Email Preservation Guide for Litigation Case Teams
An email dispute rarely begins with a neat set of messages. It begins with an employee’s mailbox that continues receiving mail, a forwarded thread missing earlier replies, an attachment saved outside its original message, or a business account subject to changing retention settings. This email preservation guide is built for legal teams that need to keep the original context available while developing facts from a large and changing record.
Preservation is not simply saving messages that appear relevant at first review. It is a process for identifying potentially relevant mail sources, retaining them in a stable form, recording what happened to them, and enabling later review against the original message context. The right process depends on the matter, the organization’s systems, applicable obligations, and counsel’s judgment. The practical objective is simpler: make it possible to trace a factual assertion back to the email, attachment, header, date, and surrounding thread from which it came.
Why email preservation requires more than forwarding messages
A forwarded email is useful for communication, but it is often a poor preservation copy. Forwarding can alter the presentation of the thread, omit routing information, separate attachments, and create uncertainty about which version was available at the relevant time. Printing an email to PDF can also remove information that may later matter, including header fields and the relationship between a message and its attachments.
The original mailbox or a properly collected mailbox export retains a fuller record. Depending on the system and export method, that record may include sender and recipient fields, dates, subject lines, message bodies, attachment relationships, folder location, and routing headers. Those details can help a reviewer distinguish a draft from a sent message, identify copied recipients, examine timing, and understand whether a quoted passage was part of an earlier exchange.
Email is also rarely self contained. A short request for approval may point to a spreadsheet, a contract redline, a scanned PDF, or a photo attached to the message. Preserving the message without its associated files can break the factual chain that a reviewer needs to examine.
Set the preservation scope before collection
Before copying data, define the source population with enough precision that the collection can later be explained. Start with the people, accounts, shared mailboxes, aliases, relevant date range, likely custodians, business units, and subject areas connected to the matter. Include former employees or delegated accounts where the facts warrant it. Do not assume that the primary custodian’s inbox is the only relevant location.
A workable scope also considers where email is stored. Relevant material may be in an active cloud mailbox, an archive mailbox, a local mail client, a shared account, or an export created during an earlier investigation. Identify whether sent mail, deleted items, drafts, calendar notices, and mailbox folders need separate treatment. The answer depends on the issues and counsel’s direction.
Document the scope decision when it is made. Record the account identifier, data location, collection date, collecting person or system, export method, date range, and any known limitations. If a mailbox cannot be collected in full, state why and identify what was collected instead. A limitation recorded early is easier to evaluate than one discovered after substantive review has begun.
A practical email preservation workflow
1. Stabilize the source
Where appropriate, coordinate with the people responsible for the account and its retention settings before the mailbox changes further. Avoid asking custodians to self select and forward only the messages they think matter. That approach can lose unfavorable, ambiguous, or contextually important material without anyone intending to do so.
Preservation may require a copy of the source mailbox, a targeted export, or both. The right choice turns on the matter’s scope, proportionality, the organization’s environment, and counsel’s instructions. Keep the original source available when possible, even after a working copy is created for review.
2. Collect in a format that preserves message relationships
Use a repeatable collection method that creates a mailbox export rather than a pile of screenshots or isolated printouts. Common review formats include .mbox and .eml based mailbox exports. Preserve attachments with their parent messages and retain the folder structure where the export supports it.
Keep the export package intact after collection. Do not rename individual files for convenience, edit message text, or replace attachments with annotated copies. If a working version needs labels, redactions, or attorney notes, keep those materials separate from the preserved source copy.
3. Create a collection record
A collection record should answer basic questions without relying on memory months later. It should identify who collected the material, when collection occurred, the source account, the system or method used, the resulting file name and location, and any access or export issues encountered.
A cryptographic hash can help identify whether a collected file later differs from the file received at collection. Record the hash value with the collection record, along with the file size and any transfer details. A hash does not establish every fact about a message or its author. It is a way to compare file content consistently over time.
4. Separate preservation from analysis
Preservation copies should remain stable. Review, searching, tagging, chronology building, and issue analysis should occur in a controlled working environment that points back to the preserved material. This separation reduces the risk that an annotated or rearranged working set becomes confused with the original collection.
For matters containing multiple sources, maintain a source register. The register can identify each mailbox, custodian, collection date, export format, hash value, and related attachments. It also helps reveal gaps, such as a missing shared mailbox or an unexplained interval in a custodian’s messages.
Verify completeness and context during review
Collection is not the end of preservation. Reviewers should test whether the material appears complete enough for the identified scope. Search for expected correspondents, recurring subject terms, date boundaries, and known attachments. Compare significant threads against other sources where appropriate, such as a contract version attached to an email or a meeting notice referenced in a reply.
Pay close attention to conversation structure. A message that says “approved as discussed” may have little meaning without the preceding exchange. Likewise, a quoted thread can contain text from earlier messages while hiding the actual sender, recipient list, or timing of the quoted content. Review the underlying message record before treating a quoted passage as a standalone fact.
Attachments deserve their own verification. Confirm that key attachments open, that scanned PDFs are legible, and that the attachment associated with a message is the version being discussed. If a spreadsheet is central to the facts, preserve the original file associated with the email and distinguish it from later revised copies.
Organize email evidence without losing provenance
Once mailboxes are collected, the review system should make facts easier to find without detaching them from their source. TranscriptMe can import email mailboxes in .mbox or .eml form into a case, organize messages and supported attachments for search, and preserve source context for review. It records a SHA-256 hash of each file on arrival and isolates each case in the database.
A reviewer may ask for messages discussing a settlement range, a contract approval, or an instruction to alter a report. The useful result is not merely a summary. It is the relevant message with its source cited, together with the attachment passage, PDF page, Word section, or spreadsheet section where applicable. PDFs, including scanned PDFs, can be read with OCR. Photos can be described, but they are not treated as text extracted through OCR.
This organization supports factual work, not legal conclusions. The system can surface a February email, a related attachment, and an earlier reply that changes its apparent meaning. The lawyer determines relevance, privilege, legal effect, and the case theory to advance.
Keep the record usable as the matter develops
Email preservation is most useful when it remains understandable after the first collection date. Maintain the collection record, preserve original exports, record later supplemental collections separately, and note why the scope changed. If new custodians, date ranges, or accounts emerge, treat them as documented additions rather than silently mixing them into the original set.
The practical discipline is to preserve enough context that a later reviewer can ask a basic question and get a traceable answer: what was collected, from where, when, and what does the underlying email actually say? That is the foundation for careful fact development when the record becomes contested.