Paralegal Playbooks

An Evidence Review Workflow for Paralegals: From Raw Files to Attorney-Ready

A staged evidence review workflow for paralegals: preserve originals, inventory, triage, verify extracted text, code by issue, flag privilege, then QC.

By CourtBriefly Editorial TeamUpdated October 7, 2026 · 8 min read

Quick answer

A dependable evidence review workflow runs in stages: preserve and hash the originals, inventory everything received, triage for relevance and priority, verify any extracted text against the source, code each item by date, people and issue, flag privilege and sensitive data, escalate judgment calls to the attorney, and run a quality check before export. Each stage has one job, which keeps the review consistent and defensible.

Preserve and hash originals before anyone opens, edits or renames a file.
Separate fast triage from detailed coding so the review keeps moving.
Verify every OCR or AI-extracted text against the source image.
Paralegals flag privilege and admissibility questions; attorneys decide them.
Quality-check a sample before export and record who reviewed what.

In this guide

What are the stages of an evidence review workflow?
How do you preserve and inventory evidence before review?
How do you triage a large evidence set quickly?
Why verify extracted text before coding?
How should evidence be coded?
What should a paralegal flag for the attorney?
What does a good handoff to the attorney look like?
How do you quality-check a review before export?
Frequently asked questions

When a client’s evidence lands on your desk as a few thousand screenshots, a pile of PDFs and a phone export nobody has opened, the attorney needs one thing from you: a reviewed, organized set they can trust. An evidence review workflow is the repeatable process that gets you there without losing originals, skipping items or making calls that belong to the attorney.

The workflow below runs in stages, and each stage has a single job. Separating them is what makes the review fast and defensible: you never code what you haven’t preserved, never rely on text you haven’t verified, and never export what nobody has checked. It works for family, civil and housing matters, and it scales from a few hundred items to many thousands.

What are the stages of an evidence review workflow?

A sound review moves through eight stages in order. Skipping ahead, especially coding before preservation, is where most problems start.

Stage	Goal	Output
1. Preserve	Lock originals before anyone works on them	Untouched originals with hash values
2. Inventory	Know exactly what arrived, from whom, when	Intake log with counts by source
3. Triage	Fast first pass for relevance and priority	Items sorted into review buckets
4. Verify text	Confirm OCR or extracted text matches the image	Corrected, searchable text
5. Code	Attach dates, people, issues, priority	A coded evidence log
6. Flag	Surface privilege, privacy and admissibility questions	Attorney question list
7. Hand off	Give the attorney a usable summary	Review memo and key-item list
8. Quality check	Catch errors before anything leaves the firm	QC record and clean export

How do you preserve and inventory evidence before review?

Preserve first: copy the originals into a protected location, record a hash value for each file, and do all review work on copies. Then inventory what you received before you look at any of it in detail.

A SHA-256 hash is a fingerprint of a file’s exact contents. If the hash recorded on arrival matches the hash of the file you produce months later, you can show the file hasn’t changed. The guide to hash values in litigation explains what that fingerprint does and does not prove. Tools such as Evidence Helper hash originals automatically on arrival and keep them untouched, which removes a manual step that is easy to forget under deadline pressure.

Your intake log should capture, for each batch:

Source and custodian (client’s phone, client’s email, third-party records, opposing production)
How it arrived (upload, email, physical media, production) and the date received
File count and formats, including HEIC photos, chat exports and scanned PDFs
Anything the client said about the batch (“these are from my old phone”)
Who received it and where the originals are stored

How do you triage a large evidence set quickly?

Triage is a fast first pass that sorts every item into a bucket without detailed coding. The point is to find what matters early and stop spending time on what doesn’t.

Use a small, fixed set of buckets the attorney approves in advance:

Key: likely central to a disputed issue; route to the attorney early
Relevant: bears on an issue; code fully in stage 5
Background: context that may help a chronology but needs light coding
Duplicate: the same content captured twice; link it to the primary copy
Not relevant: no apparent connection to any issue; kept, but not coded
Attorney question: you can’t tell, or it raises privilege or sensitivity concerns

Duplicates are common with client-collected material, because the same conversation often arrives as screenshots and as an export. Link duplicates rather than deleting them. When the volume is overwhelming, the triage workflow for clients who send thousands of screenshots walks through sampling and time-boxing.

Why verify extracted text before coding?

Search, sorting and summaries all depend on the text extracted from images and scans, and extraction makes mistakes. Verify it against the source before anyone relies on it.

OCR and AI-assisted extraction struggle with exactly the details that matter most in litigation: names, phone numbers, dollar amounts, dates and times, and text over busy backgrounds. A misread digit in a time stamp can put a message on the wrong day in a chronology.

Prioritize. Verify every key and relevant item fully; spot-check background items.
Compare side by side. Read the extracted text against the image, focusing on names, numbers and dates.
Correct without overwriting. Record corrections separately from the original extraction so the change is visible.
Mark the item verified. Note who verified it and when.

The exhibit itself should reproduce the source image or document. Extracted text is a working aid for search and summaries, not a substitute for the original.

How should evidence be coded?

Code each relevant item against fields the attorney defines at the start, usually drawn from the claims, defenses and disputed issues. Consistent fields make the log sortable into a chronology, an exhibit list or a witness outline later.

Template: evidence coding fields

Item ID: unique number assigned at intake (never reused)

Event date/time: when the underlying event happened, with time zone if known

Received: date received and source/custodian

Type: text message, email, photo, document, social media post, recording

People: author, recipients, and people mentioned

Issues: one or more from the attorney’s issue list

Priority: key / relevant / background

Foundation: who could identify or authenticate this item

Flags: privilege, personal identifiers, minor’s information, attorney question

Reviewer / date: initials and date coded

The foundation field pays off at hearing time. Federal Rule of Evidence 901 requires evidence sufficient to support a finding that an item is what its proponent claims, and knowing early who can provide that testimony lets the attorney spot gaps while there is still time to fill them. Many state evidence codes track the federal rules closely, though numbering and details vary.

What should a paralegal flag for the attorney?

Flag anything that requires legal judgment, and don’t resolve it yourself. Your job is to surface the question clearly, with the item ID and a one-line reason.

Possible privilege. Client communications with the firm forwarded to others, notes prepared for counsel, or messages with other attorneys. If anything is withheld in discovery, Federal Rule of Civil Procedure 26(b)(5) generally requires describing it; see the practical guide to privilege logs.
Personal identifiers. Social Security numbers, financial account numbers, birth dates and minors’ names. For federal filings, Rule 5.2 limits these to partial forms such as the last four digits, a birth year and a minor’s initials; state rules vary.
Third-party sensitive information. Medical, counseling or school information about someone other than the client.
Authentication gaps. Screenshots with no visible sender, date or source, or items the client can’t explain.
Completeness concerns. Excerpts where the surrounding conversation might change the meaning.
Anything harmful to the client. The attorney needs to see it early, not on the eve of a hearing.

What does a good handoff to the attorney look like?

A good handoff is a short memo the attorney can read in five minutes, backed by a log they can sort. It says what was reviewed, what matters, what is missing and what needs a decision.

Template: review memo

Scope: 2,140 items from client phone and email, received [dates]. All originals hashed.

Results: 46 key, 312 relevant, 590 background, 1,104 duplicate or not relevant, 88 attorney questions.

Key items: IDs listed by issue, with one-line descriptions.

Gaps: no messages between [date] and [date]; client says phone was replaced.

Decisions needed: privilege flags (12), completeness concerns (5), redaction approach for minors’ school records.

How do you quality-check a review before export?

Check a sample of coded items against the source, confirm the numbers reconcile, and verify that nothing flagged was exported without a decision. Then record the check.

Re-review a sample from each reviewer for coding consistency
Confirm intake counts equal triage counts; nothing fell through
Confirm exported files trace to hashed originals
Check exhibit numbering for gaps and duplicates
Confirm redactions were applied to copies and actually remove the underlying text
Confirm every attorney-question item has a recorded decision

Evidence rules and filing requirements differ by court, and whether any item is admissible or persuasive is the responsible attorney’s decision. What the workflow does ensure is that when the attorney makes that decision, they are working from complete, verified, traceable material.

Frequently asked questions

What is the difference between first-level and second-level review?

First-level review sorts and codes material against criteria the attorney sets: relevance, priority, issues, people and dates. Second-level review is the attorney’s pass over what first-level review flagged, including key documents, privilege calls and anything with admissibility or strategy implications. Keeping the levels distinct lets paralegals move quickly through volume while the judgment calls get the attorney’s attention.

How long should an evidence review take?

It depends on volume, format, the number of issues being coded and how messy the source material is. The most reliable way to estimate is to time a representative sample, such as the first hundred items, and extrapolate, adding time for verification, privilege review and quality control. Revisit the estimate once triage shows how much of the set is actually relevant.

How should a paralegal handle evidence that may be privileged?

Flag it, isolate it from anything being prepared for sharing, and route it to the attorney for a decision. Common examples are client emails to the firm that the client forwarded to others, or notes the client wrote for counsel. If material is withheld in discovery, Federal Rule of Civil Procedure 26(b)(5) generally requires describing it, often in a privilege log, and state rules have similar requirements.

Can you crop or edit a screenshot before it becomes an exhibit?

Never edit the original. Make a working copy, and record any change, such as a crop or redaction, so the exhibit can be traced back to the untouched source. Whether a cropped or excerpted version is appropriate is the attorney’s call, because completeness objections and authentication questions often turn on what was left out and why.

What makes an evidence review defensible?

Consistency and a record. Written coding criteria, preserved and hashed originals, a log of who reviewed which items and when, documented corrections to extracted text, and a quality-control check before export all let the team explain how a document was handled if anyone questions it later. The same discipline makes the attorney’s job easier at the hearing.