Discovery & ESI

ESI Discovery for Small Firms Without an eDiscovery Budget

ESI discovery for small firms on a tight budget: how to map, preserve, collect and produce electronic evidence defensibly, and when a vendor is worth it.

By CourtBriefly Editorial TeamUpdated October 7, 2026 · 9 min read

Quick answer

Small firms can handle ESI discovery defensibly without a large budget by mapping data sources at intake, preserving early, collecting native exports instead of screenshots, hashing originals on arrival, deduplicating before review, and negotiating production formats they can actually generate. Federal Rule 26(b)(1) proportionality scales the effort to the case. Specialists are worth paying for forensic imaging, disputed deletion, or large multi-custodian email sets.

The ESI rules apply regardless of firm size, but proportionality scales the effort to the case.
Collect native exports from the source; screenshots are for display, not collection.
Write down every collection step, and hash originals before anyone works on copies.
Negotiate formats and privilege logging in the Rule 26(f) conference, based on tools you actually have.
Unbundle vendor work: pay for forensics or processing only when the task truly requires it.

In this guide

What counts as ESI in a typical small-firm matter?
Do the ESI rules apply the same way to a two-lawyer firm?
The lean ESI workflow, step by step
How do you collect ESI from clients without forensic imaging?
Where do small-firm ESI budgets actually leak?
How do you negotiate an ESI protocol you can comply with?
When is it worth paying an eDiscovery vendor?
Frequently asked questions

Your client’s case lives on a phone, a personal email account, a shared cloud drive and two social media profiles. The other side has served requests for all electronically stored information relating to the claims, and the matter could never support a large eDiscovery vendor bill. ESI discovery for a small firm is not a shrunken version of big-firm practice. It is its own discipline, built on targeted collection, documented process and production formats you can actually generate.

This guide lays out a lean workflow that holds up when opposing counsel asks how you collected, reviewed and produced the data. It covers what counts as ESI in everyday matters, how to collect from clients without forensic imaging, where small-firm budgets leak, how to negotiate an ESI protocol you can comply with, and the specific situations where paying a specialist is the cheaper choice.

What counts as ESI in a typical small-firm matter?

ESI is any information stored electronically, and in small-firm matters it usually sits on consumer devices and personal accounts rather than corporate servers. Federal Rule of Civil Procedure 34(a)(1)(A) reaches documents and ESI stored in any medium, including data compilations, and most state rules use similar language. A realistic inventory for a family, housing or small business dispute looks like this:

Text messages, iMessages and chat apps such as WhatsApp, Signal, Messenger and Instagram direct messages
Personal and work email, including archived, sent and deleted folders
Photos and videos, plus the metadata recorded with them
Cloud storage and shared documents, including version history
Social media posts, comments and full account data downloads
Co-parenting app records, shared calendars and notes
Bank, payment-app and payroll portals
Doorbell cameras, vehicle apps and other device data, when the facts make them relevant

The point of the inventory is not to collect all of it. It is to know what exists so your team makes deliberate, documented scoping decisions instead of discovering a new source at a deposition.

Do the ESI rules apply the same way to a two-lawyer firm?

Yes. The rules make no exception for firm size, but they scale the expected effort to the case. Under Rule 26(b)(1), discovery is limited to nonprivileged matter that is relevant to a claim or defense and proportional to the needs of the case, weighing factors such as the amount in controversy, the parties’ resources and the importance of the discovery. That standard works in both directions: it limits what you must produce and what you can demand. Our guide to proportionality in ESI discovery walks through the factors in detail.

Three other federal provisions shape the small-firm workflow. Rule 26(f)(3)(C) expects the parties to discuss preservation and the form of ESI production early. Rule 37(e) addresses lost ESI and asks whether a party took reasonable steps to preserve it, not whether it achieved perfection. And ABA Model Rule 1.1, comment 8, treats keeping up with the benefits and risks of relevant technology as part of competence, which a team can build through study or by bringing in properly supervised help with the needed skills. State versions of all of these vary, so confirm your jurisdiction’s rules and any local standing orders.

The lean ESI workflow, step by step

A defensible small-firm workflow follows the same arc as an enterprise project, with fewer tools and more documentation. Each step below produces a record you can point to later.

Map the data. At intake, interview the client about every device, phone number, email account, messaging app, cloud account and backup. Ask when they last replaced a phone and whether any auto-delete settings are on. The written data map is your first defensibility document.
Preserve early. Send a written hold notice, turn off auto-delete settings, and tell the client to keep old devices. The litigation hold letter guide includes plain-language templates.
Collect from the source. Native exports, such as phone backup exports, platform data downloads and mailbox exports, preserve timestamps, participants and attachments that screenshots lose.
Fingerprint on arrival. Hash each original file (SHA-256 is a common choice), store it untouched and work only from copies.
Process and cull. Normalize formats, remove duplicates, filter by date range and participants, and extract text from images so the set is searchable.
Review in context. Code for responsiveness, privilege and privacy, tag by issue, and send close calls to the responsible attorney.
Produce in the agreed format. Apply Bates numbers, keep a production log, and serve a written response that states the form used and anything withheld.

For screenshot- and photo-heavy matters, a tool like Evidence Helper covers the middle of this workflow: it preserves client originals untouched, SHA-256 hashes them on arrival, and makes text extracted from images searchable after a person reviews it.

How do you collect ESI from clients without forensic imaging?

Supervised self-collection, using native exports and a written log, is common and often proportionate in small matters. Forensic imaging is best reserved for cases where integrity or deletion is genuinely contested.

