- Nationwide Digital Forensic & Cyber Investigation Services
Quick answer. E-Discovery production is the delivery of responsive electronically stored information in the agreed format. Native production delivers original files with metadata intact, image production delivers PDF or TIFF pages with extracted text and load files, and most protocols use a hybrid where spreadsheets and media are produced natively while other documents are imaged. A production set includes the documents, a data load file carrying agreed metadata fields, an image load file where images are produced, extracted or optically recognized text, Bates numbering, applied redactions with a redaction log and a hash manifest. Federal Rule of Civil Procedure 34 requires production in a reasonably usable form, and the ESI protocol should specify that form before production begins.
| Question | Short answer |
|---|---|
| Native or image? | Most protocols use both: native for spreadsheets and media, images for everything else. |
| What is a load file? | A delimited file carrying metadata and cross references so a review platform can ingest the set. |
| Why produce extracted text? | Because it makes the production searchable, which images alone are not. |
| What is Bates numbering? | Sequential identifiers applied per page or per document so filings can cite exactly. |
| Are redactions burned in? | Yes. Redactions are applied to the image and the underlying text is removed. |
| What about spreadsheets? | Produce natively. Imaging a spreadsheet destroys formulas and usability. |
| Do you provide hash manifests? | Yes, with every production, supporting authentication and integrity verification. |
| Can you fix a deficient production? | Yes. We analyze what is missing and produce a supplemental set or a written deficiency analysis. |
| Format | What it delivers | Best for |
|---|---|---|
| Native | Original files with metadata and functionality intact | Spreadsheets, databases, audio, video, computer aided design and anything where function matters |
| Page images, searchable when text is embedded, widely readable | Smaller productions and matters where simplicity is preferred over page level control | |
| Single page TIFF | Page images with separate text and load files | Traditional review platforms and protocols that require page level Bates numbering |
| Hybrid | Native for defined file types, images for the remainder | Most modern protocols, balancing usability with page level citation |
| Paper to digital | Scanned, optically recognized, coded and numbered output | Legacy files and matters with substantial hard copy |
| Report style | Threaded, time normalized presentation of messages and chats | Text message, Teams and Slack productions that are unreadable in raw export form |
Imaging a spreadsheet is a recurring dispute and a needless one. Formulas, hidden rows, comments and multiple sheets do not survive imaging, so spreadsheets should be produced natively and the protocol should say so.
A production is only as usable as its load file. We validate load files before delivery, confirming field counts, delimiter integrity, encoding, path validity and page counts, because a load file that will not ingest becomes a discovery dispute within a day of delivery.
Redactions are applied to the produced image and the corresponding text is removed, so nothing is recoverable by selecting under a black box.
Where a native file must be redacted, we produce a redacted image or a scrubbed native, with the approach documented rather than improvised.
Each redaction is logged with the basis, whether privilege, personal identifying information, protected health information or trade secret.
Withheld documents are logged with the metadata counsel needs, and slip sheets are used where the protocol requires placeholders.
Protective order legends are endorsed consistently and recorded in the load file.
Social security numbers, financial account numbers and medical information are identified for redaction as the protocol and applicable rules require.
Metadata leaks privilege more often than the document body. Author fields, file paths, tracked changes and comments should be reviewed before production, not after.
We are frequently retained by the receiving party rather than the producing one, because a production that looks complete can be missing exactly what matters.
Our deficiency analysis is written for use: what is missing, what it demonstrates about the collection method, what remains recoverable and what specific relief is worth requesting. Where necessary the same analysis supports a declaration and testimony.
This page is part of the Elite Digital Forensics E-Discovery services hub. Related coverage:
We produce to the protocol: native, PDF, TIFF or hybrid sets with validated load files, extracted and optically recognized text, Bates numbering, confidentiality endorsements, burned in redactions with a redaction log, privilege log metadata support and hash manifests. Where you are receiving rather than producing, we analyze the set for stripped metadata, broken families, missing text, unthreaded messages and coverage gaps, and provide a written deficiency analysis with declaration and testimony support.
Elite Digital Forensics is an independent digital forensics firm providing nationwide E-Discovery services, computer and mobile device forensics, cloud and email investigations and expert witness testimony. Our examiners include former law enforcement forensic examiners and court qualified expert witnesses. We work for law firms on both sides of the docket, for corporations and in house legal departments, and for insurers. When retained through counsel, our work is generally treated as attorney work product prepared in anticipation of litigation.
Rule 34 requires production either in the form requested or, absent a specification, in the form in which the information is ordinarily maintained or in a reasonably usable form. In practice courts treat a production as unusable when it defeats normal review, for example by stripping metadata, imaging spreadsheets so formulas are lost, or omitting extracted text so a large set cannot be searched. The reliable way to avoid the dispute is an ESI protocol that specifies format and metadata fields before production.
A load file is a delimited file that tells a review platform what the production contains: one row per document carrying the agreed metadata fields, Bates numbers, family relationships and paths to the native, image and text files. If it is malformed, the receiving party cannot ingest the production at all. We validate field counts, delimiters, encoding, paths and page counts before delivery for exactly that reason.
Yes, and this is not really a close question. Imaging a spreadsheet loses formulas, hidden rows and columns, comments, additional worksheets and any practical ability to work with the data. The same reasoning applies to audio, video, database exports and computer aided design files. Most modern protocols provide for native production of those types and imaged production of the remainder.
Redactions are burned into the produced image and the corresponding text is removed from the extracted text file, so the redacted content cannot be revealed by selecting or searching underneath the marking. Each redaction is recorded in a redaction log with its basis. Where a native file must be redacted, we produce a redacted image or a scrubbed native and document the approach rather than improvising.
Rules 902(13) and 902(14) allow certified electronic records and hash verified copies to be authenticated without live testimony, provided the certification comes from a qualified person and the process is documented. We support that by preserving original hash values, providing hash manifests with the production, and documenting the collection and processing chain so a qualified examiner can execute the certification if the parties rely on it.
We analyze it against the protocol and against what the underlying systems should have produced. Common findings include stripped metadata, broken attachment families, imaged spreadsheets, absent extracted text, unthreaded message screenshots, Bates and date range gaps, and custodians missing entirely. The result is a written deficiency analysis identifying what is missing, what it reveals about the collection method, what is still recoverable and what relief to request, and it can be supported by declaration and testimony.
Raw exports of iPhone messages, Teams, Slack or WhatsApp are technically native and practically unreadable, and screenshots are worse because they lose participants, timestamps and continuity. The workable approach is a threaded, time normalized report that shows participants, direction, timestamps in a stated zone, attachments and deletion indicators, delivered alongside the native export and load file set so both usability and authenticity are preserved.
The parties do, in the ESI protocol, and it is worth settling early. A typical field list covers custodian, source, sender and recipients, subject, sent and received times, document author and modification times, original file path and name, file type, hash value, family relationships and Bates range. Agreeing fields after processing frequently forces reprocessing that a short conversation would have avoided.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic and E-Discovery services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder