• Home
  • About
  • CRAIGBALL.COM
  • Disclaimer
  • Log In

Ball in your Court

~ Musings on e-discovery & forensics.

Ball in your Court

Tag Archives: EDRM

The EDRM Isn’t Broken; It’s Misunderstood.

18 Wednesday Mar 2026

Posted by craigball in Uncategorized

≈ 4 Comments

Tags

E-Discovery, eDiscovery, EDRM, forensics, investigations

Disclaimer: I serve as General Counsel of EDRM, but this message is mine alone: Nothing that follows speaks for EDRM or its leadership.

I recently received a marketing email that contained this gem: Organizations are “asking if EDRM is structurally prepared for investigations.”

Short answer: Yes. Obviously. Because the EDRM was never a structure to begin with.

That’s not a knock. That’s the point.

The Electronic Discovery Reference Model is–wait for it–a reference model—not a workflow, not a platform architecture, not an operational blueprint. A reference model is a conceptual framework that identifies the principal stages and relationships in a process. It doesn’t tell you how to do something; it maps what needs doing. Think of it as a compass, not a GPS turn-by-turn. It orients you. It doesn’t drive for you, and it ain’t broke.

The EDRM diagram—that familiar left-to-right ribbon of stages from Information Governance through Presentation—has never pretended otherwise. It emerged before we had a framework to talk sensibly about the conceptual components of exchanging ESI as evidence. It has always depicted a reference arc, not a rigid assembly line. Wise practitioners always understood that the stages overlap, iterate, and telescope depending on the matter. You don’t march from Identification to Collection to Processing like soldiers in formation. You loop, you backtrack, you run stages in parallel, recurse and iterate. The model accommodates all of that because it describes the territory, not the trail. You want to merge or collapse several stages in your preferred workflow? Go for it! The EDRM doesn’t proscribe that, just as cramming several stages into a single super-stage doesn’t do away with the need to complete the tasks the sub-stages describe.

So when someone asks whether EDRM is “structurally prepared for investigations,” the premise is the problem. They’re evaluating a map by asking whether it can carry luggage.

The shift toward “governed internal workflows where legal, security, and compliance operate from a shared investigation infrastructure” is a legitimate operational development. Organizations should be thinking about unified investigation infrastructure. But that’s a workflow conversation—a conversation about tooling, governance, access controls, and process design. It is emphatically not a conversation that requires or benefits from declaring the EDRM obsolete or unprepared.

The EDRM doesn’t compete with your investigation workflow. It informs it. The moment you need to think about what data sources to identify, how to preserve without spoliation risk, how to collect defensibly, how to process for review, how to analyze and produce—there’s the EDRM, as useful and orienting as it has ever been.

What the EDRM can’t do—and was never meant to do—is be your ticketing system, your case management platform, or your chain-of-custody log. If your investigation workflow is broken, that’s not the EDRM’s fault for failing to be software. It’s a planning failure for expecting a reference model to do a workflow’s job.

The schematic is fine (circa 2014). The thinking around it sometimes isn’t.

Use the EDRM for what it is: a durable, vendor-neutral conceptual foundation that helps you ask the right questions in the right sequence. Then build or buy whatever workflow infrastructure serves your organization’s needs. The two aren’t in tension unless you insist on making them so.

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...

Native or Not? Rethinking Public E-Mail Corpora for E-Discovery (Redux, 2013→2025)

16 Saturday Aug 2025

Posted by craigball in ai, Computer Forensics, E-Discovery, Uncategorized

≈ 2 Comments

Tags

ai, artificial-intelligence, chatgpt, eDiscovery, EDRM, generative-ai, Linked attachments, Purview, technology

Yesterday, I found myself in a spirited exchange with a colleague about whether the e-discovery community has suitable replacements for the Enron e-mail corpora1—now more than two decades old—as a “sandbox” for testing tools and training students. I argued that the quality of the data matters: native or near-native e-mail collections remain essential to test processing and review workflows in ways that mirror real-world litigation.

The back-and-forth reminded me that, unlike forensic examiners or service providers, ediscovery lawyers may not know or care much about the nature of electronically-stored information until it finds its way to a review tool. I get that. If your interest in email is in testing AI coding tools, you’re laser-focused on text and maybe a handful of metadata; but if your focus is on the integrity and authenticity of evidence, or in perfecting processing tools, the originating native or near-native form of the corpus matters more.

What follows is a re-publication of a post from July 2013. I’m bringing it back because the debate over forms of email hasn’t gone away; the issue is as persistent and important as ever. A central takeaway bears repeating: the litmus test is whether a corpus hews to a fulsome RFC-5322 compliant format. If headers, MIME boundaries, and transport artifacts are stripped or incompletely synthesized, what remains ceases to be a faithful native or near-native format. That distinction matters, because even experienced e-discovery practitioners—those fixated on review at the far-right side of the EDRM—may not fully appreciate what an RFC-5322 email is, or how much fidelity is lost when working with post-processed sets.

Continue reading →

Share this:

  • Email a link to a friend (Opens in new window) Email
  • Print (Opens in new window) Print
  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
  • Share on LinkedIn (Opens in new window) LinkedIn
Like Loading...
Follow Ball in your Court on WordPress.com

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,232 other subscribers

Recent Posts

  • The EDRM Isn’t Broken; It’s Misunderstood. March 18, 2026
  • Detecting Deep Fakes February 24, 2026
  • A Fun Way to Build AI Fluency February 21, 2026
  • Electronic Evidence Workbook 2026 February 18, 2026
  • The Most Important Thing I’ve Read This Year February 12, 2026

Archives

RSS Feed RSS - Posts

CRAIGBALL.COM

Helping lawyers master technology

Categories

EDD Blogroll

  • E-D Team (Ralph Losey)
  • Complex Discovery (Rob Robinson)
  • Corporate E-Discovery Blog (Zapproved )
  • E-Discovery Law Alert (Gibbons)
  • Basics of E-Discovery (Exterro)
  • CS DISCO Blog
  • The Relativity Blog
  • Illuminating eDiscovery (Lighthouse)
  • Minerva 26 (Kelly Twigger)
  • GLTC (Tom O'Connor)
  • Sedona Conference
  • eDiscovery Today (Doug Austin)
  • eDiscovery Journal (Greg Buckles)

Admin

  • Create account
  • Log in
  • Entries feed
  • Comments feed
  • WordPress.com

Enter your email address to follow Ball in Your Court and receive notifications of new posts by email.

Website Powered by WordPress.com.

  • Subscribe Subscribed
    • Ball in your Court
    • Join 2,084 other subscribers
    • Already have a WordPress.com account? Log in now.
    • Ball in your Court
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar
 

Loading Comments...
 

    %d