIX compress are valuable to network users because they save both time and bandwidth. Data compression is also widely used in backup utilities, spreadsheet applications and database management systems.


Includes, but is not limited to, network servers, desktops, laptops, notebook computers, employees’ home computers, mainframes, the PDAs of [party name] and its employees (personal digital assistants, such as PalmPilot, Blackberry and other such handheld computing devices), digital cell phones, smartphones and pagers.

Computer Forensics

Specialized techniques to recover, authenticate and analyze electronic data.

Concept Search

Analyzing conceptual groups of words in a document to understand the true meaning, rather than searching only for a word (keyword).

Container File

One file that contains multiple documents and document types. Requires decompression or ripping to process.

Contextual Search

Searching surrounding text to analyze the context in which a word is used.

Corporate Information Governance

See “Information Governance.”

Corporate Investigations

Criminal, regulatory, securities and/or other investigations pertaining to the activities and/or electronically stored information of one or more corporations.

Cost Shifting

Shifting the cost or a portion of the cost of production of inaccessible electronically stored documents to the requesting party. Understanding where your information lives and the information governance policies and procedures in place within your organization is critical to successful arguments for cost shifting or cost sharing. Discovery requests may cover email, databases, voice mail, instant messaging systems and other proprietary applications. These systems are rapidly evolving and do not represent the same burden for all companies when making arguments for cost shifting. Implementing legal holds or producing records from traditional voice mail systems take considerable time and money; newer unified messaging systems often make responding to the same request relatively easy. Similarly, restoring records from traditional tape backup systems can be time- and cost-intensive; near-line storage, by contrast, does not present the same challenges.

Cost Shifting

Shifting the cost or a portion of the cost of production of inaccessible electronically stored documents to the requesting party.


Removing a document prior to production or review; generally reduces the volume of data that is produced or reviewed.


See “Data Custodian”

Custodian Deduplication

Culls a document if multiple copies of that document reside within the same custodian’s data set. For example, if Mr. A and Mr. B each have a copy of a specific document and Mr. C has two copies, the system will maintain one copy each for Mr. A, Mr. B and Mr. C. Contrast with case deduplication and production deduplication.

Customer-Added Metadata

Data or work product created by a user while reviewing a document. For example, annotation text of a document or subjective coding information. Contrast with vendor-added metadata.


Any and all electronically stored information (ESI) on media that may be accessed by a computer.

Data Categorization

Categorization and sorting of ESI.

Data Custodian

Person having administrative control of a document; for example, the data custodian of an email is the owner of the mailbox which contains the email.

Data Extraction

Retrieving data from documents.

Data Formats

The organization of information for display, storage or printing. Data is maintained in certain common formats so that it can be used by various programs, which may only work with data in a particular format. This term is commonly used in the industry when asking another person about the state in which particular information exists. For example, “What format is it in, PDF or HTML?”

Data Mining

The process to cull data to extract ESI for production.

Data Production

Electronic evidence must be delivered to multiple parties involved in a legal matter, including opposing counsel, partner firms, requesting government agencies and others. Depending on the recipients, you may require different delivery formats.


A set of data elements, usually stored in one location and made available to more than one user.


Screening files against the NIST list of computer file types. Separates those files generated by a user from those generated by a system.


The process of identifying (or some vendors include actually removing) additional copies of identical documents in a document collection. There are three types of de-duplication: case, custodian and production.

Deleted File

A file with disk space that has been designated as available for reuse. Although a user may “erase” or “delete” a file, what is really erased is a reference to that file in a table on the hard disk. Unless overwritten with new data, a “deleted” file can be as intact on the disk as any “active” file you would see in a directory listing.

Digital Camera

A camera that stores still or moving pictures in a digital format (JPG, GIF, etc.).

Digital Certificate

A means of providing heightened security for the access of a website or a specific document. Digital certificates are electronic records that contain keys used to decrypt information, especially information sent over a public network like the Internet. Digital certificates must be applied for and granted by a Certificate Authority (CA).


The process of identifying, preserving, collecting, processing, reviewing and producing evidence for legal review.

Discovery Compliance

Complying with the federal, state and local regulations around electronic discovery (e.g. Federal Rules of Civil Procedure).

Discovery Conference

See “Meet and Confer.”

Discovery Cost Allocation

The distribution of the costs incurred by organizations who are compelled to produce ESI.

Discovery Response

Activities performed in response to a request for discovery.

Discovery Response Plan

A plan developed to guide the activities to be taken in response to a request for discovery. A discovery response plan may be developed reactively for a specific request or may be developed proactively within highly litigious organizations to help mitigate the cost and risk of discovery with preemptive planning.

Discovery Response Team

A team of individuals assembled to coordinate and execute a discovery response plan. A discovery response team may include members from legal, IT, business management and other resources from within an organization, legal consulting vendors and outside counsel.


Includes but is not limited to any ESI preserved on magnetic or optical storage media as an “active” file or files (readily readable by one or more computer applications or forensics software); any “deleted” but recoverable electronic files on said media; any electronic file fragments (files that have been deleted and partially overwritten with new data); and slack (data fragments stored randomly from random access memory on a hard drive during the normal operation of a computer [RAM slack] or residual data left on the hard drive after new data has overwritten some but not all of previously stored data).

Document Metadata

Data stored in the document about the document. Often this data is not immediately viewable in the software application used to create/edit the document, but can be accessed via a “Properties” view. Contrast with file system metadata and email metadata.


See “Electronic Discovery.”

Early Case Assessment (ECA)

A preliminary process of estimating the risk, cost and time required to handle discovery requests for electronically stored information (ESI) in a legal case. ECA allows attorneys to review client data without the cost or time of full processing. A good ECA tool will allow an attorney to run search terms, cull data and view many reports of the data set.


See “Electronic Discovery.”


Electronic Data Discovery. See “Electronic Discovery.”


See “Electronic Discovery Reference Model.”

EDRM Metrics

The EDRM Metrics project is designed to provide a standard approach and generally accepted language for measuring the full range of electronic discovery activities. The Metrics project follows the electronic discovery process described in the Electronic Discovery Reference Model: identification, preservation, collection, processing, review, analysis and production. For each stage of the process, the Metrics project will offer guidelines for how to measure associated costs, time and volumes.


The EDRM XML project is designed to provide a standard, generally accepted XML schema to facilitate the movement of electronically stored information (ESI) from one step of the electronic discovery process to the next, from one software program to the next and from one organization to the next.

Electronic Data Discovery

See “Electronic Discovery.”

Electronic Discovery

The process of identifying, preserving, collecting, processing, reviewing and producing electronically stored information (ESI) for legal review.

Electronic Discovery Company

A company that provides e-discovery services.

Electronic Discovery Guidelines

Guidelines, rules and other procedures developed to define activities, processes and procedures in the course of preparing for or responding to electronic discovery.

Electronic Discovery Industry

The sum of productive enterprises and organizations involved in developing products and/or delivering services relating to the legal and/or other requirements of electronic discovery.

Electronic Discovery Laws

Statutes and/or precedents outlining the legal requirements of electronic discovery.

Electronic Discovery Model

See “Electronic Discovery Reference Model.”

Electronic Discovery Reference Model

The Electronic Discovery Reference Model is a framework to describe the phases of activities around electronic discovery (www.EDRM.net).

Electronic Discovery Rules

Rules outlining the legal requirements, processes and procedures of electronic discovery.

Electronic Discovery Services

Services to support the preparation for and response to litigation or investigation.

Electronic Discovery Software

Software to support the preparation for and response to litigation or investigation.

Electronic Discovery Vendor

Vendors that provide software and/or services for e-discovery.

Electronic Evidence

Electronically stored information (ESI).

Email Metadata

Data stored in the email about the email. Often this data is not even viewable in the email client application used to create the email. The amount of email metadata available for a particular email varies greatly depending on the email system. Contrast with file system metadata and document metadata.

Embedded Metadata

Text, numbers, content, data or information that is directly or indirectly input into a native file by a user and which is not typically visible to the user viewing the output of the display of the native file on screen or as a printout.


A technology that renders the contents of a file unintelligible to anyone not authorized to read it. Encryption is used to protect information as it moves from one computer to another and is an increasingly common way of sending credit card numbers over the Internet when conducting e-commerce transactions.

Enterprise Document Management

Planning, organizing, controlling and directing activities that oversee the life cycle of information across the enterprise.

