SDNY Preservation, Collection, Processing and Production
Make the SDNY Production Deadline Without Losing the Record
Southern District matters run on the schedule the assigned judge sets, while the record sits across mailboxes, Slack and Teams, trading systems and custodians' phones. Global Digital Forensics preserves the short lived sources first, collects at the source with hash verified logs and delivers productions in the form the receiving party actually loads. Every volume reconciles to a manifest that can go in front of the court.
The engagement
From Hold Notice to Production in One Chain
Call the New York office at (212) 561-5860 or the 24/7 hotline at (800) 868-8189 as soon as a hold issues. Southern District matters, from commercial disputes to securities and financial enforcement, carry substantial electronic records: Microsoft 365 and Google Workspace tenants, Slack and Teams workspaces, structured data from ERP and trading systems, personal device data collected under a targeted protocol and the cloud audit logs that show who did what and when. Global Digital Forensics has supported litigation teams since 1992, and our experience includes federal district court, multidistrict litigation, arbitration and ITC Section 337 proceedings.
We carry the technical side of an SDNY matter from start to finish: preservation on notice, collection at the source, processing that respects the production form obligations of Rule 34, loading to the review platform the firm selects or hosting on GDF's own platform, production in the form the receiving party actually uses and, where the matter requires it, expert testimony on the technical record. GDF owns its software and uses internal tools to keep processing and hosting proportionate for small and midsize matters as well as large ones.
The engagement is scoped at the start against the assigned chambers' individual practices and the Rule 26(f) discussion, so preservation and collection do not run past what the matter needs, and where discovery is referred to a Magistrate Judge the scope follows that judge's ESI practice. In COMLAB v. Kal Tire in this district, the court accepted Joseph Caruso as an expert in computer forensics and computer science at an evidentiary hearing on disputed emails, described his testimony as highly credible and found by clear and convincing evidence that the emails had been fabricated.
Once chambers has set the schedule, send the scheduling order and the custodian list and we will map preservation, collection and production to its dates.
Scope
Legal holds and preservation
We work from counsel's hold instructions and custodian list. Custodian interviews identify the records that exist, administrators confirm which licensed workloads support a hold or export, and the configured controls are documented separately from the short retention activity logs that need their own collection.
Collection at the source
Custodian phones are collected with forensic tools that respect current platform constraints, including supported remote collection through a link so the custodian keeps using the phone, and cloud mailboxes, chat, files and administrator logs are collected through first party interfaces where possible and vetted connectors where not. Every collection carries its method, its hash values and its known gaps.
Processing and analytics
Deduplication by hash and by email thread, near duplicate and thread suppression, technology assisted review workflows where the matter supports them, foreign language identification and translation staging, and normalization of structured ERP and trading data so it can be reviewed and produced.
Review platform loading and hosting
Loading to the selected platform, or hosting on GDF's own platform, with access restricted to the review team counsel names and audit trails covering every access event.
Production
Load files matching the receiving party's specifications, images with searchable text, native production where the record requires it for spreadsheets, presentations and source code, and slip sheets for withheld and redacted documents.
Expert support on the method
Where the collection or production method is challenged, GDF provides the technical record and, where retained for it, expert testimony on the method, written so a judge can follow every step.
Evidence commonly reviewed
The Record We Keep on Every Source
Chain of custody records cover every collected source, and collection logs record the tool version, the target and the hash for every image or export. Processing manifests record deduplication and near duplicate counts, load file specifications and production manifests record what left the building and in what form, and audit logs record every access to a hosted review workspace.
What you receive
Deliverables Built to Serve as Exhibits
Preservation notice templates aligned to Rule 26(f) practice, collection reports written to serve as exhibits to a Rule 26 filing, processed data loaded to the review platform of record, production sets in the form the receiving party accepts and, where the matter requires it, an expert report on the collection or production method.
If the method is likely to be challenged, ask now who would testify to it. COMLAB v. Kal Tire shows what that testimony looked like in this district.
Engagement workflow
Five Stages, One Reconciled Manifest
Preservation
We scope preservation to the actual custodians, sources and relevant period, confirm the authorized Microsoft Purview, Google Vault or Slack retention controls for the licensed environment and record what was configured and what it covers. Independently expiring audit and endpoint events are collected where available. A hold notice, a configured hold and a successful export are three different records, and the preservation log shows each one separately so nobody mistakes one for another.
