The following are procedure we adopt at Meridian Litigation Analytics for processing emails and attachments in preparation for eDiscovery.
Emails in PST format are the easiest files to process. PST files are best created in a controlled manner from within Outlook. Typically, PST files are created per period where large cases are involved, example A v B – 2014-04.pst for all emails of case A v B during April 2014. For smaller cases a single PST file can be created for the whole case.
PST are loaded directly into our eDiscovery application, Summation, where they are automatically unpacked as individual emails with all their necessary metadata, data such as From, To, CC, BCC, Subject, Date sent, Time sent, etc. All attachments are also unpacked and linked to each parent email message to maintain a parent/child relationship which can run into very long email conversation threads and family trees.
We further process all email attachment as we do normal electronic documents described in the article Preparing Documents for eDiscovery – Part 2 – Processing Electronic Documents in this 3 part series. Some of the main processes are: decompress all zipped files, split batched files, OCR all image only PDF files, de-NIST and tag non-human generated files, etc.
A golden rule is maintained where emails with attachments are treated as composite documents. An email with attachments is treated as a single piece of evidence. All email components are to be maintained as one unit, even signature icons.
If an email is attached to another email, typically as an MSG email item, Summation has the ability to chain process these as though it were another email item. In all cases the parent/child of each email/attachment relationship is maintaining, no matter how long or deep the concatenated email and attachment chains grow.