Supervised self-collection that holds up

Give the client written, step-by-step instructions for the specific export, or run it together on a screen share or in the office.
Collect the full export for the account or thread, not a hand-picked selection. Filter on your side, where the filtering is documented.
Do not use forwarding as a collection method. Forwarded email loses original header data, and screenshots drop metadata and context.
Record the device, account, tool, settings, date and person who ran each export.
Have the client sign a short statement describing what they exported and confirming they did not edit it.

Template: collection log entry

Item: CL-004. Source: client’s phone, messaging app, thread with [participant]. Method: in-app chat export with media, run by client on [date] on a video call with [staff name]. Output: one archive file, received by secure upload on [date]. SHA-256 recorded at intake: [hash]. Notes: client confirmed no messages deleted from this thread; disappearing messages setting off since [date].

When forensic imaging earns its cost

Consider a qualified examiner when authenticity is seriously disputed, when deleted content or device activity is itself at issue, when a device is about to be replaced or surrendered, or when the needed data exists only in device artifacts that ordinary exports do not reach.

Where do small-firm ESI budgets actually leak?

Overruns often come from rework, not from the first pass. The table pairs common leaks with low-cost fixes.

Leak	Why it costs	Lean fix
Screenshots instead of exports	Rework when completeness or timestamps are challenged	Collect native exports first; use screenshots only for display
Over-collection	Review time grows with every extra item	Scope by custodian, date and participant before review
No deduplication	The same message reviewed from the phone, the backup and the cloud	Deduplicate on hashes or message identifiers first
Formats you cannot generate	Rush vendor work or a re-production	Negotiate formats around your real tools
Privilege review left to the end	Late logs and clawback scrambles	Code privilege during first-pass review
Hand Bates numbering	Gaps, duplicates and mismatched logs	Automate numbering and keep a production log

How do you negotiate an ESI protocol you can comply with?

Keep it short, concrete and built around your actual data. A two-page protocol that names sources, dates, formats and privilege procedure is often more useful in a small matter than a template borrowed from complex commercial litigation. Cover these points in the Rule 26(f) conference or its state equivalent:

Custodians and data sources in scope, and those agreed to be out of scope
The date range for collection
The search method: targeted collection, search terms tested against the data, or both
Production format by data type: searchable PDF for documents, natives for spreadsheets and media, and a paginated log plus structured data for messages
Which metadata fields, if any, will be produced and whether load files are needed
Deduplication and email threading rules
Privilege log timing and method, including any agreed exclusion for post-filing communications with litigation counsel
A request for a Federal Rule of Evidence 502(d) order or its state equivalent
A meet-and-confer step before any motion

The ESI meet-and-confer checklist turns these points into an agenda you can send ahead of the call.

When is it worth paying an eDiscovery vendor?

Pay a specialist when the task needs tools, certifications or testimony your team cannot supply, and buy only that piece. Typical triggers include:

Forensic imaging of a phone or computer
Disputed deletion or fabrication that may require expert analysis and testimony
Large email collections across several custodians, where threading and near-duplicate detection save more review time than they cost
An agreed or ordered production with load files and a long metadata field list
Organizational systems that require administrator-level exports

Unbundling keeps costs predictable: a vendor can collect and hash while your team reviews, or process into load files only at the production stage. Get the scope, deliverables and formats in writing before work starts. If you are weighing a standing platform instead of per-matter help, see the buyer’s framework in choosing eDiscovery software for a small law firm.

Paralegals and staff should route the scoping, privilege and format decisions above to the supervising attorney, and teams handling a matter outside their home jurisdiction should confirm local rules with counsel licensed there. A lean process is defensible because it is deliberate and documented, not because it is cheap.

Frequently asked questions

What is ESI in discovery?

ESI stands for electronically stored information: emails, text and chat messages, documents, spreadsheets, photos, videos, social media content, databases and the metadata attached to them. Federal Rule of Civil Procedure 34 treats ESI as its own category alongside documents and tangible things, and most state discovery rules do the same, though the wording and procedures vary by jurisdiction.

Who pays for ESI discovery?

The general rule is that each side bears its own costs of preserving, collecting, reviewing and producing its data. The federal rules allow courts to shift or share costs in some situations, for example when information is not reasonably accessible under Rule 26(b)(2)(B) or through a protective order under Rule 26(c) that allocates expenses. State practice varies, so check your jurisdiction’s rules and case management orders.

What is a Rule 502(d) order and why do small firms ask for one?

Federal Rule of Evidence 502(d) lets a federal court order that producing privileged material in the case does not waive the privilege, in that case or in other federal or state proceedings. For a small team doing review in-house, it is an inexpensive safety net against an inadvertent production. Many state courts have their own clawback rules or will enter similar orders by agreement.

Do state courts follow the federal ESI rules?

Many states have adopted ESI provisions modeled on the federal rules, covering form of production, inaccessible data and safe harbors for lost information, but numbering, deadlines and standards differ. Family, housing and small-claims courts often run discovery under their own procedures. Before relying on a federal concept, confirm the matching state rule and any local rules or standing orders that apply.

How much ESI can a small firm realistically review in-house?

There is no fixed threshold. The practical limit depends on the data types, how well the set can be culled by date and participant, how much duplicate content exists, and your team’s tools for search, tagging and numbering. Many small-firm matters involve one or two phones and a few accounts, which in-house teams commonly handle; large multi-custodian email collections are where outside processing tends to pay for itself.