Culling reduces a collection before review by applying filters for date range, file type, custodian, and search terms.

Date filtering restricts a collection to a relevant time period, removing documents outside the range from review.

Deduplication removes identical copies of files from a review set, typically by comparing hash values.

DeNISTing removes known system and application files from a collection using the National Software Reference Library list.

Email threading groups related messages into conversations, allowing review of the most inclusive message rather than every reply.

Exception handling addresses files that failed processing, such as encrypted, corrupt, or unsupported formats.

Extracted text is the machine-readable content pulled from a document during processing, enabling search and analysis.

Forensic collection captures data using methods that preserve metadata and create a verifiable copy of the source.

Global deduplication suppresses duplicates across all custodians rather than within each custodian separately.

A hash value is a fixed-length string computed from a file's contents, functioning as a digital fingerprint for identification and verification.

Metadata is the information describing a file's creation, modification, authorship, and system properties, which is discoverable and often decisive evidence.

Near-duplicate detection identifies documents that are substantially but not exactly similar, such as draft versions of the same agreement.

Optical character recognition converts scanned images into searchable text, making paper-origin documents usable in review and analysis.

Processing converts collected data into reviewable form, extracting text and metadata and applying deduplication and filtering.

Self-collection risk is the exposure created when custodians gather their own documents without supervision or forensic methods.

Targeted collection gathers only data meeting defined criteria rather than imaging entire devices or accounts.