Collection
We select a supported collection method for each source and question, because an endpoint image, a targeted export, a backup and a mobile acquisition differ in coverage and in their effect on the source. Original output, acquisition logs, integrity checks and known gaps are preserved, live activity and transformations are recorded, and the report states exactly what each hash verifies: the integrity of the collected set.
Processing
Collected data runs through file identification, text and metadata extraction, deduplication and near duplicate analysis, email threading and language identification. Processing manifests record what was ingested, what was excluded and why and what was promoted to review, and exceptions such as encrypted containers, corrupt files and unusual formats are logged and reported rather than silently dropped.
Review support
Review is hosted on the platform the legal team chooses or on GDF's own platform. We configure searches and workflows to the review team's specification and produce workspace access reports and audit logs so the record of who accessed what and when is preserved. Where technology assisted review is used, the training methodology and the validation statistics are captured for the record.
Production
Production is prepared in the agreed form with matching load files, Bates numbering, confidentiality endorsements, checked redactions and privilege logs to counsel's specification, and the manifest supports delivery checks. Where counsel supplies a Rule 502(d) order or clawback protocol, the manifest and review record support the agreed correction and notice process.
Each stage above reconciles to the one before it, which is what lets the producing party answer a Rule 37 question from the manifest rather than from memory. Call (800) 868-8189 to walk through the manifest format for your matter.
Frequently asked
Answers for Southern District Litigators
If our collection method is challenged at a Rule 37 hearing, can you explain it?
Yes. Where the collection method is challenged, GDF provides the technical record and, where retained for it, expert testimony on the method. Chain of custody records, collection logs and hash evidence are prepared so they can be put in front of the court, and the examiner who ran the collection explains them from the stand.
How do you handle mobile device collections in SDNY?
Mobile collections are commonly performed under a targeted protocol so only the relevant data is extracted. Supported remote collection through a link lets the custodian keep using the phone, and where a device cannot be surrendered a filtered logical extraction or a cloud backup extraction can be used. The scope is set with counsel before collection begins.
Do you host on Relativity, or on your own platform?
Either. GDF loads to the review platform the producing firm or the receiving party selects, or hosts the review on its own platform using the software the firm owns. Where hosting on the receiving party's platform is preferred, we deliver the processed data in the form that platform accepts.
How do you handle a rolling production schedule?
Rolling productions are scheduled against the Rule 26(f) discussion and the chambers' individual practices. Each volume is delivered with its own production manifest, and the load file is written so the receiving party can ingest volumes incrementally.
Can you support a Special Master's ESI protocol?
Yes. Where a Special Master enters an ESI protocol, collection, processing and production workflows are designed to what the protocol actually requires, and the technical record is prepared for reporting to the Special Master.
Test the Handoff Against the Order Before Volume One
A production plan starts with the actual order and the assigned chambers' practices. Identify the custodians, the source owners, the permissions, the date range, who is responsible for privilege review and the receiving system before anyone talks about tools.
For a tenant source we confirm the current license, the permissions, the export fields, the attachments, the hold settings and the audit retention. For a device or file source we identify encryption, collection depth, native files and the categories that are unavailable. Our manifest shows source and delivered item counts, attachment families, timestamp fields, hash values and exceptions, and an authorized sample is used to test load file mapping, natives and searchability with the receiving reviewer before production.
The population reconciliation sits beside the production specification: originals collected, exact duplicates suppressed, families retained and items withheld pending review. The receiving team validates field mapping and searchability on the sample, and any further collection or correction cycle gets its own dated entry.
United States District Court for the Southern District of New York · Microsoft Purview eDiscovery documentation
Bring the receiving party's production specification to the planning call, and we will test the handoff against that specification before the first volume is cut.
Talk with an examiner
Scope the SDNY Collection Before the Rule 26(f) Conference
Tell us the custodians, the sources, the assigned chambers and the production date. A senior examiner will discuss scope and sequence, and the initial consultation is free and confidential.
Since 1992 · 24/7 dispatch · Court tested experts
What happens next
Send the Scheduling Order and Custodian List
On the first call a senior examiner reviews the order, the custodians and the sources, says what needs preserving today and lays out a collection and production sequence that meets the dates. The consultation is free and confidential.
24/7 hotline: (800) 868-8189
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .