eDiscovery Early Case Intelligence

What This Solves

After collection, you are looking at several hundred thousand documents. Most of them are not relevant. A substantial portion are exact duplicates sitting in multiple custodians' inboxes. Hundreds of email threads are present in fragmented form, with the same conversation appearing across a dozen custodians at different stages of the reply chain. Review all of that document by document and you have weeks of attorney time spent on material the court will never see.

Early case intelligence (ECA) is the phase where GDF applies analytics and reduction techniques before a single document goes to an attorney for review. The goal is to move only the right data forward: unique, potentially responsive documents, in a form reviewers can navigate efficiently. The process is not about cutting corners. Material reduction decisions should be documented, methodology is logged, and the parameters used to exclude documents can be reproduced and explained. The reduction in review volume depends on the collection, duplicate rates and the criteria counsel approves. Report the before-and-after counts, document exclusions and review a suitable sample before relying on the reduced set. Do not assume a fixed reduction or treat analytics as proof that no responsive material was missed.

Deduplication: Global and Custodial

Hash-based deduplication is the foundation of volume reduction. Processing can compute cryptographic identifiers for collected items and should record the algorithms used. Two files with identical hash values are exact duplicates, byte for byte. One copy moves to review. The duplicate is suppressed but not destroyed: GDF maintains a cross-reference log mapping suppressed duplicates to their retained canonical copy, so that custodian-specific context is preserved if needed.

The choice between global and custodial deduplication matters, and it needs to be agreed upon with counsel before processing begins. Global deduplication removes a document from review if it appears anywhere in the collection, regardless of which custodian held it. A single copy proceeds to review. Custodial deduplication removes duplicates only within each custodian's own data set. If the same document appears in five custodians' email, all five copies proceed to review (one per custodian), because the fact that each person held the document may itself be relevant.

GDF documents which deduplication methodology was applied, the parameters used, the hash algorithm, and the resulting document counts at each stage. This documentation goes into the processing log and is available for opposing counsel review or court submission if challenged.

Email Threading and Inclusive Email Analysis

An email thread starts as a single message. By the time discovery is collected, that same conversation may exist as dozens of individual messages, each held by a different custodian at a different point in the reply chain. Later messages may repeat earlier content, but a thread can branch, omit quoted text or contain changed inline replies and unique attachments. Threading identifies messages with distinct content; it does not make the latest message a complete substitute for every earlier record.

Email threading identifies the most inclusive email in each conversation thread. A conversation can contain more than one inclusive message. Review each message identified as containing unique content and account for unique attachments and processing exceptions. Agree any suppression of repeated content with counsel and retain the source-to-review mapping. Earlier messages (non-inclusive) are flagged as thread members but can be set aside unless a specific review decision requires looking at earlier branch points separately.

Threading also handles replies, forwards, and divergent branches. GDF's threading analysis identifies where a thread splits (when someone forwards a message and starts a parallel conversation) and ensures that each branch has its own inclusive email identified. The result is a structured view of the processed conversations, not a flat list of individual messages.

Near-Duplicate Detection

Exact hash deduplication removes byte-identical files. Near-duplicate detection handles the next layer: documents that are substantially similar but not identical. A contract with a single clause changed, a draft email with one paragraph removed, or a report with an updated figure, each is a different document by hash but may require only a fraction of the review time if identified as a near-duplicate of something already reviewed.

Near-duplicate clustering can organize review, but reviewers must examine meaningful differences and validate any propagation rule. Do not copy responsiveness or privilege decisions across a cluster without the counsel-approved protocol, recorded quality checks and exception review.

Communications Mapping and Data Visualization

Communications mapping analyzes the email and message metadata across the entire collection to build a structured picture of who communicated with whom, how frequently, and during which time periods. This analysis serves two purposes. First, it helps counsel identify the most active communicators in the relevant time period, which often focuses document review on the custodians and relationships that matter most to the theory of the case. Second, it identifies unexpected communications: messages between parties who should not have been in contact, or communication patterns that are anomalous relative to the surrounding time period.

GDF delivers communications maps as visual outputs: network graphs showing communication volume and frequency between custodians, timeline charts showing communication spikes around key events, and frequency tables exportable to Excel or PDF. These visualizations support attorney strategy sessions and can be adapted for presentation to clients or co-counsel.