Early Case Assessment, Search Testing and Communication Mapping

Know What the Collection Holds Before Review Begins

The collection is in, the clock is running and the review estimate is larger than the dispute. Global Digital Forensics tests the searches, collapses duplicates and threads, groups near identical versions and maps who talked to whom, on analytics software we own. Counsel sets strategy and budget from counts, samples and relationships drawn from the record itself rather than from raw volume.

Get a Free Consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

A Review Estimate Built on Volume Is Usually Wrong

A review budget built from the raw collection size counts every duplicate, every quoted reply and every version of the same draft as a document to be read. It also says nothing about who was talking to whom, when the critical conversations happened or whether the key terms appear where everyone assumed they would. Early case intelligence replaces those assumptions with counts, samples and relationships drawn from the collection itself.

We report the starting and remaining population counts for each operation, the duplicate identity rules, the custodian associations, the family treatment and samples of the items excluded, and the scope and the validation are agreed before anything leaves the review set. Email thread analysis checks the text, the branches, the changed replies and the attachments, because the latest message does not always carry the whole conversation and several messages may need review. The link between the original and the review record is preserved throughout, and every processing exception is logged by file, so nothing leaves the population without a record.

Primary references: Microsoft email threading analytics.

Holding a review estimate built from the raw gigabyte count? Send it with the collection summary and a senior examiner will tell you what deduplication and threading are likely to leave to read.

Get a Free Consultation

Technical methods and scope

Focus Review Effort on the Evidence That Decides the Case

Large collections repeat the same file across custodians and carry many overlapping versions of a single conversation. Before committing review resources, the trial team needs to understand those relationships and the volume that bears on the actual questions in the case. We assess the collection rather than assume a fixed share of it is irrelevant, and the reduction we report is the one the data supports.

Global Digital Forensics has served clients since 1992, from AmLaw 100 firms to small businesses, and the analysis runs on software we own, which lets us apply search, threading, similarity and communication analysis to the collected record at a cost scaled to the matter. We record counts, exclusions and sample results before anyone relies on a narrower set, so the evidence and the decisions stay traceable from the first search to the last production.

Choose Global or Custodian Deduplication With Your Eyes Open

We use the recorded hash algorithm and identity rules to compare collected items and suppress duplicate review copies under the agreed protocol. Suppressed items are retained with a cross reference to the review copy, so custodian associations and source context remain available when a reviewer needs to know who else held a document.

Counsel chooses between global and custodian based deduplication before processing, and the choice matters. Global treatment sends one copy to review while retaining its custodian associations; treatment within each custodian keeps one copy per person. If five custodians held the same memorandum, the second approach keeps five review copies, because possession by each of them may be the point of the case.

We document which methodology was applied, the parameters, the hash algorithm and the resulting document counts at each stage. That documentation lives in the processing log and is available to the other side or the court if the reduction is challenged.

Ask a discovery specialist how this fits your matter; the first consultation is free.

Find the Distinct Content in Email Threads

A single conversation can exist in dozens of messages and branches, with quoted text omitted, inline replies changed and unique attachments scattered along the way. We organize those relationships so reviewers examine the distinct content once, rather than reading the same exchange in every message that quoted it.

Threading identifies the inclusive messages that contain distinct content, which can include several branches within one conversation. We account for unique attachments and exceptions, preserve the links from original to review record and apply the agreed review protocol before any repeated content is set aside, and earlier messages remain identified for review wherever the decision requires them.

We also identify replies, forwards and divergent branches, including the forwarded message that quietly starts a parallel exchange with someone outside the original thread. The resulting view shows the reviewer which inclusive messages represent each branch, which is often where the case turns.

Compare Similar Versions and See What Changed

Similarity analysis groups documents that differ despite sharing most of their content, such as a contract with one altered clause, an email with a paragraph removed or a report with a revised figure. Seeing the versions side by side lets reviewers find the meaningful change instead of rereading identical pages.

Reviewers examine the differences and validate any rule for carrying decisions across similar items. Responsiveness and privilege decisions follow the attorneys’ protocol, with quality checks and exceptions recorded for each cluster so the shortcut can be explained later.

Send the custodians and the deadline and the first call sets the collection plan.

