By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics
How Cloud Sprawl Transformed Electronic Discovery From Terabytes to Petabytes
When enterprises first migrated from local exchange servers to the cloud, legal teams hoped cloud centralization would make electronic discovery effortless. Instead, the explosion of collaborative SaaS platforms, spanning Microsoft 365, Google Workspace, Slack, Teams, Box, Salesforce and custom cloud databases, multiplied the volume and complexity of discoverable Electronically Stored Information. Exporting raw cloud vaults without forensically sound filtering and conversational threading buries trial teams in millions of duplicate notifications, broken hyperlink attachments and unreviewable database tables.
Controlling Discovery Costs With Targeted Cloud Collection and eCloud Discovery
Global Digital Forensics combines veteran cloud forensic engineers with our eCloud Discovery and CompleteDiscovery platforms to bring predictability and cost control back to complex litigation. Working directly for retained litigation counsel and corporate legal departments, we execute targeted, API validated cloud collections that preserve full metadata and modern attachment versions without over collecting irrelevant system noise. Our analytics engine then applies global deduplication, email and chat threading and technology assisted review to reduce reviewable document populations substantially before attorneys bill a single review hour.
A Collection Walked from Export to Review
Consider a contract dispute with six custodians in Microsoft 365, two shared Teams channels and a Slack workspace the sales team adopted on its own. Scoping with counsel fixes the custodians, the date range and the search terms, and identifies the Teams channels and Slack channels where the deal was discussed. Collection then runs through the platforms' administrative and API interfaces rather than through the custodians: mailboxes are exported with their folder structure and message metadata, Teams messages are exported with their channel context and the files that modern attachments point to, and Slack is exported from the workspace with user and channel maps so a message can be attributed to a person and a conversation. Every export is hashed on arrival and logged. Our cloud collections practice and the guide to preserving Teams, Slack and email together describe the platform specific steps.
Processing is where the raw export becomes reviewable. Each item is given a hash of its content so that the same message collected from a sender's and three recipients' mailboxes is recognized once, with a record of every custodian who held it, which lets reviewers code it a single time while the production still reflects who had what. Email is threaded so a reviewer reads the final message in a chain with its history visible rather than fifteen fragments of the same conversation. Chat is reassembled into conversations by channel and time window, because a Slack export is a stream of individual messages that mean nothing out of order. Attachments that arrived as links to SharePoint or OneDrive are resolved to the document as it existed when it was shared, where the platform allows, and flagged where it does not. Our eCloud Discovery platform performs these steps on infrastructure we own.
Review receives a population that is smaller, organized and traceable. Search terms and date filters are applied on processed text rather than on raw exports, so a term that appears in an attachment is found. Technology assisted review, where counsel elects it, prioritizes what the reviewers see first. Every document in the review set carries its path back to the export and the hash taken at collection, so when a production is challenged the answer is in the log rather than in anyone's memory. CompleteDiscovery carries the matter from that point through review and production, and because GDF owns its software and hosts the processing, the workflow is scaled to small and midsize matters that cannot absorb enterprise platform minimums.
Rule 26 Proportionality and the Rule 37(e) Duty in the Cloud
Two Federal Rules of Civil Procedure frame every cloud collection. Rule 26(b)(1) limits discovery to what is "proportional to the needs of the case," considering among other things the importance of the issues, the amount in controversy, the parties' access to the information and whether the burden outweighs the likely benefit. Cloud platforms make it easy to export everything and expensive to review it, so proportionality is where the collection design is argued: which custodians, which channels, which dates, and whether chat is in scope at all. A written collection plan that states those choices and the reasons for them is what a party produces when the other side says too little or too much was collected.
Rule 37(e) governs what happens when electronically stored information that "should have been preserved in the anticipation or conduct of litigation" is lost because a party "failed to take reasonable steps to preserve it." In the cloud the usual failure is a retention policy that kept running after the duty attached, deleting chat after a set period or purging a departed employee's mailbox, and the fix is a hold applied in the platform the day the duty is recognized, documented with who applied it and to what. Our eDiscovery collections practice confirms holds are in place before any export begins, because an export of a mailbox that is still being pruned is a snapshot of a shrinking record.
What a Cloud Export Represents
An export is the platform's answer to a request, not a forensic image, and counsel should know what it leaves out. A Teams or Slack message that was edited exports in its final form unless the platform retains versions and the export requests them. A modern attachment is a link to a document that may have changed since it was shared, and the version the recipient saw may no longer exist. Reactions, read receipts and mentions are exported inconsistently across platforms. Deleted items survive only as long as the platform's recoverable items or retention settings allow. Where a question turns on what a document said at the moment it was sent, the examiner looks to version history, audit logs and the recipient's own copy rather than the export alone, and our cloud and SaaS forensics practice takes over when the question is forensic rather than discovery.
