SDNY
eDiscovery in the Southern District of New York
Preservation, collection, processing, review support and production for matters in SDNY. Workflows are designed to the Federal Rules of Civil Procedure and to the schedule the assigned chambers actually sets.
The engagement
What the SDNY eDiscovery engagement covers
Southern District of New York matters include commercial and financial-crime cases with substantial electronic records. Matters commonly involve a mix of Microsoft 365 and Google Workspace tenants, Slack and Teams workspaces, structured data from ERP and trading systems, personal-device data collected under a targeted protocol, and cloud audit-log evidence.
GDF supports SDNY matters end to end on the technical side: preservation on notice, defensible collection at the source, processing that respects the FRCP Rule 34(b)(2)(E) production form obligations, review-platform loading (Relativity, Reveal, Everlaw, Nuix Discover, DISCO), production in the form the receiving party actually uses, and, where the matter requires it, expert-witness testimony on the technical record.
The engagement is scoped up front against the SDNY chambers' individual practices and the Rule 26(f) discussion, so preservation and collection do not run past what the matter actually needs. Where the case is assigned to a Magistrate Judge for discovery, the scope follows that Magistrate's ESI practice.
Scope
Legal holds and preservation
Counsel directs the hold instructions and affected custodians. Source interviews identify the available records; authorized administrators confirm which licensed workload supports a hold or export. Document configured controls and exceptions separately from short-retention activity logs, which may need their own collection.
Defensible collection at the source
Custodian mobile devices (iOS and Android) collected with forensic tools that acknowledge modern platform constraints (Advanced Logical, checkm8 where the device supports it, cloud-backup extractions, third-party app data where present). Cloud mailboxes, chat, files and admin logs collected via first-party APIs where possible, third-party connectors where not.
Processing and analytics
Deduplication (MD5 and email-thread), near-duplicate and email-thread suppression, technology-assisted review workflows (continuous active learning where the matter supports it), foreign-language identification and translation staging, and structured-data normalization for ERP and trading data.
Review-platform loading and hosting
Loading to Relativity, Reveal, Everlaw, Nuix Discover, DISCO or the receiving party's chosen platform. Where GDF hosts the review, access is controlled to the review team specified by counsel and audit trails cover every access event.
Production
Load files (Concordance DAT, Relativity RDX, EDRM XML) matching the receiving party's specifications. TIFF with searchable text, native production where the record actually requires it (spreadsheets, presentations, source code), and slip-sheeting for withheld and redacted documents.
Expert-witness support
Where the collection or production method is challenged, GDF provides the technical record and, where retained for it, expert testimony on the underlying method.
Evidence commonly reviewed
Evidence reviewed
- Chain-of-custody records for every collected source
- Collection logs (tool version, target, hash) for every image
- Processing manifests with dedup and near-dup counts
- Load-file specifications and production manifests
- Audit-log evidence for every hosted-review access event
What you receive
Deliverables
- Preservation notice templates aligned to Rule 26(f) practice
- Collection reports usable as exhibits to a Rule 26 filing
- Processed data loaded to the review platform of record
- Production sets in the form the receiving party accepts
- Where required, an expert report on the collection or production method
Engagement workflow
How the engagement runs
Preservation
Scope preservation to the actual custodians, sources and relevant period. Confirm authorized Microsoft Purview, Google Vault or Slack retention controls for the licensed environment, then record what was configured and what it covers. Collect independently expiring audit and endpoint events where available. A hold notice, configured hold and successful export are different records, and none establishes complete preservation by itself.
Collection
Select a supported collection method for each source and question. An endpoint image, targeted export, backup or mobile acquisition can have different coverage and source-change effects. Preserve original output, job or acquisition logs, method-specific integrity checks and known gaps. Record live activity, transformations and inaccessible data; a matching output hash does not prove the source was unchanged or every relevant record was acquired. Agree unusual vendor or application methods before collection.
Processing
Processing runs the collected data through a defensible pipeline: file identification, text and metadata extraction, dedup and near-dup analysis, threading of email conversations, and language identification. Processing manifests record what was ingested, what was excluded and why, and what was promoted to review. Where the ESI protocol specifies exception handling (encrypted containers, corrupt files, unusual formats), the exceptions are logged and reported to counsel rather than silently dropped.
Review support
Review is generally hosted on a platform of record chosen by counsel (Relativity, Everlaw, DISCO, Reveal, Nextpoint). GDF hosts the data on the platform, configures searches and workflows to counsel's specification, and produces workspace access reports and audit logs so the record of who accessed what and when is preserved. Where technology-assisted review (TAR/CAL) is used, the training methodology and the validation statistics are captured for the record.
Production
Production is prepared in the agreed form, with matching load files, Bates numbering, confidentiality endorsements, checked redactions and privilege logs to counsel's specification. The manifest supports delivery checks. Where counsel supplies an applicable Rule 502(d) order or clawback protocol, the manifest and review record support the agreed correction and notice process. Counsel determines waiver protections.
Frequently asked
Common questions on SDNY eDiscovery
Can you defend the collection method at a Rule 37 hearing?
Yes. Where the collection method is challenged, GDF provides the technical record and, where retained for it, expert testimony on the method. Chain-of-custody, collection logs and hash evidence are prepared to be put in front of the court.
How do you handle mobile-device collections in SDNY?
For SDNY matters, mobile-device collections are commonly performed under a targeted protocol so only the relevant data is extracted. Where the device cannot be surrendered, a filtered logical extraction or a cloud-backup extraction can be used. The scope is set with counsel before collection begins.
Do you host on Relativity, or on your own platform?
GDF hosts on Relativity, Reveal, Everlaw, Nuix Discover, DISCO or on the receiving party's chosen platform. Where hosting on the receiving party's platform is preferred, GDF delivers the processed data in the form the receiving platform accepts.
How do you handle a rolling production schedule?
Rolling productions are scheduled against the Rule 26(f) discussion and the chambers' individual practices. Each rolling volume is delivered with its own production manifest, and the load file is written so the receiving party can ingest volumes incrementally.
Can you support a Special Master's ESI protocol?
Yes. Where a Special Master enters an ESI protocol, collection, processing and production workflows are designed to what the protocol actually requires and the technical record is prepared for reporting to the Special Master.
Test the handoff against the SDNY order
A production plan starts with the actual order and assigned chambers' practices, not a platform name. Identify custodians, source owners, permissions, date range, privilege-review responsibility and the receiving system.
- For a tenant source, confirm current licence, permissions, export fields, attachments, hold settings and audit retention.
- For a device or file source, identify encryption, collection depth, native files and unavailable categories.
- An illustrative manifest can show source and delivered item counts, attachment families, timestamp fields, hash values and exceptions.
- Use an authorized sample to test load-file mapping, natives and searchability with the receiving reviewer before production.
Keep the population reconciliation beside the production specification: originals collected, exact duplicates suppressed, families retained and items withheld pending review. The receiving team should validate field mapping and searchability on the sample. Any additional collection or correction cycle is documented rather than silently treated as part of a successful initial export.
Court information and current practices · Microsoft source, access and licensing guidance
Talk with an examiner
Talk with the local team
Tell us where the people, devices or retaining team are located and the matter you need help with.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189