Enterprise Risk Management

Enterprise risk management (ERM) includes the methods and processes used by organizations to manage risks (or seize opportunities) related to the achievement of their objectives.


See “Enterprise Risk Management.”


See “Electronically Stored Information.”

Evidence Production

See “Production.”

Evidence Review

To evaluate the collected ESI for relevance and privilege.

Federal Rules of Civil Procedure

Rules that govern the conduct of all civil actions brought in federal district courts.

Federal Rules of Evidence

Rules that govern the introduction of evidence in proceedings, both civil and criminal, in federal courts.


An element of data storage in a file system. A collection of data or information that has a name, called the filename. Almost all information stored in a computer must be in a file. There are many different types of files: data files, text files, program files, directory files and so on.

File Name

The name of a file. All files have names. Different operating systems impose different restrictions on file names. Most operating systems, for example, prohibit the use of certain characters in a file name and impose a limit on the length of a file name. In addition, many systems, including DOS and UNIX, allow a file name extension that consists of one or more characters following the proper file name. The file name extension usually indicates what type of file it is.

File Name Extension

In DOS and some other operating systems, one or several letters at the end of a file name. File name extensions usually follow a period (dot) and indicate the type of information stored in the file. For example, in the file name LETTER.DOC, the extension is DOC, which indicates that the file is a word processing file.

File System

The system that an operating system or program uses to organize and keep track of files. For example, a hierarchical file system is one that uses directories to organize files into a tree structure. Types of file systems include file allocation table (FAT) and Windows® NT file system (NTFS).

File System Metadata

Data that can be obtained or extracted about a file from the file system storing the file. Contrast with document metadata and email metadata.

Flash Drive

A portable, USB storage device that can hold between 256 megabytes and 4 gigabytes of ESI.


See “Computer Forensics.”

Form 35 (FRCP)

Report of the parties’ planning meeting in which the parties jointly propose the agreed upon discovery plan.


See “Federal Rules of Civil Procedure.”


See “Federal Rules of Evidence.”

Good Faith

A showing of good faith has always been necessary when responding to discovery or any other court-ordered instruction; however, the burden of showing good faith is now significantly greater on the part of the responding party. Attorneys cannot claim that they did not know about those backup tapes stored in a closet or have proper access to IT personnel. Counsel must have proactive conversations with ESI custodians and IT stewards to create and maintain documentation regarding what preservation actions were taken when the obligation arose, how chain of custody was assured and how both custodians and relevant ESI repositories were systematically identified.

Hard Drive

The primary hardware that a computer uses to store information, typically magnetized media on rotating discs.


The Hart-Scott-Rodino Antitrust Improvements Act of 1976 requires organizations to report specific information at the start of the merger process and to report on additional data points as part of a second request for information.

Hash/Hash Coding

Algorithm that represents a unique value, like a digital fingerprint. The process of creating a unique algorithm that is unique to every document.

Help Features/Documentation

Instructions that assist a user on how to set up and use a product including but not limited to software, manuals and instruction files.


See “Hart-Scott-Rodino.”


HyperText Markup Language, a language that uses tags to structure text into headings, paragraphs, lists and links. It tells a Web browser how to display text and images.


A phase of the electronic discovery process involving the identification of all relevant sources of electronically stored information.


See “Instant Messaging” or “Information Management” depending on context.

Imaged Copy

A “mirror image” bit-by-bit copy of a hard drive, i.e., a complete replication of the physical drive regardless of how the drive is organized or whether the image created contains meaningful data in whole or in part. From an imaged copy of a hard drive it is possible to reconstruct the entire contents and organization of the source drive from which it was taken.

Information Governance

The organizational structures and processes that ensure an accountability framework for use by IT that also support an organization’s legal objectives and strategies.

Information Management

Information management (IM) is the collection and management of information from one or more sources and the distribution of that information to one or more audiences.

Input Device

Any object which allows a user to communicate with a computer by entering information or issuing commands (e.g., keyboard, mouse or joystick).

Instant Messaging

Using non-email Internet or network-based software or services to send and/or receive text messages between one or more computers and/or mobile devices. Messages are often, but not always, stored in log files.


The convergence of globalization, technology proliferation and evolving e-discovery rules creates challenges for organizations with internationally dispersed operations. Demands from U.S. courts and government agencies often conflict with foreign privacy and data protection laws, leaving a corporation and its outside counsel uncertain of their rights and obligations.

Legal Document Management

The policies, procedures, planning and other activities around the storage and possessing of documents that may be needed for legal matters.

Legal Hold/Preservation

A legal hold is an essential element of a company’s overall records management program, particularly when it comes to electronic information. It needs to be issued to demonstrate a company’s good faith and reasonable effort to comply with its discovery obligations. The reality, however, is that the full implications of the legal hold process may not be fully understood by all parties, particularly outside the legal department. Proactive coordination and planning among corporate counsel, outside counsel, IT and other key stakeholders are imperative to ensure good faith compliance in the face of anticipated litigation.

Litigation Management

The business activities around preparing for and/or responding to litigation.

Litigation Preparation

The strategic planning and/or activities around preparing for litigation.

Litigation Readiness Consulting

Consultative services to help guide an organization in preparation for litigation.

Litigation Response Consulting

Consultative services to help guide an organization in its response to litigation.

Litigation Support

Personnel or resources that help one or more organizations prepare for and respond to litigation or investigation.

Litigation Support Services

Services to support the preparation for and response to litigation or investigation.

Magnetic or Optical Storage Media

Including, but not limited to, hard drives (also known as “hard disks”), backup tapes, CD-ROMs, DVD-ROMs, JAZ and Zip drives, smart cards, memory sticks, digital jukeboxes and floppy disks.


An area in memory or on a storage device where email is placed. In email systems, each user has a private mailbox. When the user receives email, the mail system automatically puts it in the mailbox. The mail system allows you to scan mail that is in your mailbox, copy it to a file, delete it, print it or forward it to another user. The mailbox format used by Microsoft Exchange® email systems is PST, while Lotus Notes® uses NSF files.

Meet and Confer (FRCP Rule 26(f))

A rule within the FRCP that requires parties to meet prior to a scheduling conference in federal court to discuss and agree upon discovery of information and evidence relevant to the case.

Meet and Confer 26(f) Conference

The meet and confer conference for electronic discovery has moved from a nice-to-have to a requirement under the amended Federal Rules of Civil Procedure. A major component of preparing for a 26(f) meet and confer conference is a “map” of the litigant’s ESI content: where it is, what it is, how to preserve it, how to collect it, etc. This defensive requirement can be turned into a strategic advantage when counsel is well informed as to the location and nature of ESI, as well as the costs necessary to produce it.


Internal storage areas in the computer. The term “memory” identifies data storage that comes in the form of chips, and the word “storage” is used for memory that exists on tapes or disks. Moreover, the term “memory” is usually used as shorthand for physical memory, which refers to the actual chips capable of holding data. Some computers also use virtual memory, which expands physical memory onto a hard disk. See the definitions for two types of physical memory: RAM and ROM.


Handling and processing electronic evidence present new and unique challenges that are vastly different from working with traditional printed documents. Unique among these is the handling of metadata – document attributes as to creation, modification, authorship and potentially more details based on the application used to create the electronic documents. Metadata may be used for admissibility purposes, demonstrating the chain of custody for a particular piece of ESI. It may also be used in the preservation and review processes, identifying information to be held and facilitating the culling of duplicate documents, respectively. Simply opening a file or copying it to another location may modify the hidden metadata. In order to prevent spoliation, proper methods must be used in the collection and review of electronic documents. Similarly, metadata that represents privileged information must be carefully removed prior to production. This can be a complex process requiring deep technical expertise and experience.

Native File/Format

The source document, as collected from the source computer or server, before any conversion or processing of the document.

Native Format Review (also Native Review)

Reviewing ESI using the software used to create it originally. For example, using Microsoft Word in the review process to open/review a .DOC (MS Word Document format) file.

Near Deduplication

The elimination of electives with “near duplicate” similarities, i.e., a document that was sent to multiple custodians.


A group of connected computers that allows people to share information and equipment (e.g., a local area network [LAN], wide area network [WAN], metropolitan area network [MAN], storage area network [SAN], peer-to-peer network or client-server network).

Network Operating System

Software that directs the overall activity of networked computers.


National Institute of Standards and Technology.


Optical Character Recognition, a method of translating printed text and images into a form that a computer can manipulate (into ASCII codes, for example). An OCR system enables you to scan a printed document directly into a computer file.

