An ESI protocol is the negotiated roadmap that tells both sides how electronically stored information will be preserved, collected, and produced. For years that roadmap was built on a simple mental model: email is the record, documents are static files, and attachments travel with their parent message. Modern data breaks every one of those assumptions. Text threads, ephemeral chat apps, hyperlinked cloud documents, and collaboration platforms generate evidence that no email-era template was written to capture. When a protocol is silent or imprecise about that data, that ambiguity tends to be read against the party seeking broader production, and it sets up exactly the kind of downstream dispute the protocol was supposed to prevent.
Why Legacy Protocols Fail Modern Data
The standard ESI protocol assumes a world of mailboxes and file shares. That language still works for email. It does not describe how a conversation actually unfolds today, where a single exchange can move across a text thread, a chat channel, a comment inside a shared document, a calendar invite, and a follow-up email. Reusing "standard" protocol language without adapting it to these sources increasingly draws challenges.
Three structural shifts drive the problem. First, communication has fragmented across tools, so the record of a decision rarely lives in one place. Second, documents are dynamic and versioned rather than static, so the file shared on Monday may not be the file in the repository on Friday. Third, links have replaced attachments, so the "document" referenced in a message may sit elsewhere in the organization or entirely outside it. A protocol that does not account for these realities tends to produce data stripped of the context that makes it meaningful.
Mobile, Messaging, and Ephemeral Data
Mobile devices are now central evidence, and they carry data types that demand explicit treatment. Text messages are not email: they have no subject line, sender display name, or attachment family in the traditional sense, and how they are exported determines whether reply structure, timestamps, and sender identity survive. The text message production format is a term to negotiate directly, not assume. Producing texts "as a PDF" or "text only" can quietly destroy sequence, participant identity, and the link between a message and the photo or file it carried.
Chat applications add their own layers. Edits, deletions, reactions, and read receipts can be probative, and they are often available only if collection is scoped to capture them. Ephemeral messaging raises a preservation question that should be resolved early rather than litigated late: whether disappearing-message features were enabled, when, and on whose devices. These are issues a mobile device eDiscovery expert can surface during negotiation, before a gap becomes a spoliation argument. Establishing a clean mobile device chain of custody at the outset is what makes any later production defensible.
Cloud Documents and Collaboration Platforms
Hyperlinks function much like attachments, and the law here is still developing — some courts, such as in In re Keurig, have declined to treat hyperlinked documents as traditional attachments, while the issue remains contested and varies by jurisdiction. A linked document may live inside the platform, elsewhere in the organization's systems, or with a third party, and it may have been edited many times since it was shared. That breaks the familiar email "family" of parent message and child attachment. A protocol therefore has to pick a rule for linked content and write it down: produce the link and surrounding context only; treat the linked file as an attachment when it is within the party's possession or control; or capture a snapshot of the file as it existed when the link was shared. It should also name the exceptions for third-party links, broken links, and permission barriers.
Collaboration platforms also redefine where evidence lives. Shared channels and workspaces are often organizational assets rather than the files of any single custodian, while one-to-one and small-group chats behave more like custodial data. Permissions and access history can be more probative than authorship. A protocol that does not distinguish what is custodian-based from what is system-based invites both over-collection and under-production arguments from the other side.
A protocol commitment you cannot operationally keep is worse than no commitment at all. In In re StubHub Refund Litigation, a party agreed to produce hyperlinked documents as attachments and then could not, because storage limits left many of the linked files unrecoverable. Courts increasingly hold parties to the protocols they sign.
The Protocol Terms That Actually Matter
A defensible protocol does its work in the specifics. Vague obligations like "produce metadata" mean little, because modern platforms generate layered metadata across system, application, and user-generated categories plus audit and activity logs. The protocol has to state which fields, from which system of record, in what format, and standardized to a single time zone. The terms below are where most disputes are won or lost:
- SCOPE Date ranges, custodians, and the specific platforms and devices in play, plus a procedure for adjusting scope as discovery evolves.
- SOURCES Where data actually resides, separating custodial data from system or workspace data, and what is included or excluded and why.
- FORMS The production format for each data type, including how texts, chats, and cloud files are rendered.
- METADATA A field schedule by data type, naming the source system and output format.
- FAMILIES What constitutes a family for links and versioned files, and which version is produced.
- THREADING How reply and conversation structure is preserved so sequence and meaning survive.
- DEDUP & PRIVILEGE Deduplication method and privilege treatment, including handling of linked privileged content.
Proportionality and the Role of the Expert
None of this requires collecting everything. The governing standard is proportionality, and reasonable preservation means targeting the right sources rather than imposing blanket holds across every channel and workspace. Sources are identified through custodian interviews, IT indices of teams and channels, and sampling of potentially relevant spaces. The protocol should document why particular spaces were included or excluded, which is both a proportionality argument and a defensibility record. Counsel are expected to be technologically competent under ABA Model Rule 1.1 comment 8, but competence does not require self-sufficiency on the engineering details of every platform.
That is where a forensic expert adds value at the negotiating table, not just on the stand. An expert who works in these systems daily can translate what a platform's export tooling can and cannot do, flag the gaps before they are promised away, and help draft format and metadata language that is actually achievable. The same expertise supports an opposing mobile forensic report review when the other side's production looks incomplete, and it underwrites questions about whether deleted content was preserved, an area where a deleted text message expert witness can assess what recovery is feasible. The goal is a protocol both sides can operationalize, defend, and live with through trial.
Authorities & further reading
- Fed. R. Civ. P. 26(f)
- Fed. R. Civ. P. 34
- Fed. R. Civ. P. 37(b)(2)(A)
- In re Keurig Green Mountain Single-Serve Coffee Antitrust Litig., 341 F.R.D. 474 (S.D.N.Y. 2022)
- In re StubHub Refund Litig., No. 20-cv-08665, 2023 WL 3092972 (N.D. Cal. Apr. 25, 2023)
- ABA Model Rule of Prof'l Conduct 1.1 cmt. 8
Adapted from Law & Forensics continuing-legal-education and seminar materials (2025–2026). This article is general information for attorneys and is not legal advice; it does not create an attorney-client, expert, or consulting relationship.