eDiscovery Rebuilt Case-Centric After the Classic Retirement at a 2,600-employee Insurer
Legal holds were being issued by email and tracked in a spreadsheet, and every matter turned into a bulk export that outside counsel billed to review. We rebuilt the process on the unified Purview eDiscovery experience, cut review volume by 61%, and brought first collection down to 6 days.
About the Client
The Challenge
The insurer ran roughly 140 litigation and regulatory matters a year — claims disputes, bad faith allegations, a market conduct examination, the occasional employment claim. Every one started the same way. A paralegal emailed a hold notice to a list of names, pasted it into a spreadsheet, and chased replies. Nobody could say who had acknowledged a hold, when, or for which matter.
Preservation meant putting entire mailboxes on litigation hold and leaving them there. Holds were rarely released because releasing one required knowing it existed, so Preservation Hold libraries and Recoverable Items folders grew without limit and nobody could describe the preservation footprint.
Collection was the expensive part. IT ran a search across the custodians, exported everything it returned, and handed a drive to outside counsel. Counsel billed to read a corpus full of duplicate attachments, forty-message chains reviewed one by one, and files never indexed properly. Nobody upstream was filtering, because nobody upstream had a tool that let them.
The breaking point was a regulator's request with a fixed deadline. The team measured its own response: 23 days from hold decision to a first usable collection, most of it spent reconciling custodian lists and re-running searches that had returned partially indexed items. The deadline was external too — classic eDiscovery and classic Content Search were retired on 31 August 2025, so every habit built around the old tooling had an expiry date. The general counsel asked for a process that could be described to a court without embarrassment.
Our Approach
The unified experience is not a bigger content search. The workflow is case-centric, not custodian-centric: the case is the container, custodians and non-custodial locations are data sources inside it, and searches, statistics and review sets hang off it.
Case Structure, Roles and Compliance Boundaries (Weeks 1-3)
Defined what a matter looks like before migrating any work into it. The case is now the unit of everything, so its shape is the foundation. Set up the eDiscovery Manager and Administrator role groups so a paralegal runs their own matters and only an administrator sees everyone's. Configured compliance boundaries and security filters so matters touching one regulated entity cannot reach another's data. Agreed a naming convention and a matter-closure step, because an estate without one becomes the same unbounded hold problem in a new interface. Ad-hoc tenant-wide searching was rehoused in the default system case.
Data Sources, Custodians and Automated Hold Notices (Weeks 2-6)
Custodians are one kind of data source in a case, not the organising principle of one. Adding a custodian maps their mailbox, OneDrive and Teams data automatically; non-custodial sources — shared mailboxes, project sites, the claims file share — sit alongside them, preserved without being attributed to a person. Much of what a claims matter needs was never attached to an individual. Hold notices, reminders, escalations and release notices became templates with acknowledgement tracking. Acknowledgement rate is now a reportable number rather than a paralegal's recollection, and it sits at 97% across 480 custodians under active hold.
Read the Statistics Before You Commit (Weeks 5-9)
Trained the team to run a search and read its Statistics before committing anything to a review set — the estimate view that used to be called collections. It returns hit counts by location, volume and the share of items partially indexed, so a query can be narrowed while it is still free to change. Only once the estimate is defensible does the search become a review set. That habit removed most of the re-run cycles.
Analytics on the Review Set (Weeks 8-13)
Advanced indexing is no longer a separate step somebody forgets — it runs automatically during searches, so items with indexing errors, unusual formats and password-protected attachments surface for remediation rather than being silently absent. What needs planning is throughput: indexing and export both move roughly 2 GB an hour, and that figure sets a matter's calendar. A large custodial corpus is a multi-day processing job before anyone reviews a page. Analytics then runs on the review set — near-duplicate detection marks one representative per group, email threading identifies the inclusive messages carrying a chain's full content, and themes cluster by subject. An ignore-text rule strips the firm's email disclaimer so grouping is not defeated by a footer. Reviewing inclusive emails and one representative per group removed 61% of this client's documents before a lawyer read anything — their own measured before-and-after count.
Export, Outside Counsel and the Playbook (Weeks 12-16)
Standardised exports to a load file format the review platform ingests without rework — native files, extracted text and a metadata file, delivered to a controlled location rather than a posted drive. Export runs at the same 2 GB an hour, so delivery is scheduled rather than assumed. Tag groups were agreed with counsel in advance so responsiveness and privilege decisions return in a structure the case absorbs. The sequence was written up as a playbook and rehearsed against a mock request, alongside the audit log retention work that supports it.
Solution Architecture
Case model: One case per matter, custodial and non-custodial data sources kept distinct, and an explicit closure step that releases holds
Preservation: Case hold policies rather than blanket litigation holds, so the preservation footprint is attributable and reversible
Notification: Templated hold, reminder, escalation and release notices, with acknowledgement tracking as the record
Reduction: Automatic advanced indexing, then near-duplicate detection, email threading and themes before any human review, with content also reachable for records management disposition checks
Export: Load file exports with native, text and metadata components, delivered to a controlled location with an agreed tag structure
Results
Client identity withheld under confidentiality. Figures are representative of engagements of this scope.
Technologies Used
Key Takeaways
If your organization is facing a similar challenge, here's what we learned:
A hold you cannot prove was acknowledged is not much of a hold. The spreadsheet works until someone asks when a custodian was notified and what they were told. Templated notices with tracking turn that into a report instead of an archaeology exercise.
Commit after you have read the Statistics, not before. The estimate tells you hit counts by location and how much of the corpus is partially indexed. Changing the query at that point costs nothing. Changing it after you have committed to a review set costs a cycle.
Plan the matter around 2 GB per hour. Automatic advanced indexing removed a step people used to forget and replaced it with a throughput question. Indexing and export both move about 2 GB an hour, so a large corpus is a multi-day job before review starts.
Email threading pays for the licence on its own. Most of a litigation corpus is the same conversation quoted back at itself. Reviewing only inclusive messages removes a large share of the documents without removing any content, and counsel bills by the document.
Close your matters. Every open case keeps custodians on hold and preservation libraries growing. A closure step with a release notice is the cheapest risk control in the process.
Related Case Studies
How Long Does Your First Collection Take?
If the answer is measured in weeks and the process involves a spreadsheet of custodians, the tooling you are already licensed for can do considerably better. We rebuild eDiscovery around cases, not searches.