eDiscovery Identification

We create a data map of the IT systems in question to locate potential sources of relevant ESI.

The goal of the e-discovery identification stage is to determine the scope, depth, and breadth of the ESI investigation. In this stage, e-discovery investigators figure out how much ESI is relevant and which form the relevant ESI takes, determine how it should be collected and preserved, and take steps toward inventorying the relevant ESI.

eDiscovery Identification Services

We conduct interviews with IT personnel & data custodians to create a preliminary plan for the upcoming preservation & collection stages of e-discovery.

To do this, our e-discovery investigators first create a data map of the IT systems in question to locate potential sources of relevant ESI. We also conduct interviews with IT personnel and data custodians to create a preliminary plan for the upcoming preservation and collection stages of e-discovery.

  • Meet and Confer Conference (FRCP Rule 26(f)) consulting
  • Data Mapping of complex IT Systems
  • IT/Custodian Interviews
  • Verification of third party data maps and data disclosures

We can assist you with FRCP Meet & Confer consultation as related to FRCP 26(b)(1).

Where Does ESI Come From? Potentially Relevant Sources of ESI

Every case is different, and the potential sources of ESI will vary depending on the situation. The question of whether or not a specific source of ESI is valid to an e-discovery situation has a different answer for every case and every client. That said, there are some common sources of ESI which an e-discovery consultant will often focus on during the identification stage. Below is a list of the most common sources of ESI.


This is ESI created by communications between individuals or within groups, such as text messages, phone calls, voicemails, and emails. ESI such as recorded calls and voicemails can be found directly on the communication device or saved to VOIP servers. Communications-based ESI includes locally stored emails on computers, smart phones, and tablets, such as Outlook PST and OST files, as well as server stored emails, are an often-relevant source of ESI. The records produced by chat applications and videoconferencing systems such as Skype, Slack, Google Hangouts, and Zoom can also prove relevant sources of ESI.

Local Network Resources

Data stored on local network resources for the entity in question such as file shares, NAS devices and file servers, and servers such as DNS name and VPN servers can also prove to be relevant ESI to a legal expert. Database and application servers for the business or organization, such as SQL, Oracle, MySQL, and MongoDB databases may also provide a wealth of relevant ESI for e-discovery consultants.

Cloud Services

Like local network resources, relevant ESI can also be stored on the cloud. This includes cloud-based file storage and sharing services such as Google Drive, Dropbox, Office 365, and iCloud. Other cloud services like Amazon Web Services and Salesforce could also potentially hold relevant ESI in an investigation.

Local Files

Office documents (.doc, .xls, .ppt, etc.), image files (.jpg, .png, .tiff, .gif, etc.), audio and video files (.mov, .mp4, .avi, etc.) and email files (.pst, .ost, .eml, .msg, etc.) can be a potentially relevant source of ESI, depending on the situation. Whatever any sort of file contains could possibly count as relevant and necessary ESI, whether that file is a PDF document, a JPG image, or one of a computer’s application or system files.

Removable Storage Devices

Portable and removable data storage devices can contain a wealth of relevant ESI. These devices include external hard disk drives and SSDs, USB flash drives, SD and microSD cards, CDs and DVDs, and even floppy disks and zip disks.

Data Backup Systems

Backup systems can hold relevant ESI, and can prove especially useful to e-discovery investigators in instances where the original data has somehow been lost. Backup systems can take many forms. Local backups, in the form of an on-site backup device, a data center, or a tape archive, can host relevant ESI. Relevant ESI can also live on cloud-based backup systems, such as those provided by Storagecraft, Barracuda, Carbonite, and other backup service providers.


Contact our experts for free