A litigation data mapping guide is most valuable before preservation notices go out, devices are collected, or review costs begin to rise. At that point, the legal team needs more than a list of custodians. It needs a defensible picture of where potentially relevant information lives, who controls it, how it moves, and what can happen to it if action is delayed.
For high-stakes disputes, regulatory inquiries, and government matters, data mapping is an operational discipline. It connects case allegations to people, systems, records, retention practices, and collection decisions. Done well, it narrows scope without overlooking critical evidence. Done poorly, it produces overcollection, avoidable preservation risk, and difficult questions when opposing counsel or a regulator asks why a source was missed.
What Litigation Data Mapping Actually Covers
A litigation data map is a structured record of potentially relevant electronically stored information and, where appropriate, paper records. It should identify the business context of each source, not merely its technical name. “Microsoft 365” is not a useful map entry by itself. A defensible entry explains which accounts, Teams channels, SharePoint sites, retention settings, date ranges, and business functions may contain relevant information.
The map should connect four facts: the source, the custodian or data owner, the likely relevance to claims or defenses, and the preservation or collection action required. It also documents practical limits. A source may be inaccessible, overwritten under normal operations, held by a third party, or subject to privacy, trade secret, or regulatory restrictions. Those facts belong in the map because they shape proportionality decisions and help counsel explain the process later.
Paper records still matter. Signed agreements, legacy personnel files, handwritten notes, engineering binders, medical records, and historical correspondence may exist outside enterprise systems. A complete map accounts for offsite storage, departmental file rooms, remote offices, and active matter files, along with scanning needs, Bates numbering requirements, and chain-of-custody procedures.
Start With the Issues, Not the Technology
The fastest way to create an unusable data map is to ask IT for every system in the organization. Start with the legal issues instead. Break the matter into the events, transactions, communications, and decisions that could be relevant. Then identify the people who participated, approved, received, stored, or were affected by them.
For example, a wage-and-hour matter may require payroll, scheduling, timekeeping, HR, manager communications, and mobile messaging data. A trade secret dispute may center on source code repositories, endpoint activity, personal cloud storage, collaboration platforms, and departure-related communications. The systems differ because the facts differ.
Early interviews should include legal, information technology, records management, human resources, security, and the business unit closest to the dispute. Each group sees a different part of the information environment. Legal defines relevance and privilege concerns. IT explains architecture, access, backups, and retention. Business personnel explain how work is actually performed, including informal channels that may not appear on an organization chart.
Ask direct, time-bound questions: What tools did this team use during the relevant period? Did the workflow change after an acquisition, system migration, or remote-work policy change? Were employees using personal phones or private messaging applications for business communications? Is data available in a live system, an archive, a backup, or only on a departing employee’s device?
Build a Map That Can Support Decisions
A working litigation data map is usually maintained in a controlled spreadsheet, matter database, or eDiscovery project workspace. Its format matters less than its completeness, version control, and ability to show who made a decision and when.
For each potential source, capture enough detail to make preservation and collection decisions without reopening the entire investigation. At a minimum, record:
- Source name, platform, location, and responsible business or technical owner
- Relevant custodians, former custodians, shared accounts, and third-party users
- Content type, likely date range, and connection to specific issues in the matter
- Retention behavior, deletion risk, legal hold status, and preservation method
- Collection method, access limitations, anticipated volume, and chain-of-custody record
Do not treat these entries as static. A data map changes as pleadings are amended, witness interviews reveal new channels, custodians leave, and collections expose additional sources. Versioning is particularly important. If a source is ruled out, record the basis for that decision rather than simply removing it. A documented proportionality analysis is far more defensible than an unexplained gap.
Prioritize Preservation Risk First
Not every source needs immediate collection, but every source with a realistic risk of loss needs a timely preservation decision. This distinction helps legal teams control cost while meeting their obligations.
Mobile devices deserve early attention because messages, attachments, call logs, and application data can be altered through ordinary use, device replacement, or remote management policies. The same is true for ephemeral messaging, collaboration platforms with short retention windows, local files on laptops, and cloud accounts controlled by departing employees. Forensic collection may be necessary when metadata, deleted content, device artifacts, or authentication details could matter.
Backups require care. They can be expensive and difficult to search, and they may not be reasonably accessible. Yet they should not be dismissed automatically. If a live source is unavailable, corrupted, or incomplete, backup media may become the only remaining evidence. The data map should distinguish between disaster-recovery backups and archives that can be accessed in the ordinary course of business.
Preservation notices should be tailored to what the map reveals. Generic notices can fail because custodians do not recognize the systems, folders, text messages, or paper files they are expected to retain. Clear instructions, acknowledgment tracking, follow-up interviews, and documented releases are stronger than a single email sent to a broad list.
Align Collection With Review and Production
Mapping is not only a preservation exercise. It determines whether downstream review will be efficient and defensible. Before collecting, consider how each source will be processed, searched, reviewed, and produced. A collection that loses metadata, breaks family relationships, or omits system context creates unnecessary work later.
For email and cloud collaboration data, preserve native metadata and include attachments, linked files, and relevant conversation context where appropriate. For mobile data, define whether the matter requires messages only, a targeted application collection, or a full forensic image. The answer depends on allegations, proportionality, privacy restrictions, and the likelihood that device-level artifacts will be material.
This is also the stage to address structured data. Databases, payroll platforms, sales systems, and case management applications may contain evidence that cannot be meaningfully reviewed as standard documents. The map should identify the system of record, relevant fields, reports, data dictionaries, and personnel who can explain how the data was created and maintained. A screenshot or exported PDF may be useful for review, but it is not always a substitute for preserving the underlying data.
When paper records are relevant, establish consistent intake and imaging procedures. Capture folder-level context, maintain custody records, scan at a quality suitable for OCR and review, and apply Bates labels only after the production strategy is clear. Physical and electronic evidence should be managed as parts of the same case record, not as separate workflows with separate histories.
Common Failure Points in Litigation Data Mapping
The most common gap is overreliance on formal systems. Employees often use text messages, personal email, shared drives, consumer file-transfer tools, or private collaboration spaces to complete work. A custodian interview that asks only about company email will miss much of that activity.
Another problem is confusing a custodian with a source. A key executive may have relevant information in email, text messages, laptop files, cloud storage, calendar entries, handwritten notebooks, and assistants’ accounts. Conversely, a shared system may contain relevant information even though no single custodian owns it.
Timing can also undermine an otherwise sound process. Waiting until after meet-and-confer discussions to understand retention schedules or data accessibility reduces the team’s ability to negotiate scope from a position of knowledge. A preliminary map does not need to be perfect. It does need to be early enough to preserve volatile sources and inform a credible discovery plan.
When Specialized Support Adds Value
Complex matters often require coordination across legal, IT, records, vendors, and outside counsel. The challenge is not merely collecting data. It is maintaining a documented, repeatable process from source identification through production and trial preparation.
Specialized litigation support can help when collections involve iPhones, remote custodians, legacy paper archives, sensitive regulated records, or large-scale review in RelativityOne. The right team can coordinate forensic collection, onsite or offsite scanning, processing, attorney review support, and exhibit production while preserving the documentation that makes each decision defensible. For legal teams handling urgent matters in Southern California and beyond, Concord Document Technologies provides that continuity across physical and electronic evidence workflows.
A useful data map gives counsel something more valuable than an inventory: a basis for action. It shows what must be preserved now, what can be collected later, what requires further investigation, and where the real discovery risk sits before it becomes a deadline problem.
