AI Dictionary of Terms

eDiscovery (Electronic Discovery)

The legally defensible process of identifying, collecting, preserving, and producing Electronically Stored Information (ESI) in response to a request for production in a lawsuit, investigation, or regulatory inquiry.

The Simple Version

Finding and collecting digital evidence for a lawsuit. Instead of digging through physical filing cabinets, lawyers use specialized software to search through millions of emails, Slack messages, cloud files, and databases to find the “smoking gun” documents relevant to the case.

Detailed Explanation

Modern litigation generates petabytes of data. eDiscovery is the structured pipeline used to manage this data while maintaining a strict “chain of custody” so the evidence is admissible in court. The process typically follows the EDRM (Electronic Discovery Reference Model):

  1. Identification: Locating potential sources of ESI (e.g., employee laptops, corporate servers, personal devices under BYOD policies).
  2. Preservation: Issuing legal holds to prevent the spoliation (deletion or alteration) of relevant data.
  3. Collection: Forensically imaging the data to create exact, bit-for-bit copies without altering metadata.
  4. Processing: Extracting text, metadata, and deduplicating files to reduce the dataset size.
  5. Review & Production: Using AI (like TAR) to identify relevant/privileged documents and exporting them in standard legal formats (like load files) to opposing counsel.

Key Characteristics

Business Context

Real-World Analogy

Finding a specific needle in a haystack, but the haystack is the size of a mountain. Instead of searching by hand, you use a highly advanced metal detector (AI) that learns exactly what the needle looks like and ignores all the other metal junk.

Code Example

# Conceptual: Maintaining Chain of Custody via Cryptographic Hashing
# In eDiscovery, every collected file must be hashed to prove it wasn't altered.
import hashlib
import os

def generate_evidence_hash(file_path):
    """
    Generates SHA-256 hash of a file to ensure data integrity and chain of custody.
    """
    sha256_hash = hashlib.sha256()
    
    # Read file in chunks to handle massive eDiscovery files without memory overflow
    with open(file_path, "rb") as f:
        for byte_block in iter(lambda: f.read(4096), b""):
            sha256_hash.update(byte_block)
            
    file_hash = sha256_hash.hexdigest()
    file_size = os.path.getsize(file_path)
    
    return {
        "filename": os.path.basename(file_path),
        "size_bytes": file_size,
        "sha256_hash": file_hash,
        "status": "Integrity Verified"
    }

# In practice, this hash is recorded in the collection log. 
# If the hash changes later, the evidence is considered "spoiled" and inadmissible.
print(generate_evidence_hash("suspect_email.pst"))

Common Misconceptions

Sources & Further Reading