On-Site Electronic Discovery

Electronic data discovery services performed at the facility where the ESI is maintained.

Operating System

Software that directs the overall activity of a computer (e.g., MS-DOS ®, Windows ®, Linux ®, etc.).


To copy new data over existing data. Overwritten data cannot be retrieved.


Portable Document Format – a file format developed by Adobe Systems. PDF captures formatting information from a variety of desktop publishing applications, making it possible to send formatted documents and have them appear on the recipient’s monitor or printer as they were intended. To view a file in PDF format, you need Adobe Acrobat Reader, a free application distributed by Adobe Systems.

Personal Identifiable Information (PII)

Information that can be used to uniquely identify, contact or locate a single person or used with other sources to uniquely identify a single individual. Examples of PII are dates of birth, Social Security numbers and driver’s license numbers.


Presentation of the preserved, collected, processed, reviewed, analyzed and produced ESI at a legal proceeding.


The process of retaining and protecting all relevant evidence from destruction or deletion.


Technology, when properly applied, has the ability to rapidly increase the rate of productivity exponentially. However, when improperly utilized, small mistakes can have large-scale effects – particularly when dealing with the inadvertent disclosure of privileged documents. Clawback and quick-peek agreements may help buffer the risk, but are only partially effective. And without proper steps to maintain privilege, courts may find it has been unintentionally waived.

Privilege Data Set

A set of documents that are deemed responsive or relevant but are withheld on the grounds of privilege (work product or attorney-client).


Capturing an electronic data image or a representation of the image, generally in native format, entering it into a computer system and manipulating it so that it can be exported into a review application.


To electronically deliver ESI to a variety of recipients or for use in other systems.

Production Deduplication

Culling of a document if multiple copies of that document reside within the same production set. For example, if two identical documents are both marked responsive, nonprivileged, production deduplication ensures that only one of those documents is produced. Contrast with case deduplication and custodian deduplication.

Proximity Search

Process that searches for words or phrases within a prescribed distance of another word or phrase.


A Microsoft Outlook email storage format.

Quality Control

Process undertaken to ensure that service rendered is of quality set forth in SLA or fulfills the requirements with sufficiently high quality.

Quick Peek

ESI is made available to opposing party before being reviewed for privilege, confidentiality or privacy. Strict guidelines are required to prevent waiver.


Random Access Memory – the hardware inside a computer that retains memory on a short-term basis and stores information while the user utilizes the computer.

Record Custodian

Person responsible for the storage and protection of records throughout the record retention period.

Record Retention Policy

Policy for setting procedures around managing the life cycle of records, from creation to maintenance to disposition.

Record Retention Schedule

A formalized plan for the management of records, identifying how long records should be kept, when they should be archived and when they can be destroyed.

Records Management

Planning, organizing, controlling and directing activities that oversee the lifecycle of information.


To obscure or remove sensitive or privileged information from a document prior to production.

Repository for Electronic Records

A device on which electronic records and record metadata is stored.


The transferring of data from a back up database or other medium, to an online system, typically to recover ESI lost due to disaster or system failure.


Examination of potentially relevant data sets, or ESI, for relevancy, privilege and confidentiality in advance of production.


Read Only Memory – the hardware in a computer that that can be read but not written to. ROM contains the programming that allows a computer to boot up each time the user turns it on and essential system programs that neither the user nor the computer can erase.

Rule 16 (FRCP)

Pretrial conference – FRCP Rule 16 may provide a party with an opportunity to discuss settlement without giving the appearance of having initiated the conversation.

Rule 26 (FRCP)

General provisions governing discovery; duty of disclosure.

Rule 37 (FRCP)

FRCP 37(e), formerly 37(f), provides a safe harbor when data is lost or overwritten in the normal course of business.

Rule 502 (FRE)

The proposed Federal Evidence Rule 502 is intended to reduce the risk of forfeiting the attorney-client privilege or work product protection “so that parties need not scrutinize production of documents to the same extent as they do now.”

Rules of Civil Procedure

See “Federal Rules of Civil Procedure.”

Rules of Evidence

See “Federal Rules of Evidence.”


Testing a database or ESI to determine the frequency of relevant information.


The preservation of ESI can be costly for many large organizations. Over-preservation may result in escalating costs as information is produced at an exponential rate. Failure to preserve enough can result in a wide range of possible penalties, including monetary, issue, expert and case-related sanctions. Companies need to develop defensible processes that strike the balance between preservation and business needs. Such policies must also be effective and supportive of good faith efforts to identify and preserve potentially responsive ESI.

Second Request

Under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, certain mergers and acquisitions are subject to pre-merger antitrust review by the DOJ and FTC. In some cases the DOJ or FTC will issue requests for “additional information and documentary material relevant to the proposed acquisition.” This is typically referred to as a second request.

Seven-Factor Test

Seven-Factor Zubulake (Zubulake I, 217 F.R.D. at 322) Test for the cost of producing data from inaccessible sources; factors are listed in descending order of importance:

  1. The extent to which the request is specifically tailored to discover relevant information;
  2. The availability of such information from other sources;
  3. The total costs of production compared to the amount in controversy;
  4. The total costs of production, compared to the resources available to each party;
  5. The relative ability of each party to control costs and its incentive to do so;
  6. The importance of the issues at stake in the litigation; and
  7. The relative benefits to the parties of obtaining the information.

The difference in empty bytes of the space that is allocated in clusters minus the actual size of the files. Also described as the data fragments stored randomly on a hard drive during the normal operation of a computer or the residual data left on the hard drive after new data has overwritten some of the previously stored data.


Any set of instructions stored on computer-readable media that tells a computer what to do. Includes operating systems and software applications.

Software Application

A program that instructs a computer to perform a specific set of instructions or execute a process. Some software applications are user-driven, like Microsoft Word or Notepad, while others are system-driven like the Windows system clock or automatic virus scanning programs.


While FRCP 37(f) provides a safe harbor for routine, good faith deletion of e-discovery, FRCP 37 also provides for sanctions where the producing party fails to provide e-discovery outside of the safe harbor. In addition to sanctions, spoliation of ESI may result in an adverse inference, an award of attorneys’ fees and possibly an adverse judgment. These risks can be mitigated through documented good faith efforts to preserve potentially responsive ESI.

States Rules (of Civil Procedure)

Rules promulgated at the state level governing the procedural rules to be followed in state courts. Many states are adopting e-discovery rules, similar to the FRCP Rule 26(f), as proposed by the National Conference of Commissioners on Uniform State Laws.

Storage Device

Any device that a computer uses to store information.

Storage Media

Any removable device that stores ESI. See “Magnetic or Optical Storage Media.”

Structured Data

Data that has a structured format, such as a database.

Substantive Metadata

Data that reflects the substantive changes made to the document by the user. For example, it may include the text of actual changes to a document. While no generalization is universally applicable, system metadata is less likely to involve issues of work product and/or privilege.

System Metadata

Data that is automatically generated by a computer system. For example, system metadata includes information such as author, date and time of creation and the date a document was modified.

Tape Drive

A hardware device used to store data on a magnetic tape. Tape drives are usually used to back up large quantities of data due to their large capacity and cheap cost relative to other data storage options.

Technology-Assisted Review (TAR)

(also called Computer Assisted Review and Predictive Coding) – The use of machine learning technologies to categorize an entire collection of documents as responsive or nonresponsive, based on human review of a subset of the document collection. These technologies typically rank the documents from “most likely” to “least likely” to be responsive to a specific information request. This ranking can then be used to “cut” or partition the documents into one or more categories, such as potentially responsive or not, in need of further review or not, and so on.


Tagged Image File Format – a graphic file format used for storing still-image bitmaps. TIFFs are stored in tagged fields and programs use the tags to accept or ignore fields, depending on the application.

Unstructured Data

ESI that does not have a data structure or has a structure that is not easily readable by computer.


Universal Serial Bus. See “Flash Drive.”

Vendor-Added Metadata

Data created and maintained by the electronic discovery vendor as a result of processing the document. While some vendor-added metadata has direct value to customers, much of it is used for process reporting, chain of custody and data accountability. Contrast with customer-added metadata.


Extensible Markup Language.


Five landmark decisions on e-discovery addressing when to shift the cost of electronic discovery to the requesting party; when a company needs to begin preserving electronic evidence and what electronic evidences must be preserved; what steps must be taken to preserve and the consequences of the failure to adequately preserve electronic evidence.