← All guides

How to Prepare Email for Legal Discovery, Step by Step

Learn how to preserve, collect, filter, sort, and number email for legal discovery, then build one clear PDF production with a full log for review.

What discovery means in plain words

Discovery is the part of a case before trial. Each side asks the other side for facts and papers. The goal is that no one is shocked at trial. Email is often a big part of that ask.

A production is the set of files you hand over. You do not hand over your whole mailbox by default. You hand over the files that fit the ask. Then you keep a clear record of what you sent.

Why email needs care

Email holds dates, names, and exact words. It also holds hidden data about each message. That hidden data is called metadata. Metadata can show when a mail was sent and by whom.

This guide is help, not legal advice

This guide shows a clean way to handle files. It does not tell you what the law needs in your case. Rules vary by court, state, and case. A lawyer should check your plan before you send files.

Some rules still give a useful base. Federal Rule 34 deals with asks for stored data. Stored data on a computer is called ESI for short. ESI means Electronically Stored Information in full.

What Rule 34 says about form

A request may name the form for the files. Form means the type of file, like PDF. If the ask names a form, you must plan for that form. If it does not, you have more choice.

If no form is named, there is a base rule. Files must be sent as they are kept in normal use. Or they must be sent in a form people can use. The same files need to be sent in one form only.

A real court order as an example

Some courts set the form in a written order. One federal court order sets rules for ESI. It also sets rules for page numbers on each page. That shows why you should read the case rules first.

Those page numbers are called Bates numbers. Each page gets its own number in order. Later in this guide you will see how they help. For now, just note that form is not a small choice.

The seven steps at a glance

The work has a clear order for a good reason. You keep files safe before you touch them. You pick whose mail counts before you search it. You cut the set down before you pack it.

Step 1: Preserve the mail as it is

Preserve means keep the mail safe and not changed. Tell each person in the case to stop deleting mail. That note is often called a hold. A hold tells staff not to clean out old mail.

Put the hold in writing and keep a copy. Name the topics and the date range it covers. Tell people not to edit files to fix them. Even a small edit can change the file data.

Keep the first files apart

Make a safe copy of each mailbox you collect. Keep that first copy apart from your work copy. Do not open and save files in the first copy. Work only on the copy you made for review.

What can hurt you in this step

Check for these risks on the first day. Turn off auto delete for the mail in the hold. Ask each person if mail is on more than one device. Save what you find in your notes.

Step 2: Collect mail from the right people

Collect means gather mail from the right sources. A custodian is a person whose mail you collect. The word sounds hard, but the idea is simple. Each custodian is one source of files in the case.

Choose dates and sources with care

Pick a date range that fits the ask. The range may start before the key event. It may end after the last key step. Write down why you chose those dates.

Mail may live in more than one place. It may be in an inbox, an archive, or a shared box. It may be in files with names like MBOX or EML. An MBOX file holds many emails in one file.

Know the file types you may meet

An EML file holds one email on its own. A MSG file is a mail file from Outlook. An MBOX file can hold a whole folder of mail. All three types can hold key facts.

You do not need a new tool for each type. MBoxToPDF can take all three types at once. You can also convert loose EML files the same way. That helps when mail comes from mixed sources.

Keep a simple collect log

Write one line for each source you collect. Note the custodian, the source, and the date range. Note the file type and the file size too. This log will join your final log later.

Step 3: Cut the set down to what fits

Most mailboxes hold far more mail than a case needs. Ads, alerts, and side chats add bulk fast. Your job is to cut with clear, fair rules. You should not cut by hand in a random way.

How date and keyword cuts work

A date cut keeps mail in a set span of time. A keyword cut keeps mail that hits your terms. The terms can match the subject line of a mail. They can match the sender or the body text.

On MBoxToPDF, Pro lets you set both cuts. You pick a start date and an end date. You add keywords for the topic you need. Then only mail that fits is used in the export.

Use this cut with care

Test your terms on a small batch first. A broad term may pull in too much mail. A tight term may miss mail that uses other words. Try names, project names, and key phrases.

Step 4: Convert the mail to one sorted PDF

Now you can build the production volume from the cut set. A volume is one merged PDF file for the whole set. It is not a pile of loose files. One file is easier to send, read, and cite.

MBoxToPDF joins MBOX, EML, and MSG files in one run. It can take several files at once. The mails are placed in date order, oldest first. That order is called chronological order in formal terms.

What the volume gives you

The volume starts with a cover page. Next comes a table of contents with start pages. The contents page lists each email in order. You can find a mail fast from its start page.

Each page shows Page x of y at the foot. That tells you where you are in the whole set. If a page is lost, the gap is easy to spot. If a set is long, this aid matters a lot.

How each email is shown

Each email starts with a header block at the top. The block shows From, To, and Cc fields. It also shows Date, Subject, and Message-ID. A Message-ID is a unique code for that message.

You can sort the set in two ways. Date order puts the oldest mail first. Thread order groups mails in the same chain. A thread is a chain of replies on one topic.

What happens to attached files

Some mails carry files fixed to them. Those files are called attachments in plain words. PDF, image, and text files become pages in the set. They sit right after the mail that carried them.

Every attachment is also kept in its first form. It is placed inside the PDF as a file. Word, Excel, and PowerPoint files are not made into pages. They are listed, placed inside, and put in a ZIP file.

A note on the ZIP file

A ZIP file is a pack that holds many files. Starter and Pro give you one ZIP per run. It holds one PDF for each email in the set. That pack can help your own team review mail.

Step 5: Number each page with Bates numbers

Bates numbering gives each page its own ID. That ID is stamped on the page in the set. You can learn more about what Bates numbering is in depth. This step shows where it fits in the work.

In a hearing, people need to cite one exact page. A Bates number lets them do that fast. They can say the number and all can find it. No one has to hunt through the whole set.

How Bates works in the volume

On the Pro plan with Bates numbering, you set the start. You pick a short prefix and a start number. A prefix is a short code placed before the number. It can name your firm or your side.

The stamp runs through the whole volume in order. It covers the cover page and contents page too. It then runs through each email and attachment page. The stamp is dark red and sits in the page foot.

What the cover page shows

The cover page prints the full range of numbers. It shows the first number and the last number. Anyone who opens the set can see the full span. That helps them check that the set is whole.

Step 6: Log the set with a CSV index

A log is a list that shows what you sent. Starter and Pro give you a metadata CSV index. CSV is a plain table file that most tools can open. It has one row for each email in the set.

Each row shows the date and the sender. It shows who got the mail and who was copied. It also shows the subject and attachment names. The row holds the Message-ID and Thread ID too.

Why the log matters so much

The log lets you find a mail without the PDF. You can sort it by date, name, or subject. You can search it for a word in seconds. You can prove what was in the set you sent.

The CSV also maps Bates numbers to each mail. It records the first Bates number for that mail. It records the last Bates number for that mail too. Those fields are named bates_start and bates_end.

Flags you should not ignore

Some mails may be locked or may be broken. A locked mail may need a key to open it. A broken mail may have parts that are lost. These mails are flagged in the CSV index.

Step 7: Deliver the set and keep your copy

Check the ask for how the set must be sent. Some asks name a secure link or a drive. Some name a file form and a due date. Send the merged PDF and the log as asked.

Keep your own copy of the sent PDF. Keep the CSV log and your collect notes too. Keep the list of cuts and terms you used. Store them in one case folder with clear names.

Do a last check before you send

Open the PDF and check the first pages. Check the cover, contents, and first email. Jump to the last page and check its number. Make sure the page count matches Page x of y.

Search the CSV for a mail you know well. Check its date, subject, and Bates range. Open that page in the PDF to test the map. If the map works, your set is in good shape.

Table: Each step and what can go wrong

Use this table as a quick check for your work. It shows the aim of each step in brief. It also shows a common fault to watch for in that step. Keep it near your case folder as you work.

Format can differ from case to case

Do not assume PDF is right for each case. The other side may name a form in the ask. A court may set a form in an order. Your lawyer must check that point first.

Plans and limits to keep in mind

The Free plan gives three conversions each month. Files can be up to 25 MB in size. Each run can hold up to 100 emails. It gives the merged PDF only, with no CSV log.

Starter costs 15 dollars per month for more room. It gives 30 conversions and files up to 200 MB. Each run can hold up to 2,000 emails. It adds the CSV index and the ZIP pack.

When Pro is the right fit

Pro costs 29 dollars per month for the most room. It gives 100 conversions and files up to 1 GB. Each run can hold up to 10,000 emails. It adds date and keyword cuts before export.

Privacy and file handling

Your files travel to the site over HTTPS. HTTPS is a safe link that guards data in transit. Files are worked on by the server for your run. They are deleted on their own after 24 hours.

A short final list to follow

Work in order and write down what you do. Keep the first files safe and work on copies. Cut the set with dates and words you can explain. Build one sorted PDF and stamp each page.

References

• Cornell Law Institute — Federal Rule of Civil Procedure 34
• U.S. District Court, Eastern District of Pennsylvania — ESI Production Order (Case Management Order No. 10)