Audit logs are the other half of the record and they expire on their own schedule. Microsoft documents a default retention of 180 days for the unified audit log under standard licensing on its audit retention page, and Google's data retention table for Workspace lists six months for most log event types with shorter periods for some. Those logs show who accessed, shared, downloaded or deleted a document and when, which is often the question in a trade secret or departure matter. Exporting them at the start of the engagement, even when the case seems to be about the documents, is a small step that preserves the ability to answer a question counsel has not asked yet.
Costly Errors in Cloud Collections and How the Engagement Avoids Them
Custodian self collection is the most expensive error, because the custodian forwards or downloads what seems relevant, strips the metadata in the process and leaves the other side free to argue that the selection was interested. Exporting entire tenants without a scope is the opposite error and produces a review bill the matter cannot bear. Forgetting that chat exists, or that the sales team used a tool IT never approved, leaves a gap that surfaces when the opposing party produces the messages. Collecting from the platform after a departed employee's license was removed, when the mailbox has already been purged, is a Rule 37(e) problem that a hold would have prevented.
The engagement avoids these by sequence. Holds are confirmed before export. A written collection plan fixes scope and states its reasons. Collection runs through administrative interfaces with hashes and logs. Processing deduplicates, threads and resolves attachments before any reviewer sees a document. The collection report accompanies the production so every question about what was collected and how has a documented answer. Our massive data discovery case study shows the approach at scale, and the first call to (800) 868-8189 is where the scope conversation starts, usually with the question of which platforms the custodians actually used rather than which ones IT thinks they used.
Streamline Your Next Cloud eDiscovery Matter
Read our guide to reconciling Teams, Slack and email collections before review, or call Global Digital Forensics at (800) 868-8189 to schedule a live demonstration of eCloud Discovery and scope your collection. The initial consultation is free.
A Cloud Collection Walked From Export to Review
The guide walks a six custodian matter from export through processing to review. This table lays out those stages, what happens at each and the gain it produces, so counsel can see where over collection is prevented and where review cost is reduced before a single review hour is billed. Read the gain column as the reason processing precedes review. An export is the platform's answer to a request, not a forensic image, and the audit logs that show who accessed a document expire on their own schedule.
| Stage | What it does | Gain it produces |
|---|---|---|
| Scoping with counsel | Fixes custodians, dates, terms and channels | Collection proportional under Rule 26(b)(1) |
| Hold confirmation | Applies holds before any export | Stops retention policies pruning the record |
| Collection through admin and API | Exports mailboxes, Teams and Slack with metadata | Full metadata and modern attachment versions preserved |
| Global deduplication | Recognizes one message held by several custodians | Coded once while the production still shows who held it |
| Threading | Reassembles email and chat into conversations | A reviewer reads one thread, not fifteen fragments |
| Attachment resolution | Resolves links to the version shared | The document as the recipient saw it, where retained |
| Review with filters and assisted review | Applies terms to processed text | A smaller, organized and traceable population |
The massive data discovery case study describes extracting emails and documents with metadata and correlating them into reviewable batches and timelines, the targeted collection and threading this guide brings to cloud sprawl.
How to Begin and What Happens on the First Call
Have the list of custodians and the platforms they used, including any chat or file sharing tools adopted outside IT, the date range and the issues in dispute, the status of any legal holds and the production deadlines. The examiner will ask whether retention policies are still running, whether any custodian has left and what happened to that account, who administers each tenant and at what licensing tier, whether the other side has proposed a protocol and what review platform counsel prefers. You receive a written collection plan with its scope and reasons, a timing estimate for collection and processing and a proposal. The initial consultation is free. Call (800) 868-8189 at any hour.
Sources and Related Reading
Authorities cited in this guide: Federal Rule of Civil Procedure 26. Subdivision (b)(1) sets the proportionality factors that bound the scope of discovery, Cornell LII text of the rule. Federal Rule of Civil Procedure 37. Subdivision (e) governs lost electronically stored information, Cornell LII text of the rule. Microsoft Purview audit log retention policies. Documents the default 180 day retention and longer options for the unified audit log, Microsoft Learn as read in October 2026. Google Workspace data retention and lag times. Lists retention periods for Workspace audit log event types, Google Workspace Admin Help as read in October 2026.