See Who Talked to Whom, and When

Communication mapping uses retained email and message metadata to show accounts, contact frequency and the periods in which people were in touch. It identifies the active relationships and the changes around the dates that matter, including unexpected contacts that deserve examination in context. The pattern points reviewers to the conversations worth reading first.

The visual record can include relationship graphs, event timelines and frequency tables exported to Excel or PDF. Attorneys use them to discuss the evidence with clients and colleagues and to select the records that need closer review. Call (800) 868-8189 to talk through the collection before the review budget is committed.

Before that call, the digital forensics process guide shows how an examination moves from collected records to findings and what an early pass can tell you.

Methodology

From Collected Records to a Focused Review Set

Map sources and relevant custodians

We align the analysis with the custodians, sources, dates and data types in the collection, so the early legal questions guide the review population rather than the other way round.
Preserve source context

We preserve the source context, owners, dates and known exceptions while preparing the analytical set, so every item can be traced back to where it came from.
Analyze the agreed material

We apply deduplication, threading, similarity analysis and communication mapping under the agreed protocol and reconcile every exception, so the population entering review is documented.
Deliver a documented review package

We validate the agreed review package and retain the processing record, so reviewers can trace each selection to its original and counsel can defend the reduction.

If you want these four steps reported stage by stage to the client, call (800) 868-8189 and we will agree on the counts, the samples and the approvals the legal team will see.

Evidence commonly examined

Discovery records we analyze

Custodian and source inventories identify the population behind the analysis, and Microsoft 365 and Google Workspace supply the suite records that most often form the review set. Collaboration and messaging records require their conversation relationships preserved during processing, computers, phones and file shares add local content and versions, and database and structured exports supply business records that need normalization and review context. The collection, processing and exception logs account for every item that entered or was excluded from the analysis.

What you can expect

Your analysis, review set and processing record

The data map and scope record define the early analysis population and the questions it serves. Processing and collection logs document the handling and the analytical operations performed, the exception and reconciliation report records population changes and unresolved processing issues, and the agreed package gives reviewers organized material with its supporting audit record.

The data discovery case study shows these deliverables at class action scale, where millions of documents and emails had to be correlated into batches and timelines before anyone could read them.

Test the Collection Before You Commit the Review Budget

Use a free initial consultation to discuss the early decisions, the collection size, the review deadline and sample material. We will identify which analyses will focus the review and how the results will be documented.

Ask which examiner would run the analysis and report to the client; the team and their credentials are on the About page, and the data discovery case study shows the kind of record that analysis produces.

Get a Free Consultation

Frequently asked

Early Decisions, Deadlines and Deduplication

What decisions should early case analysis support?

Define the decisions that have to be made first, the relevant dates and the sample material available, then agree which analyses will help assess the record. The scope follows those decisions rather than a standard menu.

What determines the price of early case analysis?

The size of the collection, the analyses selected, the hosting duration and the review and production that follow shape the cost. GDF owns its software, so the analysis is scaled to the matter, and the itemized scope states recurring charges and change approvals before work begins.

Can you deliver the results into our existing review platform?

Yes. Name the platform, the formats and the tasks your team retains, and we confirm compatibility, transfer methods and responsibilities so the focused set loads with its threading, duplicate and similarity fields intact.

What if the review deadline is already close?

Call (800) 868-8189 with the deadline, the data sources and the current status. We discuss availability, priorities and a realistic sequence of analysis so the most useful results reach the trial team first.

How much will deduplication and threading remove?

That depends on the collection, which is why we measure it instead of quoting a percentage. The report shows the starting count, the count after each operation and samples of what was set aside, so the reduction is visible before review is staffed.

Talk with an examiner

Understand the Evidence Before Expanding Review

Share the collected sources, the review budget and the first decisions the case calls for. We discuss search testing, threading and samples before the review expands, and the first consultation is free.

GDF has practiced since 1992 and offers court tested forensic expertise.

Talk with an examiner

Send the Review Estimate to a Senior Examiner

Send the collection size and the review estimate ahead of a free first call, and a senior examiner will tell you which analyses will shrink the set and how the results will be reported to the client.

Call (800) 868-8189 Get a Free Consultation

For early case analysis, call (800) 868-8189.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.